{ "Event": { "published": true, "date": "2025-12-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-04", "timestamp": 1764892981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8c54ee13-f7d3-4c0b-a2d7-16ff43214102", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3397fd2e-d0df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764831751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831751, "uuid": "5a30790f-6892-4de6-8f02-aa278d2cff08", "comment": "Malware payload", "value": "161964c485bd5c4592dd5a699a70fe14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831751, "uuid": "bbbc7971-a221-4ac3-b434-7192cbc60bf9", "comment": "Malware payload", "value": "00275e77542c63f6b5ac2851e02049737ba7a7e86f10625e540f13f773573c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831751, "uuid": "d9f0a14a-8f31-4083-a3f0-5fa25dc23bc2", "comment": "Malware payload", "value": "308f4e80a38300ffd1739bf5eea6ef293f7ee47f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831751, "uuid": "cfa2c017-d2c9-440a-936e-4b95b31148fd", "comment": "Malware payload", "value": "d67b14b0043759fd4e979d1f986afd57b9a988f581d9e27c702946dd35e70bbd29a18a2d0af938591a77db45295dbdb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831751, "uuid": "0193d705-1835-4aa6-802c-2300b68c5b85", "value": "T1A1E4AE1077A0C477C5A202311876ABBB9BFAE97956664F0303503F5DBDB32C28A1F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831751, "uuid": "76d1323b-f50a-47ce-a626-1d692e17d72b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831751, "uuid": "d7471c16-34f1-4249-90d3-cbdbc5f0b41e", "value": "768:Y7ra/Tl+hs3E/jU0dugZ0T2Xtz+lHQW40Zz0D3jHUpi1GounzWlC/LPfw3+Ep:x/T2X/jN2vxZz0DTHUpouzWYguEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831751, "uuid": "0c8fa30a-1393-45cf-9b28-9ad20e68a201", "value": 684656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831751, "uuid": "81617273-74a6-4200-8e65-d5998763ecf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831751, "uuid": "2f3ff474-41f8-48d8-88f2-f09531722e71", "value": "zcn1qk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2f6ba1-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883113, "uuid": "6ca8a01a-4057-4b69-82b1-51c15df6c11d", "comment": "Malware payload (Mirai)", "value": "7c9c14b4ea9b25932ed9ec8998fecb04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883113, "uuid": "3c03684d-783f-4b09-a6c7-e6265737964b", "comment": "Malware payload (Mirai)", "value": "004d4a8cb7db29784f0f3f1bef4072a56b9c0d7f135703596e07aac648f07087", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883113, "uuid": "243eff08-2ca9-4fcd-a1ea-0b7c4fc3971a", "comment": "Malware payload (Mirai)", "value": "8033a5142e50963b206837417314e7bc1dd96dbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883113, "uuid": "3fc0225d-2608-472f-9899-f5a6b61f88e2", "comment": "Malware payload (Mirai)", "value": "a250d1657f40dbbb243dbd5c6fa2ecb08a6f51ff0f4419564d5c74120e3607a57478a6ff52c084d06521ea6959724de9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883113, "uuid": "10595094-bff8-4fdf-b05e-822e71904793", "value": "T134343881F987C5F6D80388705096FB3F8A319976D176C75DEF98AF32DA2B601422639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883113, "uuid": "eee82a4c-11e9-45df-b3e5-fe7b8119e207", "value": "6144:eyw5KKjtRpMuhgeZQU9mc4GV5PDXXVzNSC:/INjt3Mu2eiU9mcv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883113, "uuid": "7f997708-db41-4463-9dca-ecf018374699", "value": 232040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883113, "uuid": "e939500c-2df1-4d92-80d1-db23a11d4676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883113, "uuid": "72a166d4-5a67-495f-8cfa-6facb142854f", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a1349e-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875403, "uuid": "d602c051-74d6-4337-926b-83bea15857c8", "comment": "Malware payload (BlihanStealer)", "value": "9b3c8beee85e09ce0e7ca7d3ce852ec9", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875403, "uuid": "891ffe20-1eda-4839-8915-780debac5386", "comment": "Malware payload (BlihanStealer)", "value": "0081d6ef697668923ef8e36ee6b463a194044ad75ae6e9dd74f36ebed2298167", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875403, "uuid": "52d2ed56-40a3-4e87-ae53-1b97c9995143", "comment": "Malware payload (BlihanStealer)", "value": "5a8b3c4110a3d0d94d69122b3316efa752eeb0de", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875403, "uuid": "0db26e2f-d0b1-43f9-bd21-e5de3a47d2ff", "comment": "Malware payload (BlihanStealer)", "value": "c220f06f16ba6316ecb393a10d4db596a35f8b77c5dc4aa3d5dfda9647c3e688e917df0ca35a377306a5644873adb697", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875403, "uuid": "23b844f2-87ab-406e-a4ad-e8bd5a994a7a", "value": "T100C3E7076FB1CCEBD851043A57BAA22D86E7BC440DDCE35697DDCC4634C2918C8AEA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875403, "uuid": "99b00e05-c388-40d8-90d1-e85d85d0f6c5", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875403, "uuid": "06f75fc5-9724-4c95-832f-212d26c3a70b", "value": "3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hK2:eene", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875403, "uuid": "4bf10971-63b8-4bca-9502-992161fd6273", "value": 128246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875403, "uuid": "06aa7e58-61b6-4155-8f13-f78506ab1eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875403, "uuid": "9264fc84-f7e7-4f9d-98a2-d4c62bbf2d63", "value": "3xrg1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544b8ea3-d123-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764861011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861011, "uuid": "553f252e-89b2-4a24-b947-91b476883f34", "comment": "Malware payload (Mirai)", "value": "3045354b41883276b3b2636b6951e10e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861011, "uuid": "2add8c48-da7f-4c1e-83a4-868550a83eca", "comment": "Malware payload (Mirai)", "value": "00ff3c9b845f57259d8a8245d61f9cfe0ee7a1153f2bd582039f9471dd5d3bf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861011, "uuid": "8c3d1db1-ba04-41e6-a91f-7595f0240419", "comment": "Malware payload (Mirai)", "value": "daa2bfb5b9875305f5df36964c18a799097761b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861011, "uuid": "ce46c220-fbf8-4080-893e-c51336065b14", "comment": "Malware payload (Mirai)", "value": "52e88e9d1461d5d5d1a7734c2efdc467aeaf9a5593cf2f413f5fd7d01e126e5e63cdc10f96ee001acc2f662d835ab871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861011, "uuid": "9a2ff639-3419-4ee7-8295-81b37e238483", "value": "T1D0E2F1D9364FB491E861683ACDFC86D8399F0275F97123FE5C200AF621F944266F4643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861011, "uuid": "07a1567c-f970-4c3c-9436-33b843e8498e", "value": "768:VcSschzUWPugiQ8zfIrDqUO8i0m0QQViwmthnB1lhZLZH2Ls3UozE:VcSsjuFyg/qUO3ZBomthz1Lt/zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764861011, "uuid": "a4d27d01-520e-4cdb-bf1f-33aaec26d8a2", "value": 33216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764861011, "uuid": "921ecbdc-c7b2-46d8-b0e4-0e89a62fb109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861011, "uuid": "2bdb0ecf-0368-42e6-aeb8-8343629c949e", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b2e4ef-d0db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829956, "uuid": "7eb62daf-f7b2-4dd5-a676-e6690c20d873", "comment": "Malware payload (Mirai)", "value": "4538f3ee5f1d2acd0e8ff8521959cf9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829956, "uuid": "6ace9a5b-abb7-4ce0-ae43-3eb1a8629a1e", "comment": "Malware payload (Mirai)", "value": "01ff82612808960c59d7ceb23b0943c9f2829ba55c01b561d9612ec669cda8e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829956, "uuid": "e362b0b5-39fb-40f8-9880-bd294d0fcaba", "comment": "Malware payload (Mirai)", "value": "e783902568281f0ec517c7808fbfe0ea9e372f83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829956, "uuid": "ec3dc5c3-b745-4c98-aed9-c8025bdda902", "comment": "Malware payload (Mirai)", "value": "18274f59385a4515af04838f271863452e7e62187d72ccdff57680e880af49cd45f4ff7863c177bfba2c69e5ad836656", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829956, "uuid": "606d25e9-e4ff-4676-b9c5-0076feb53e4c", "value": "T1B2735B41B3880D43C1970DB0363F2BD6D7AFE9D122E4FA852A5F9B4691B1A33154EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829956, "uuid": "085d317f-1620-4674-9d3a-a71235f7ee6a", "value": "1536:uJE+FvWG8T9mCFwUzQz4ln7IHl+94tCy/f7c6t:uJE+5x8TTRkg7IF+7gcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829956, "uuid": "c52e76e9-bdc0-4c38-bb9a-05a4e4e66c0e", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829956, "uuid": "ae22db8f-cd6f-4fe7-a4c2-475bc5cbe22e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829956, "uuid": "548ad0ff-cfd2-4d18-a7b4-74ddd450673c", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472eba43-d126-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764862278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862278, "uuid": "7b904ff1-6fe1-4366-bb1a-e98f91855128", "comment": "Malware payload (Joker)", "value": "a4070af2f7abfaf4fe7eda8ba0b9d69c", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862278, "uuid": "86362503-21a5-432f-9ea7-a88e2e8436e5", "comment": "Malware payload (Joker)", "value": "02033941da2fdd3990e140c6500c8f3feccfccd949259d24a3c11a1636484b0e", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862278, "uuid": "7e34dc69-b2a1-43c2-8914-c35e0dba5056", "comment": "Malware payload (Joker)", "value": "e3cbf053686dc9f86df138f3ead95f83f3a9cec5", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862278, "uuid": "a8f504c8-aca3-4467-821f-44edddb85396", "comment": "Malware payload (Joker)", "value": "a63792bdd8b5e736099d918344536d3aec2e14ac68c4b57eb01c87bcca50905c6a87026b38d1b19e9284e6422ab613a4", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862278, "uuid": "174c17b1-1650-4e15-8d19-8a73522a3687", "value": "T187970146F60CD42BD9FAB07CDD8B47D3B9126C461610C29B2921B60CFEB37D4AA527E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862278, "uuid": "9cfb8cad-0a8a-42a4-945c-8e9f49db5142", "value": "786432:ORtBFyii1jVDi7MTUx/SsojJvT4B+jMNcIeSQcFv4oq:ijOhiQYQsw50vNcoW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764862278, "uuid": "5476bb63-cd1d-4659-936b-bc736c92836a", "value": 42372734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764862278, "uuid": "417a3494-b667-4c66-9154-6904a1483995", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862278, "uuid": "7fc31d8c-6ae4-4ea7-ba04-86dec4ccf194", "value": "File+Text+Messages_4.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d5d6f1-d0ab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764809503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764809503, "uuid": "6d013f03-61af-4b91-943d-a84a0bb611b4", "comment": "Malware payload", "value": "aa555505bfabf5d48aac5548ef58bb23", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764809503, "uuid": "02ca5b09-f5e7-4cb7-ab3d-1323d2c02852", "comment": "Malware payload", "value": "02f685b3b9eb0626045c9c93f503b7d87645ad7377b6fcec47821d2dd55707e5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764809503, "uuid": "8d0627af-cf8b-40d0-b4cd-92f0271febb6", "comment": "Malware payload", "value": "d3738553f183a332e763655769d2b9128c57f8ea", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764809503, "uuid": "f46248b0-0aff-4f99-b59a-0697dd1673f1", "comment": "Malware payload", "value": "95b388bffde294490276087168a65dfe5c2803f4d4c8c993deef0f1f8d75b6ddee719ee869264f12fd972ce117457c04", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764809503, "uuid": "b9c64d92-2a93-4ead-9fee-d4b8a88beca0", "value": "T1EB7342588ACF85F8A55374449BAF4D05FBE58423132CE6D2FE8D79E02F1092DA1F4AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764809503, "uuid": "dbfde176-db66-43db-890b-2a122cd602cd", "value": "768:4rlUq9x2n54BCaCAxTVDV3VAVaNxN5NTNfFJF2FvFVRatRkRccRvBblOeRkmfQKH:am9n5md/BmOCM5ahetY5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764809503, "uuid": "6cc457f2-c247-4f13-a5e1-0c85bd719cb1", "value": 77587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764809503, "uuid": "092d1cb1-1388-4c5a-b9e6-92119a81ec13", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764809503, "uuid": "8da9c272-37d8-4e26-8d21-a214e61c8929", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b600666-d0d6-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764828059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828059, "uuid": "2a6eda6e-4eb3-4c40-90e3-8894889835b3", "comment": "Malware payload (PureLogsStealer)", "value": "915d1fa2c107312214ee8a5f652051ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828059, "uuid": "b3bf60f5-7f1a-4f75-b12d-4ece3602ab8b", "comment": "Malware payload (PureLogsStealer)", "value": "031f3fb6daa600b71515e2734ed6b211ab9e000abe7445fa9628a2319b6f028b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828059, "uuid": "abbb3c57-4933-42fc-b50b-976915883482", "comment": "Malware payload (PureLogsStealer)", "value": "fee923cae34c8f7883c1e0e870630b18296ffaef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828059, "uuid": "9c15eb27-0031-4149-952c-002e946eff8f", "comment": "Malware payload (PureLogsStealer)", "value": "0e74865c758ea848901d2b58b9bae2bbb05632b7957652603409c76b9058f43a5909cf160eb5192c64512be6f25498af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828059, "uuid": "743bc116-1fdf-49d8-a564-1bfc476364c3", "value": "T14DA422D6FA54E496CBC242F0D0BD1ABF82B8C46463A92FA743505791BED024DDCDE2D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828059, "uuid": "1cbd04d9-8e43-43e9-aea7-cbc2a4311aeb", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828059, "uuid": "e8e89465-ec9c-4482-89dc-33d5a89e241e", "value": "12288:hYI1IMEb8fHGBbCJf6yepzXWS6GnrYzP00Zg:hYBNb8PkCJfLedXWSvnsz1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764828059, "uuid": "ff55963d-5259-42db-b512-939ac148d702", "value": 486344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764828059, "uuid": "831585e1-8db2-44e4-bfa9-3c7f56729a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828059, "uuid": "67b766b8-e98a-413c-b26d-d66028b89b37", "value": "STL-2025Swift000E3-CRU9011-XW3110-YA73921-CIR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853213eb-d143-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764874837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874837, "uuid": "4679237a-338e-4ccb-9b84-2e08904bd874", "comment": "Malware payload", "value": "e00ec1feec86b000672f825d60ed0859", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874837, "uuid": "9df8fd79-05ea-4f95-b850-32f8063b2782", "comment": "Malware payload", "value": "039b88209b3fb51bc0b4915ab2a1490de34448c6f5bfb66ac0fa3a5fa16927e8", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874837, "uuid": "3e6e12d1-a8c8-40c4-94f3-28f491bfbc61", "comment": "Malware payload", "value": "4456578a541c7b7e356cb5b17eda01bf212da6d6", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874837, "uuid": "10facbc7-1454-42c9-b168-32ee293b076b", "comment": "Malware payload", "value": "921b115028a037ca33c080572f3d2b4df64cc6172ace2fbcaaed26a8a6f6f01b3317148dba628c3df2afe87842eb8b57", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874837, "uuid": "75491b82-734e-4ef4-b212-96d602f45137", "value": "T1BC7633FB436C3B2ED50B9DB89B35028E60A98F6779287E5194627733CC406F85ADB610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874837, "uuid": "dd94b477-596d-4ced-aff6-deb7896ca58e", "value": "196608:m5OuZWNHm1TdS1UmrpMr3e/MXZcMhHv692FT8XNNDoViOXC:mguZp9oRS78uOM95uNDogOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764874837, "uuid": "39d65184-1bd2-4f31-b14f-6d35566dd40e", "value": 7439377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764874837, "uuid": "ed329581-7996-426b-9147-024544ca88a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874837, "uuid": "481f50d1-1717-4064-859f-48a2f53a3fd9", "value": "fdg2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66d681f-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807032, "uuid": "e6a2184e-5cc6-4f06-b4f0-cbb61bbe4e71", "comment": "Malware payload (Mirai)", "value": "edf02338cb4ca338a2b97a07f055d702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807032, "uuid": "28a2f3b8-1aee-4a6c-be49-0e8e731ae4d7", "comment": "Malware payload (Mirai)", "value": "0482536f0a86fecc67a07bbbb907aec92950dda719e87bc9d84a2be964267299", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807032, "uuid": "3742dca4-0cc9-4b8d-837e-9441ba0c9a0b", "comment": "Malware payload (Mirai)", "value": "15e5ff43ba9923a3805941da4df6c0de2a903269", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807032, "uuid": "14c88dd7-debc-49c7-8bf7-22b123c0c917", "comment": "Malware payload (Mirai)", "value": "e48d6a96c99ce248dbf7ff3eacb384e5198d5168e3a25fa03cb8e2da777e1afbb40fd6b551bbdb85b5681d03e0d03725", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807032, "uuid": "b8f2e370-a354-4aca-a247-dea688cad338", "value": "T1C2534B32FA762A27C0E5A47A21F78B15B5E117DE21A4C65E3DB30E4BFF606406502EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807032, "uuid": "82c6bc0d-82c6-4511-ab68-ac52c62f12be", "value": "1536:wwkfZJxFtojQlvnrj/Byzn7dke4tuItYZ6w8+BwQ3z0XYIfiV0/:BkfZJxFtojQlvnrj/a4LYZ7iYN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807032, "uuid": "8c7243ce-36ed-42c5-85ef-88b28628cde7", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807032, "uuid": "3801c211-bdbb-4b39-927d-2570c40e7dc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807032, "uuid": "b0202676-8c18-41a9-a8a4-671b5236d3c7", "value": "uYtea.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa6b16a-d142-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764874390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874390, "uuid": "57cdb531-62bf-4625-ae1d-d700763a6d24", "comment": "Malware payload", "value": "1633cc9f5762b1d09f52fbd113380eae", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874390, "uuid": "1625b179-d5cc-4b8a-bc50-1c570181373c", "comment": "Malware payload", "value": "04bcc29a99a0044bbdf819242be711a0f3e1aa9ac788a0f3c73ce526017e4653", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874390, "uuid": "cf27888e-311e-41ad-b470-e20a4277fac4", "comment": "Malware payload", "value": "5de47a0844c8cba02f68a7992fc81b35889f4c4c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874390, "uuid": "c66d7c31-ef87-4446-92dd-7d7ba3da88be", "comment": "Malware payload", "value": "d68fda40968c4526f9ce930bf3b76cc3a98426e64f12968752e724e31158e3916264ca71d5cfd4478dd931db66e3b700", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874390, "uuid": "281a405c-9e92-475a-95d5-a127b2092060", "value": "T1FF73608D0ACF85F9A923F458879F5D06F7A5C5074A2CD691FB4D68A07F0242DA2F4DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874390, "uuid": "0dbeed68-6bc8-4d54-abe6-21792e21724d", "value": "768:JMt2yIRIQPLc1ppSXi7cZHuTab0EE8uW26k7esOlg4l6BCyqCivUAZCyBr9jP61K:DRdpH0cfkJCtXvHzUSTJa+9NHzmLb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764874390, "uuid": "9947f335-59e1-4c40-af31-304255645871", "value": 76280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764874390, "uuid": "1776ecd4-7ecf-4d6d-bddf-00a91a1f6c7c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874390, "uuid": "dc0bb3d5-df76-40a0-b5fb-a085987f60a1", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe081d0-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807095, "uuid": "d0a9a21d-6dd6-4b6f-a252-f0e4e70258a3", "comment": "Malware payload (Mirai)", "value": "c5abf9e5261d01ceeade4ad27c8ea33a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807095, "uuid": "cfb56c20-ec47-46f7-acde-bc95f52647fd", "comment": "Malware payload (Mirai)", "value": "04c83d0aa0ba32540f08765138177cca0c6a70bd33eb93b30e735fe220501e15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807095, "uuid": "f5befa59-db5a-461d-b56b-f19aecbe7af2", "comment": "Malware payload (Mirai)", "value": "5a6e65e89fe1c22aacbb94dbf5743b96f7448b87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807095, "uuid": "ff5303c5-3325-4ab0-8233-6bd3c15ebb9a", "comment": "Malware payload (Mirai)", "value": "d5e0a26abde50ea47808d005687da2f3579f7e12c9d8f04a5ac2cfa471c2b3fa99c5301325eb6dfdbe9c4b84c25851b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807095, "uuid": "1bd4156e-261a-4da2-b17c-08009b30a948", "value": "T12CA33980FA87C1F6D91B883050A2B33FCB32D9A540719B9DEF5A9F35DA77901D613298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807095, "uuid": "4b0d4d07-65b0-422e-ab79-04bf41d91154", "value": "1536:glNRGAn9DQJppFLsaECeXMngxpPDr2KZupAWTaacBSm3orQx6Z73Md0Z:gll8JpDLsaECeXMnaJ/a+acBSm4rQ5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807095, "uuid": "b732302f-6d3e-486f-a8ec-32fb2fb4e114", "value": 99700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807095, "uuid": "66b9c8ed-e2be-4216-a8b9-0ef2c0ee57be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807095, "uuid": "b97cda8f-b4fa-46a9-8516-8d0a993ac1f3", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874e053e-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880854, "uuid": "7727ae6a-9ab5-4d61-b33f-4401f457dd2a", "comment": "Malware payload (Mirai)", "value": "a6cbcc9edf175994a578a1249ff4c83e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880854, "uuid": "f58aca21-04d6-4835-87af-f41d0eb8091f", "comment": "Malware payload (Mirai)", "value": "0511ece302b8cd00141d6015688217698e16a1990691a2b0d31b7e2c7984e1bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880854, "uuid": "5d7e332c-5f70-4f03-99ce-1ffc7a3de44c", "comment": "Malware payload (Mirai)", "value": "d5c76b8ae6122c8a7131f3c0bec71330c13a2c66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880854, "uuid": "41108530-25da-423a-a918-15cd6a8fbe5d", "comment": "Malware payload (Mirai)", "value": "4e84850e2c7085d07625ac8696322346b7da65f7552ddbff0c8e1980d68a2a4fe2968324086952fb1b4833f193dd28b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880854, "uuid": "4ee56297-21ef-49ed-bc6d-73482117703f", "value": "T192431854BC929A26C6E4277BFA2E418C731563ECD1EE3202DC292FF4768582F0D6B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880854, "uuid": "21d57766-ebd9-40a5-b795-3c7e81eff793", "value": "1536:wXe9WaJ9833g2c90d9IcjNI62xPYB71/5s51:wXYWyCc90TIQp2xyR651", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880854, "uuid": "8aad3ed6-08a5-4521-b1a3-11a739a2ea38", "value": 56144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880854, "uuid": "53b24629-e035-4808-a1cb-7f03d39d56bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880854, "uuid": "7a276654-6f9d-4d47-bc61-3191721dbefd", "value": "DEMONS.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cd27f9-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764875110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875110, "uuid": "e185de1c-5609-49f7-a536-38c475ad439c", "comment": "Malware payload (njrat)", "value": "de7ffd2e3a68dac535a5b357ff34d745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875110, "uuid": "ef9f56f9-d177-4965-8520-72a833491b15", "comment": "Malware payload (njrat)", "value": "0590c9b057970ad6c9c6ebb50ee29355fcda0ddce150b758fd05b9ca5323b8b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875110, "uuid": "69ad3659-736e-4f0d-bc3a-95e6f880c5aa", "comment": "Malware payload (njrat)", "value": "04cfa9715a923e71daaa0f12d87ae64bb12b8079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875110, "uuid": "e99a176b-3401-4e7e-aeb8-24da445aa564", "comment": "Malware payload (njrat)", "value": "e39156be0f87c8b61c30c336034a47985e1833d8a7e311d0041ed1b437441f0b9f010bc6b5172f81ea61ffc56cb75105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875110, "uuid": "f27d0d94-cf95-4acf-98d1-4e4cd065b027", "value": "T116634B4877958A11D2BD2E7844F297518730E60B6D03F72E4CD160FAABB3EC44A42BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875110, "uuid": "f1501476-b4f5-4576-b33f-3456e865b6ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875110, "uuid": "610298c6-6400-494b-8742-0dadf7c8f4e0", "value": "1536:K6DOToN36tUQviFw1hdXGoBnvbU9fLteF3nLrB9z3nHaF9bQS9vM:K6DOToN36tUQviFCv3Bn6fWl9zXaF9bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875110, "uuid": "ab5ab8a9-b78f-4971-a7ba-446f9dfbc65c", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875110, "uuid": "343beb77-957e-4fa5-802f-5f5a69cc6682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875110, "uuid": "2e4777a7-0e8b-4f0c-a011-fa316dbb466c", "value": "Roblox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb6a403-d0cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764823636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823636, "uuid": "bbe8c92b-f4a7-4585-9de9-55b71aa0344d", "comment": "Malware payload (Gafgyt)", "value": "4c27196c85cec02a11d9a94dabe0269e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823636, "uuid": "c826f8db-c841-4c2f-b7b6-8e3997c99bd2", "comment": "Malware payload (Gafgyt)", "value": "0658c9f92e23f5b8914d511b3a29ce28b170d194343b8c3d6e22baf21aac6c90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823636, "uuid": "119068f7-4137-4bd9-a0d3-9577b91e2388", "comment": "Malware payload (Gafgyt)", "value": "c062dd8d5288a6a11f2fadca581bd73f9538d217", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823636, "uuid": "71a56e95-ecc5-4439-b3f4-bdd64a042d03", "comment": "Malware payload (Gafgyt)", "value": "47e2f1ef0ea100b2f793581fa7fe7b1114d152caefb13d3555764d3f7242d875506c8fe666458d08042949614d5b4367", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823636, "uuid": "2e147f94-af79-4898-bf31-950bc5e194d4", "value": "T1F3B31845F8408727C3D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823636, "uuid": "58408fbe-4a81-4274-9b36-589e625df105", "value": "3072:MSY+46m1qOzsszFPPKNy+AmkZrQAhPDCXFke:06mgOzJzFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764823636, "uuid": "c872d6aa-9632-40f2-9842-6ea14ec25776", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764823636, "uuid": "b7cc11d9-f962-4928-9620-9877a1435209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823636, "uuid": "0849bf5a-4e6e-482d-900a-9da6ce1021fd", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0178f22-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883043, "uuid": "d7d6100f-54d2-48e3-a821-746d69a0a60c", "comment": "Malware payload (Mirai)", "value": "8b00b0f5df3e91996c0261f1cd0b79bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883043, "uuid": "09d802ab-e235-435c-8277-d5526a1d52b7", "comment": "Malware payload (Mirai)", "value": "068c807168cd98fc8868d0c22b38ad59c00b17c2775e2ad01c39c88e610cd572", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883043, "uuid": "01940a34-6e62-47d7-8559-bb948765a9b2", "comment": "Malware payload (Mirai)", "value": "6c3a3e03e899c93ba6f2de13b35333574e9bb035", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883043, "uuid": "19a0c557-ce48-48c2-9768-3d1e13c4cf77", "comment": "Malware payload (Mirai)", "value": "4ab60159067d03fbaa4f82c6f210f6e5567ff66ebfc399affb8f05e672aa402b5348fa40e506d3d3ea6f7b28d001018a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883043, "uuid": "3f32d7d9-0bff-4992-9fb5-4c8c3d3d5491", "value": "T16B83022953876BB4CB93B3736FD28588ABD18B5A64BACA304381DF05CC4C572C906EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883043, "uuid": "e0105f6a-d40a-4828-b18c-7611336ecbd6", "value": "1536:aO1CRZ0UI9QYwS1JW9Ah6C/FCVj1JbMHathCghCsHj4SbggwM54u+qgw09q:p1VKYwIJW9AhLCjJbBR74rgwM54u+qg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883043, "uuid": "4f19e624-997e-4cce-a6b9-7638c16001b1", "value": 82120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883043, "uuid": "48c5e216-faf0-42b0-aac3-1178f153a935", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883043, "uuid": "bf7477cd-0293-4316-9cea-d0950476045c", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e966fcc5-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764829049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829049, "uuid": "9d4257fe-c27d-43b1-b4ca-645351ffa289", "comment": "Malware payload (Gafgyt)", "value": "9f1c3a80d34e75fc521e1f2192c96fce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829049, "uuid": "2a6d0a68-3c26-4c06-ac2c-b80440f34c20", "comment": "Malware payload (Gafgyt)", "value": "0696e46a4622542358d4e04c3992f38fd3fe6237560b6f39a9d4eb3aee887c0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829049, "uuid": "0914d894-2417-444b-ac4f-fa36cd12428a", "comment": "Malware payload (Gafgyt)", "value": "4be5a174ff7c633cd539daa32ef7ae827fb9d9f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829049, "uuid": "4fb185b1-c6eb-42f0-b971-7c25856e119b", "comment": "Malware payload (Gafgyt)", "value": "47e24800f61f7601959c625eca3bc77618fffc7c3583a77b24dd32454f2d52e7df06713174763fce43481f15069dacb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829049, "uuid": "7c115adb-9ec6-4427-95c7-8f99916d70a8", "value": "T1F3735B136991CB7BC4C747F92FDB952144A3F83E1B32620A73D8BDA92B1A9D82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829049, "uuid": "00b989d4-030d-42e1-96e0-9aa4f419b2fa", "value": "1536:Y7IZuUaH+1iDnD+Q8bQ8O32Ls0FnswNSzvmA+JbOm/coZ3ymj:+Eae1ItqQH2LDnsESzvm/JbOmEoZimj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829049, "uuid": "ed9f65a3-2e0f-40e1-884d-4e8b64bc36ae", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829049, "uuid": "c5dcac3f-5eb1-4a49-a97d-0fced956ef35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829049, "uuid": "bc8dd016-c43a-4c6a-b1fe-65b129680cf9", "value": "bootingworld.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce73f261-d0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764839741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839741, "uuid": "0437f4ea-97d5-478e-8d8e-f884e33d5e74", "comment": "Malware payload (Mirai)", "value": "25a195210f04e291a3f4b93fe1e9496a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839741, "uuid": "64b4d4e8-772d-4e6b-a16e-ec3265d1b885", "comment": "Malware payload (Mirai)", "value": "06e8c2b82ca3482cb92309962f5aafcd05778b45bb2cc6b9cec1dab606f3c929", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839741, "uuid": "1db8d798-56ef-43dd-80be-2d254e22d708", "comment": "Malware payload (Mirai)", "value": "1152f7ea006070354e31c0485961844866970d7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839741, "uuid": "6ae3aa89-8365-47e3-80fb-24b672fb05f0", "comment": "Malware payload (Mirai)", "value": "5e84d0184c54fc8fcdea7cd57591503c466326f76ba09ed024a1e630fa9de88fdb928db5fade0f3a9bab487e23799270", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839741, "uuid": "4aaa8463-867a-4e85-bf40-4ef7378f3bd5", "value": "T1B9B36CC5F593D4F9E91242B12067EB339B37E43A402AE9D7CB985D33A8A1490D31A37D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839741, "uuid": "b1e9b04d-4eb4-4d00-a019-9d59802fb7af", "value": "3072:OC2E5TXqHcYr/7/rjSTvfnYcGn4w3BC6fV7MX4lH:OC55TXq8C7/r2Tvfn63owAX4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764839741, "uuid": "cfd74eef-2176-4047-8abd-98aa4fc5b5aa", "value": 114468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764839741, "uuid": "81442daf-4e85-421e-b53c-da37e1c086c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839741, "uuid": "c63fc6ca-88e3-4c23-9b93-876e55145b84", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5155ad90-d0d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764825358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764825358, "uuid": "4dd8cab4-a501-424a-8c2e-e68da87cab16", "comment": "Malware payload (Mirai)", "value": "aa745cb85aab0e98fba1bf1360bf099c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764825358, "uuid": "8ac1f2ba-164d-4941-a513-e3ab3b1efa8d", "comment": "Malware payload (Mirai)", "value": "0788c29730c2a6772949607a863648d12116988fbcf89f62e26ea25ad8f8dd0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764825358, "uuid": "3208cf8e-3ee4-4361-b7a3-93ca40fe78a4", "comment": "Malware payload (Mirai)", "value": "4f37cf0a450bd8a5d912e530acef0775a2e6f4c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764825358, "uuid": "60488283-14f5-4747-9a0a-d1877a7b23b9", "comment": "Malware payload (Mirai)", "value": "343331e886d2c5af13d80099dbf49c8544ffa9614eef22e5335d48071bfd982ae8bb8f6deb516ab9b2e542890f8f1db4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764825358, "uuid": "bb3460a0-04da-4c7d-b8c4-548aa87c43e1", "value": "T1C303E060818594FAC7B0C433DEA0C40AA3476BF5D4ECF06702478BF6C6B05F5AACD6A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764825358, "uuid": "56b6f0ba-5172-4343-ba44-4171adec4d42", "value": "768:T/AUEa797ta0ZG2m38Znqwwww2NhBiFC303qLq3Uirk:v9lJ9W8ZnqwHNhEKwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764825358, "uuid": "fc13e805-ca17-4892-88e5-1f20a2861368", "value": 39556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764825358, "uuid": "35e0643f-d094-4420-82f9-d25c493259b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764825358, "uuid": "68997c2f-9551-40ac-b5ac-d5d94d496c02", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2775b1c-d0d6-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764828071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828071, "uuid": "c7bd1532-c03c-4a69-990f-e6808a081df2", "comment": "Malware payload (PureLogsStealer)", "value": "af637ae157add50d32f21472b31cb88b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828071, "uuid": "74e9995b-a582-49bc-b057-40ae74f0152d", "comment": "Malware payload (PureLogsStealer)", "value": "07d60e2e2eeaa29464bfa3815e54f72d194a3847ae9336b30d3cf9ed3ebd0d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828071, "uuid": "56611c4f-cf85-425a-b4fa-d42294119fef", "comment": "Malware payload (PureLogsStealer)", "value": "b907f3869e69b6b8fdc7a9dbd8ebc3aa1f7e516b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828071, "uuid": "442822f6-926f-44db-a8a8-dddb7ac65b38", "comment": "Malware payload (PureLogsStealer)", "value": "4eee91f8fdaf62dbd737bf6db70e33f8057965199a9c6cafaf7bb2cb1448ec4781423fbe7ae5db2b6c57bc096f6303aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828071, "uuid": "1e143815-0200-4b3c-936b-7d7c49fe462b", "value": "T118A42292ED51E8A3C7D21CF688ED125E4A74D32877868E4613400FD8F8993DAEB5F2D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828071, "uuid": "93af76fe-04ab-4892-8d42-5c18b1a23545", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828071, "uuid": "55a74069-d718-4db1-9ee3-ac2b8d756819", "value": "12288:pyd+Q53+SBVwnl4/+13D/hTk7MnrYzP00Z4:pydgSe+mx/hTSMnsz14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764828071, "uuid": "d8520463-d2dc-4054-a999-f317ccda8c18", "value": 463344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764828071, "uuid": "94692eb6-a515-47de-90cd-6b8f121abaaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828071, "uuid": "6adf5582-31b0-4819-b3f2-6474b16c544d", "value": "USDSWIFT421-DK481-HTYC8002-039001374-CNT58000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4416088-d136-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869440, "uuid": "f49ec1d2-1011-4ebe-9215-bf760ce4560b", "comment": "Malware payload (Mirai)", "value": "8e80c890a267053dbce31e33d2c3b5ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869440, "uuid": "25a4dffb-5414-4e81-abf8-06b425665f95", "comment": "Malware payload (Mirai)", "value": "08175b72020012a3c4542d2f37e002a0a04ef41d1c99eb74442ba1d35cc699cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869440, "uuid": "8cee7989-39be-4092-8552-3a76bf76cb60", "comment": "Malware payload (Mirai)", "value": "b2308ff25599d632fbaff0f61fef23b726dd5e5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869440, "uuid": "0e7918fa-f7ac-4688-b471-0ccb03b92fd7", "comment": "Malware payload (Mirai)", "value": "6a21074b827b08d80f5fa5cfe1073e16831a5dab247ccdccf20d1ad0cc71c7e91c66c67329132d045b41b87745039f0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869440, "uuid": "7ddeff49-8d21-41f3-a53a-840b33b4d8ab", "value": "T139041986FCD18E12C6C612BFFB5E418D372657A8D2EA31039D266F21378B46B0F3A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869440, "uuid": "c2d2b4ad-09bd-4e49-800d-b5c236bddd2d", "value": "3072:QI50Uxgm2YMaAixBgHg0CS9uF47Yq89rjz4KOjHq:V50Uxgm2AngjHQF4sqArjcKOjHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869440, "uuid": "d8c2f02e-ea1b-4a1e-9007-423729eaf07b", "value": 176448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869440, "uuid": "8f7a3f9a-6506-4dda-ad9f-789af16829a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869440, "uuid": "ed3e4b32-09cf-417e-a072-963020ad0c16", "value": "Polar.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b0d9f6-d134-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868535, "uuid": "4ee93979-b41a-4c98-8d8b-000b1209fa3e", "comment": "Malware payload (Mirai)", "value": "83963613eeaeaeb15fc2d99591d93fbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868535, "uuid": "b491dae4-3d56-4d9e-a685-53f2aa5e5af7", "comment": "Malware payload (Mirai)", "value": "08ae005f1cc8abd47effeed2e97daaac8b10070fe9354ec6c04f7702df416686", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868535, "uuid": "9c9f8029-7118-4e2b-a055-090ef43da1b1", "comment": "Malware payload (Mirai)", "value": "cbc0fe885273136f02ab5ca7024fc65917741710", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868535, "uuid": "def3fb75-f6fc-4a78-a453-3129b6435f99", "comment": "Malware payload (Mirai)", "value": "1275149843a2e7785b4c4df881250a69b5114c748313e7e543d73a3751606072ffbe6a6ebe23ccc59c89b19f3dde8571", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868535, "uuid": "ec7d12b2-ac6c-431a-acbb-f3b19be233dc", "value": "T14EB2D1338B30BB31CA30083BBC3AD611DF965B3195BA745A19694B252FC1ACF52BC58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868535, "uuid": "95542932-949d-4f68-a49a-d72ea8bcd89b", "value": "768:4bOIC33oVXf7LfjsB1oKKwDP40cs3UozR:4beop7LbsBjKCPHzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868535, "uuid": "b17edb5f-eb85-4297-943b-a16ade91ceaa", "value": 25644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868535, "uuid": "35285c29-b6b3-486d-a4e8-6f038b016a61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868535, "uuid": "5e34e830-824e-4aab-8eaa-d7dd5ff40816", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca7d131-d138-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869964, "uuid": "a0a6f328-5e1e-48fe-b757-d6f814b35657", "comment": "Malware payload (Mirai)", "value": "898f5aad72e870b673658e617061c93e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869964, "uuid": "5c126f6c-f819-45cf-b76d-3e6d0fa6cd02", "comment": "Malware payload (Mirai)", "value": "0939eca605511651bd4526a976e059a51ac8fc16944f2a969c0d490931c7a0b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869964, "uuid": "aa3b2c91-029f-4fc7-a921-5be73a3759ca", "comment": "Malware payload (Mirai)", "value": "e1029409b721a92bfab7fd2d28ee1e3c21a030f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869964, "uuid": "d1069870-109c-45cd-9e09-b6e97f1a8de3", "comment": "Malware payload (Mirai)", "value": "0d3c2b27f73f0558793a08fce81119faea6b87a62879682383f28da69dce12ab8bf55cf76fccd77631b14f0fbac6b74f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869964, "uuid": "a5396dff-b0dd-4fa6-abd1-347fef455aaf", "value": "T1F4D36BC5E68FD0F5E85215713036FB365A73ED3A023EDA83D3A89A319CA3981D61635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869964, "uuid": "5293bc58-79db-4387-92a9-70a0caf2ff5e", "value": "3072:2PELV7AWrEFFrpX0KENKuLa6MjFWB3lL6en1CI:gELV7fEFTrENhlu+1CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869964, "uuid": "9212fda8-0d65-42e6-8a3b-439337697430", "value": 141676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869964, "uuid": "477b951f-69bc-4793-85b2-cea1b8375c09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869964, "uuid": "c5a3c29a-c67f-4be6-bfd3-a6540e0ba803", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb7bfc1-d161-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764887894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887894, "uuid": "988f963a-354d-4fb5-b10f-f3142a01e0c6", "comment": "Malware payload", "value": "263d648ffc4713d9681787e387006c10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887894, "uuid": "21ce73b1-f4ca-40a0-af3c-a2319d2bf462", "comment": "Malware payload", "value": "095acfb43e0b54a29453204af2c755f7b0cc103bac0c53e05c2e1cfbd97a2787", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887894, "uuid": "10b7af44-97b8-467d-85f2-1f44b59a73c7", "comment": "Malware payload", "value": "d72fef89582c0b07b61bea3f91b066e362d103d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887894, "uuid": "0ec0638b-22fd-49fb-9839-b8f8fa61ffc3", "comment": "Malware payload", "value": "9a8cdefd79e475aaefa909a59981e84f8aeb8098f5dae6fbaf10643f11a02ab5ee7cd4dcea3292744ef5a49716606213", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887894, "uuid": "d5c51b54-39bf-4ee5-9e04-c04cbfe3b23a", "value": "T12373A60A6E22DFADF768C73587B78E31D798339226E1C581D16CE9045E6034D681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887894, "uuid": "5c4ab9f2-352d-46c5-b262-53f888ceded5", "value": "1536:KtySQepXpXDTAs6dhkCVCB7Z1JS3k/3ht/33pfFnci/QacAu9:RSlp9GyB7Z1dLQVAu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887894, "uuid": "edebdcf9-4631-4ad7-8cbd-b18ee567d772", "value": 79956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887894, "uuid": "6aca4872-ce0b-4ace-87ad-694ea108a48a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887894, "uuid": "41859026-6fce-453a-9bc6-8d915e64b40f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcca3b22-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829082, "uuid": "cb30d8ff-8a66-43c9-ac48-a260eba95115", "comment": "Malware payload (Mirai)", "value": "301fdaefd4d83871c6e6ad6b31a77616", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829082, "uuid": "b1ae6b55-fd9f-4c46-b760-0638949505b0", "comment": "Malware payload (Mirai)", "value": "0a3cc4cdf8b1b4bb52da31527fe2217a5a00b1c47b7bee7b29e5daa117094114", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829082, "uuid": "47f90a6f-21d6-4f9e-8c65-b2b3e9c4adf1", "comment": "Malware payload (Mirai)", "value": "6ba8887c0fb0c20312eda30a7d85d40c81edd853", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829082, "uuid": "e8a6329b-3023-4987-b0a3-ecd8ed44d054", "comment": "Malware payload (Mirai)", "value": "1c7b96b46fee22296e6442104514c02f6f90f4f5469afcc1d572c2198ce2bd43319171c3634a7bd1345e476a59c6cdd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829082, "uuid": "674b9a20-384d-478e-aeeb-332ee420916b", "value": "T1B513F119A25F85E2CD202D39FC114BC71E84A7B1B2E9302147989BDEBEDC3B25BA5144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829082, "uuid": "35740891-3d2e-43bf-aa70-79d3dad25e3a", "value": "768:aaU5jg+eO3dCE5M+nHo2mu3NnrQy3txM3cP11R1gHv6tpfVO6fAJFaqWDjKTTNSR:aaU1g+F3nM+nr33NnFLYK10v4XYWqqKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829082, "uuid": "e7b6c367-2110-4a66-b775-db30c37e38b6", "value": 44760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829082, "uuid": "09f5fbe7-7fc0-498d-a693-5176b4e8350a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829082, "uuid": "4e80ee30-85c9-47c3-8ce3-2160e0e1500b", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3b8776-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764833944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833944, "uuid": "6f31c6e8-840a-424b-9c38-ffa507f2afc1", "comment": "Malware payload", "value": "4b6ed72e31145d2ff5c728409952c586", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833944, "uuid": "01c85cd6-9868-420c-88a3-a4abb836a4ae", "comment": "Malware payload", "value": "0b1ecb1d5505123ee64955f4cca064997b0139a31a8bf199097c7ab3d61d6a91", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833944, "uuid": "045e4e1f-80f8-4a9b-94fe-105d4997f593", "comment": "Malware payload", "value": "a31f17f5159ed42c3f5c0a69509e4a3870ed9f07", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833944, "uuid": "e7893945-6671-4d6a-adec-a0c39fe6c1ec", "comment": "Malware payload", "value": "72d30f318977c489b8d8b0fd35108678f4c1409e1829eac922e3c26ca4674ed5a4749595f3455593f03ae0415440a369", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833944, "uuid": "d4975863-c179-4846-86c5-0e8119583981", "value": "T142164A02B970D6A5C09AE239E8B191927F31BC98073237D31F767A720DB27D4DA76358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833944, "uuid": "c00cddda-c493-4cd8-8275-a4014cbffc61", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833944, "uuid": "ce0b7aa9-3f2e-4ec3-9098-5440891cf415", "value": "49152:/YsiwDeJSp0ekbW45bHajKIeaUP9tp35/9Ag+zY8W2GTy:fPjhm5/AnWxTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833944, "uuid": "5afd56cd-0fd3-4845-b837-aecc20724d53", "value": 4412368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833944, "uuid": "417276f1-77ae-46d2-8f86-9e73e5669c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833944, "uuid": "43303d70-244f-47fa-b825-9f5d45e00e58", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2814b4-d115-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764855224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855224, "uuid": "c219df17-af70-4fc3-a60b-9e8dc3e9fe7d", "comment": "Malware payload (njrat)", "value": "ee78fede5ea55dcce49fefb3c7e13537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855224, "uuid": "fdb22b37-9afb-460d-a945-ca53d4a9164a", "comment": "Malware payload (njrat)", "value": "0b5c1b777491d7f267bdb5b1eb6e687323799f85ea5eac44f3db11a84c7f505c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855224, "uuid": "97c0b595-9d11-4eb0-a650-1d2051c1d2b0", "comment": "Malware payload (njrat)", "value": "82dc07b2094d8aa1b9a51cf5ccc673c106081904", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855224, "uuid": "90adb8a8-e677-4823-9a3d-a31f4c7f9fc1", "comment": "Malware payload (njrat)", "value": "1b74768d9703942093006295b38e1c44c88d9fcf1a319b5ce74c6e82a67e968abc151f8372f1d6aa5ad04897df0d18e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855224, "uuid": "276c35a3-b47a-4b47-be9c-e91974b6214b", "value": "T11625C0A173F4851AE1FF1BB4E4B149494BB7B9529A36DB4F4D8890AD1EB37408F103A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855224, "uuid": "af9f8700-d317-4d38-a7f8-1c6511a72a9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855224, "uuid": "1c9c3e9c-4c51-4fa7-a768-feee1a264165", "value": "24576:uXUeAxJzck+uGW/yFoBkkAQqOaxeT/tp:uXUeATYjqqanTB7T/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764855224, "uuid": "933371cc-ce61-4fc7-9ca9-0ae526cdf489", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764855224, "uuid": "d120027d-2fdc-4827-879a-a5c22f23382e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855224, "uuid": "28255f92-6d16-40a2-88e3-2e152e2a37c5", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964d1639-d16a-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764891616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764891616, "uuid": "35db5fe0-d964-4450-b662-8c434fda531b", "comment": "Malware payload (PureLogsStealer)", "value": "3074464547b17af64e3a302400444954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764891616, "uuid": "a433baaf-4053-44ca-8961-2e628aac4b78", "comment": "Malware payload (PureLogsStealer)", "value": "0b67d298c72d5ce44862870a253e2fae7011e9bb615b4edb17fee6227f252819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764891616, "uuid": "bfee821b-0ed3-4113-b934-28d849bd50cd", "comment": "Malware payload (PureLogsStealer)", "value": "166eeaa34791465cde69526a01cda71e34996a5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764891616, "uuid": "963e9a1d-c12a-4f16-a693-ef226c028d02", "comment": "Malware payload (PureLogsStealer)", "value": "283dec95644d1073788d742720f2f4a44e5f1f078924c3d31d8d1a885a13ddaf92caca94cc22fc4dd47ef1c3b2e6f5ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764891616, "uuid": "b4868596-1c75-4544-8453-fc69bdbccb10", "value": "T1333522A6529ADD22C49407B01DB0E33857787EAEE472D34F89DEBDFF3235B001914A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764891616, "uuid": "99887072-a649-41db-8622-f958115f53b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764891616, "uuid": "6837557c-50f4-4492-a3b3-a6baa235464a", "value": "24576:uIBmGFhVSSvRDxzJing9qpwjRK09aN+n/Z+I+v:pBmG7VPDx1VqyjRK09cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764891616, "uuid": "6f359c62-d5bf-41a1-bfd8-703d01e82921", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764891616, "uuid": "a917be4d-9b6f-42d0-919f-bea90dc21a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764891616, "uuid": "0d1b7ec9-5f51-4678-8ee1-571aef5d0468", "value": "Enq-01431003525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c5b8c0-d0bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764817933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817933, "uuid": "936788c1-529a-4906-866a-c1c3baebea72", "comment": "Malware payload (Mirai)", "value": "fcb2526b9be74f72fcd68fd3f2cb07bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817933, "uuid": "6a1cd534-78de-44bf-af63-367a4c25e508", "comment": "Malware payload (Mirai)", "value": "0c2fc7a67744d1f8f7c1e65c74d33eca19ee18aba95ca6f60d66d967ffd2c738", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817933, "uuid": "9f5893fb-8e23-4b19-846e-3112cdc395b7", "comment": "Malware payload (Mirai)", "value": "d2e7f46fc9b698960cb08efb4b7452c4d3a4237e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817933, "uuid": "9c5ab417-9b50-40ad-8628-5070a6f50e40", "comment": "Malware payload (Mirai)", "value": "7e3a59c25dab0002ff9344db8501ab189d3fc070e61d84d16d8975b05a21fbd248484ef6365c615962065737c45bd02e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817933, "uuid": "9b9d199d-f9cc-4349-8c14-29cb4b4f8edb", "value": "T19563D95A3E319FECFBA982354BB38E21675C23CA26E1C5C5D19CD6011E7034E245FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817933, "uuid": "e275f3a7-9234-4c59-8644-5965351601ea", "value": "768:4jEjlaB1YS3Mi0c6IBSTn94PuRMeQfWjylphK5uLHeF1gv3ttDWeACmknJv9CSjL:CC63MKWnHf2mknJv9CO47SB0ezjoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764817933, "uuid": "7d467410-160b-416a-87cd-cf63e93f8961", "value": 73340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764817933, "uuid": "2951a6c7-e5c3-4aa8-824b-73eb5b2bb239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817933, "uuid": "a3ad8e1d-f22d-4212-a81a-5561bc04ccec", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eeccb6f-d0d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764825381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764825381, "uuid": "24fa643d-af73-4349-8953-a4d9726a2e2a", "comment": "Malware payload (Mirai)", "value": "7895dc16c5cf0cce4176e230f366f8aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764825381, "uuid": "a7064843-ca51-4d1b-b25d-c736898c6e24", "comment": "Malware payload (Mirai)", "value": "0c77a58eda1b365e87631178e03d3869a92b3f7d900e00d48086b9f2ad1621ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764825381, "uuid": "485bb099-db51-4531-9070-7dde7935e860", "comment": "Malware payload (Mirai)", "value": "0dcfbc259ea45d6b0108d0217a985bd96002158b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764825381, "uuid": "bcbd07f2-9492-4239-9f73-65c66d9ed805", "comment": "Malware payload (Mirai)", "value": "77a689e33d9a94b5361f63650997ac31cc0c94d81194d9e28462b62f262c14f933594a18b0d2e76929119f884ba47e96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764825381, "uuid": "d23a59ec-4db2-44bc-adb0-f76806133616", "value": "T1A383F805A9819F01D5C731BAFB9F515933236FB8E3F97102DD20AFA423869DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764825381, "uuid": "44f0fa7b-ac10-4d6c-8665-111881ebf1a1", "value": "1536:wGn03gRzigRPHA6I46xNjza25Qkn4RP0jtdlfcfQiEBHlat4YvoVm:dR1A6IrxNjzaGQkn4RF0Hlat4/Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764825381, "uuid": "f82150ad-3d0f-4324-90aa-d635afe6b420", "value": 85880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764825381, "uuid": "116c83cb-3327-4093-a20b-7dbce450754c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764825381, "uuid": "8b58366e-6195-4be8-abb4-268687ef8f43", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f240a25d-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834647, "uuid": "55e99f48-9a66-41a7-bac2-c9fb8579fa4a", "comment": "Malware payload (Stealc)", "value": "77a4ca340598a2ce6ee5a40c43928ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834647, "uuid": "e57d3134-9d8b-4351-b391-56e87d99733b", "comment": "Malware payload (Stealc)", "value": "0cda6733515c70152ffa0b1877192131ea18986f40ab10f6b081a3322aecc8c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834647, "uuid": "c1965c5f-b933-4102-bfa2-75f68af893de", "comment": "Malware payload (Stealc)", "value": "fd83ccea170c16fc124454be95ded335f5ff3662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834647, "uuid": "d4ae46e3-1dfd-40bb-ba60-63292d7aa556", "comment": "Malware payload (Stealc)", "value": "b61070c137676778983b192b9ca9c2d8d4dc817d66c9ffa400a9ff0955d7d371909edbfe54d7909365cf09c147b1d53b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834647, "uuid": "eb2b67ed-4cde-4ae7-9780-94de87b51f83", "value": "T119E48D5EE7A503F8D0ABC278CA428582E7B2B8555770978F03E146B62F376A05D3FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834647, "uuid": "04fb8a9e-c0e4-4e46-89c2-621df88ea082", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834647, "uuid": "d63b9181-58b1-4f0c-8b01-6964e3f8036b", "value": "12288:lGLVpIo/cBJ9InRPehbyv8plnEUCv3YZtF15kjH:lkkBJinRP6bw8TEUW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834647, "uuid": "6cf59044-35a3-492a-a9cf-950e36852616", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834647, "uuid": "8690be80-999c-4784-b927-22cf2141a97b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834647, "uuid": "a429a738-1d0e-4400-b6c4-2fa8b23edf39", "value": "3kr9e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b3ac6b-d0dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764830739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830739, "uuid": "ef059a14-a3ab-4a98-a2be-b8eaa7d1e12a", "comment": "Malware payload (Mirai)", "value": "716a388ac5af73935c5d44dc38ee1a36", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830739, "uuid": "53027aed-3aea-4334-ad25-36250a2b0e10", "comment": "Malware payload (Mirai)", "value": "0cf7ec227b8b4e59139945929c467465bd01421ceeeadcd557a46fcddd405d0d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830739, "uuid": "2a3fbb52-2dc6-4405-a63e-0b7748b35a33", "comment": "Malware payload (Mirai)", "value": "84bae3aac3bc1e55bf27c3f15c383fadb47c54f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830739, "uuid": "b24c3e93-bb4f-4bd6-9172-ba1f5afd93c5", "comment": "Malware payload (Mirai)", "value": "1389553b3c609d5144d2f860a2d516fef178aad1687ff341616caacf72b00758d46bca7146ce5001e18c8ab4095280e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830739, "uuid": "58620665-3891-45d3-9c37-65c61f949aaf", "value": "T19B1142BA02A0EB06001E4F4479990548B7DABEF4F4B94E5CD8C6483678F66097399F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830739, "uuid": "0a974783-64eb-4fec-8187-9583bcd9d079", "value": "24:2NBKDwNIBx8bKC5tkfWQPhcNdlNwkls6ofT9Ril+UstLGqUNtoMxn:2NBKDPx8b75tkfWQpydTtls6ofTjxUsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764830739, "uuid": "54139dc3-e646-416b-add3-5e9d2d368790", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764830739, "uuid": "4bfe83b5-8ab7-4563-a0ff-097c84e266b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830739, "uuid": "1e002d9b-41cd-4732-b75b-183d04457c6e", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e7fe10-d136-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764869419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869419, "uuid": "23f66df9-8b6d-4f38-a44a-b306b4faf01f", "comment": "Malware payload (Vidar)", "value": "9910659c40859894e9483d9a8f61360a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869419, "uuid": "843edf94-3d82-4186-a12d-70577bd9153f", "comment": "Malware payload (Vidar)", "value": "0d3a4e0faeceb43cb9803cc22e8cbe7ce650c61abfc84daaf8fdc3bf47c43d3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869419, "uuid": "fe53c520-cb9a-4828-8b47-99c74c8b6f8f", "comment": "Malware payload (Vidar)", "value": "b6f2c3cfc42bc14c82c28c2b676652420ecdc718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869419, "uuid": "9587357d-2c0d-401b-811e-28349c92af3d", "comment": "Malware payload (Vidar)", "value": "ec26b80ee7ccd01d9bebe88f150bf6303ad2c9d3ce26f9fed6d8e5f608dc3287c3c37ae0357ad0d0f4a89fd294756804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869419, "uuid": "4080b57e-6db9-43bc-b064-998bbef0c602", "value": "T16EF623D32EC99158D0864F31A68F5B9871D2F7C84CFB1A1D3ACB2807D571F93868A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869419, "uuid": "67b48ce8-861b-41cc-8789-65bb02362085", "value": "663db01aac141130c0fe8631c0bf50ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869419, "uuid": "e69d21e8-0bae-41ae-bb2e-354ae8aa914c", "value": "393216:ascR+Lpl0pkNN1xGkFFF8zs2xikSgBrifNVmA9:KRAplTTGgCSgBrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869419, "uuid": "79dbf3f9-597b-45b4-9084-9b49c0f06ba3", "value": 16582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869419, "uuid": "092eaa94-d617-4e00-b6fd-14c846f7b9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869419, "uuid": "18a0b892-cb00-4ab5-b53c-53bfd5a48359", "value": "G\u0430Iaxis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c2390c-d134-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868537, "uuid": "3837110a-c3ee-47cc-b1a8-e6a98894231d", "comment": "Malware payload (Mirai)", "value": "ee8e5f5acada437372b6df10bcf6d4f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868537, "uuid": "499f932e-bedd-4085-9cf4-9c3e476c5fe3", "comment": "Malware payload (Mirai)", "value": "0db6a24801c0d8c0d3cb88c3fb40aaced0e50a4b96b56f9a8389238b3cc643be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868537, "uuid": "efe58fca-f964-4eed-8359-2d182598dd34", "comment": "Malware payload (Mirai)", "value": "b3991c08fbc60fa45e19aed07e619701b4db6356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868537, "uuid": "7e1ca335-39cc-48d4-a75f-1421f6d77da5", "comment": "Malware payload (Mirai)", "value": "dded77fe6687f3c01012249cb12b05073e18e1ed28672fd41740b30bb94ad7d65ea55b603c9a535c4e8636d765f89ae1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868537, "uuid": "b07b4b5f-a5c0-4f26-865a-2cfeca9a595b", "value": "T115839E37E4255E54C19189B034F58E391F13A2C882973EBB5AE5C6B86097D9CF601FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868537, "uuid": "2ba12042-fa03-4b5a-8fd4-8a84f78bc68b", "value": "1536:0agENhFLMgqNw6EWOcrKCTp37SK7riCOMImF7MR8:0ebLl56DOcOC5p7riqJAR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868537, "uuid": "173b3ad2-48aa-495a-ba39-c0e40db4d7bd", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868537, "uuid": "b369f1d2-4aaf-45ed-a971-af36c7c5fbc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868537, "uuid": "3ef18750-4b15-4144-808c-bc7e0886368e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80e7f48-d14a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764878036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878036, "uuid": "f0a00cbb-0c54-4bbe-b6a2-850b780e5227", "comment": "Malware payload (Mirai)", "value": "a77a3960fdc075d095837f50e1f7bd90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878036, "uuid": "561b63f8-9d24-4e85-b81c-5b155dd45bc9", "comment": "Malware payload (Mirai)", "value": "0dba6a6fc718c4cbe110a5ce6c8327ee43e4b22a3abd429c69bdc9d2724db737", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878036, "uuid": "9ab2c2b6-8e6c-4887-a072-fb88017835af", "comment": "Malware payload (Mirai)", "value": "a463284979be8bbb9e2868892067d1fec13a4ab7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878036, "uuid": "f8229ec2-f998-4f1e-988f-c3b8bb672263", "comment": "Malware payload (Mirai)", "value": "2fd94a6c3479921de2a31dc84141a23f81abfd32c45e6d4512c126ed2cee2f72e32606f2925a8da0318d72545eaa69ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878036, "uuid": "2251f73a-083f-4eec-acb9-b00e7f547f95", "value": "T1E1435CC59563E9FCDC1015393077FF7296B6E93E1028EBC7D7A8AD32A941A02D80729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878036, "uuid": "9c61a1bf-002c-4ef4-8b46-48a21f237b5e", "value": "768:CoXHT2eWvDW7b3VO5zDSbrJuB/G9UwtU/HYlstWt1XfWA+LtOfRc3go:CojsW7b3U5zDOrJuBuUwEBWTF+Lt+Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764878036, "uuid": "7ea96f23-fc2b-4a44-8429-c88351210fd8", "value": 55872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764878036, "uuid": "7ef70e0c-1276-462c-a69c-3b5f46c18f32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878036, "uuid": "252e4cdc-0b00-4323-a705-7aaf5e0a522b", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a86aca7-d11b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764857666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857666, "uuid": "f7a71de8-3679-402f-a341-1dc522888aea", "comment": "Malware payload", "value": "4ee1903806773935faa0404b6c11597f", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857666, "uuid": "060daa21-168c-4a7a-8d32-cbdae2e70423", "comment": "Malware payload", "value": "0ea67d58d900c9ed14e6210e7fb16c2cb1f4ec2bc52b45359c196727d2d8a93b", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857666, "uuid": "3bfe3288-c2c7-4d6b-b1d7-3ec65f4657d8", "comment": "Malware payload", "value": "ef998ffcd0645756781b7355bb791f54682b6205", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857666, "uuid": "7bcf8cb3-3abd-4f50-9e59-9cf50b7eac66", "comment": "Malware payload", "value": "ad4cfb66ac81438d16eb731c932f784fe30155e42d0c1a66101451379ca6afbfe71d87bdaeb93fe66f3b31d42ca97494", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857666, "uuid": "ec9f0012-4801-4efb-a96d-1f43df174b96", "value": "T170F6339AE6598544E47CA6B189C06F630E5A2C8F4DE207B2F5CC277C1D28DB44E9F34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857666, "uuid": "4844bbfe-6827-4560-bf01-bc85220b65f9", "value": "98304:F18Isu26w+oskv5wuiNIqfbH5peOdQ/49nkkshWTYz9AY:38Ak2uiNIqTZAhV889B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764857666, "uuid": "041c8783-3a9d-44ae-bf54-80bf6ffa1e82", "value": 16433007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764857666, "uuid": "d6838fb8-8833-495d-b514-cf0e250e886c", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857666, "uuid": "ccf2ab1e-9614-4359-b600-7cdc6576fe53", "value": "inntkuprf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8644d8f6-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764870544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870544, "uuid": "743d73d7-cc17-4fd6-aa34-c41021e29ddf", "comment": "Malware payload (Stealc)", "value": "5b1d80c2689b8733a71bf1fd4c54c62b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870544, "uuid": "50d88d1d-19ac-4509-b124-9dc1a5676265", "comment": "Malware payload (Stealc)", "value": "0f174c66c0160c6cf77c17f9c44ecfea8d8d795163719ed54f603670e396c0e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870544, "uuid": "07c94eba-3415-4d80-b9b5-ec5a0cb8a0d9", "comment": "Malware payload (Stealc)", "value": "77e293b055fff9160a2f0f9c5acb57af376de69e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870544, "uuid": "f4742f21-aefd-4894-8c3d-3d7db19bfc61", "comment": "Malware payload (Stealc)", "value": "6263fc0c5662965e65ac560fdbb1352360fd6fe90ed8b93c4b83312d803ac8d616bca29ff9fd1e919c6dd6ce3af18e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870544, "uuid": "e9d153a8-d105-4395-8b01-8d5718e8979a", "value": "T146E48D5EE7A503F8D0ABC278CA428542E7B2B8555770978F03E146B62F376A05D3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870544, "uuid": "b8b1a5e1-e344-4cb9-a700-99209f095564", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870544, "uuid": "e077844f-e604-48c9-9ef1-c0c837b6d3b5", "value": "12288:lGLVpIo/cBJ9InRPehbyv8plnEnCv3YZtF15kjH:lkkBJinRP6bw8TEnW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870544, "uuid": "7419c3e1-fe07-4119-9979-751d405ec059", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870544, "uuid": "2948fc70-4a6d-4788-8dd6-56eb46b3ee38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870544, "uuid": "883f91b8-eaaf-4c90-bc40-46d91fe8b7ae", "value": "h0klcscea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db1a63e-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879146, "uuid": "7e23007a-c197-4ef2-8081-94efa7b4b822", "comment": "Malware payload (Mirai)", "value": "873f91ebcd42e6731879cc4ad3cbcb80", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879146, "uuid": "df819603-e771-4ffa-acef-c151de1f4f34", "comment": "Malware payload (Mirai)", "value": "107bdc785d8632e7fc18b0f7c9d35efbc22ec7577de9ce262dc577f260f4d2f2", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879146, "uuid": "27fadff5-c8c2-4442-ac03-aa8d426b8933", "comment": "Malware payload (Mirai)", "value": "0f1ec0f53c9d7de9ddb7a7ba74c579e70024e553", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879146, "uuid": "d29fe6c1-fe81-493b-ba75-4c8273a370e0", "comment": "Malware payload (Mirai)", "value": "2c9286d2db757404ff224feb27a36f45f64a83bf64275fd12eede1576b6fd08d32a4e186c2df8fbc3b06b6c65b5386a6", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879146, "uuid": "655d2e17-90d1-43fa-9945-c1f6fbaeb996", "value": "T196630A95F890CA62C6D4277AFB5D118C33171BB8D2DA3202CE10AF357BE795D0A7B852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879146, "uuid": "bb4077de-6aff-4648-8441-9845e1a62871", "value": "1536:hI/z5RPQR0kzuoP1Dggd/fhf37nxpvmJdxDOODgYegIwOoxL/6RoYGiajT9:hI/zgR3zf1DpFJP72DlDx4oxL/YoV3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879146, "uuid": "5c542fb7-25d7-4c12-a139-7d9637aedf94", "value": 66784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879146, "uuid": "264eef5d-8d73-4d88-9fe1-f6bc11aa261e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879146, "uuid": "47c6d624-d4b7-4295-9e3a-27d441667c1c", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812c71d1-d161-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764887715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887715, "uuid": "b74993b9-c4e0-4e82-aae7-ca0f08ab9246", "comment": "Malware payload", "value": "b0e7e5a6d521f101f20b58b378caa6ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887715, "uuid": "473fbe22-f985-42df-813c-146700c0840b", "comment": "Malware payload", "value": "10a0841ac359bbc5dca1d5fdd1adca722b3b292ade731e7a432180f20ebb59c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887715, "uuid": "eb468565-6811-4ab8-85a9-e341960fa754", "comment": "Malware payload", "value": "c5d3556838215510c257d4150de9dff7b2345907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887715, "uuid": "da7c61e3-4fd1-4059-b463-3bec179b8c15", "comment": "Malware payload", "value": "69b932b8e451807b38c97674d9f5532e7640b9187990f7ebd3dfee0017c4b4f532c8587c5c5542866af49b289b21cff3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887715, "uuid": "cb9d6972-ad17-4673-a7b1-448c23c9fd20", "value": "T10263E786B9918B15C5D412BEFA2E518D33232778E3EFB213DD101F15778A96B0E77902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887715, "uuid": "85e8620a-bc9a-4c1a-b147-10c32650dc02", "value": "1536:UhnYiJFiibuJJ5Z/9Po3qaA7fYPyk8OsPC3WeMTiX5Jy5kdtu:eVbuZ/9Po6VYakT5Jy5kdtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887715, "uuid": "e0655f76-f1e0-49c0-90d3-4cce8d1dc7f6", "value": 71708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887715, "uuid": "9f453369-e039-4580-9bae-89487512e549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887715, "uuid": "6473d0ce-8c1b-43fb-87a1-05b76339677f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eacf2ab-d0c8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764821837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821837, "uuid": "751e249d-ce5e-4b6f-8154-f8ce01a44594", "comment": "Malware payload (Mirai)", "value": "a8766c142a08cd5805384e2cccc5493d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821837, "uuid": "2df30c78-a6c5-4413-aaf7-1c5a7a0aa861", "comment": "Malware payload (Mirai)", "value": "10ed89e1071318a35b68b13ba9ffcec25231857893422c9b890a1df577085e39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821837, "uuid": "0334cab2-ed40-47f5-8f61-8d6d4db2637b", "comment": "Malware payload (Mirai)", "value": "6c7ad19b6aff4e27cf33880ac8162af02262a0c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821837, "uuid": "29cd59f0-5732-4328-a263-e91c3ec86b87", "comment": "Malware payload (Mirai)", "value": "17f62d41c0b99ff3705282802b6406868003651403d561defb8db8351f53db70ae7c2940920cf94c01bb89d14e7ed743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821837, "uuid": "e9e540a3-8f3f-4f8a-98fa-bd42de4838de", "value": "T1A304B61AAF610EBBDCAFDD3702E90A4139CC951722A83F753674D528F54A50B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821837, "uuid": "ccb26834-4890-4a28-a5f5-c7e7caa256ab", "value": "1536:nzmbX88CEizdQmA3gxkbhLkOGka2M5e8oM1ZUR6CG9S1/ZS0OWB8z4XikotTe1rX:nzSSESA3ZtkHkY99+/BG4XidteQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764821837, "uuid": "28103d7d-800a-4a28-bc59-c7f596406bc3", "value": 174176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764821837, "uuid": "ca2ab3d9-54cb-41d8-ab4b-95bfc53dbe43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821837, "uuid": "5f9f78d4-3791-49ba-ac77-cabd584e0412", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b56aed7-d0e9-11f0-a129-42010a9c0007", "comment": "Malware payload (FleetDeck)", "timestamp": 1764836005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836005, "uuid": "b06cdb17-a32a-4a95-9586-39ff9d243d1e", "comment": "Malware payload (FleetDeck)", "value": "462d1f7b01352cface00641e0d6d1091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836005, "uuid": "86143c4c-8975-43ec-938b-f1d885169ced", "comment": "Malware payload (FleetDeck)", "value": "111725664342508621d6bb41473a2f0586d73eb00657880d15d99b4e98bdea05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836005, "uuid": "538bd6ce-3e3d-4108-bacf-dabe00a457cd", "comment": "Malware payload (FleetDeck)", "value": "b7990ad15e3f55a942572229afd51265fa4a740b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836005, "uuid": "b3fa1d60-e9fe-49a1-b858-a92e073bd7f7", "comment": "Malware payload (FleetDeck)", "value": "835790a104137fb787ca5dd1620e700d4d2c6780eb4d90b5bf01fde6afee5c0f1ae4eae15bef8eee7f73c9ef8797f813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836005, "uuid": "26e48744-856e-4119-a41f-72557ab3fe3d", "value": "T19516CE50FCDB14B5E603193158AB62BF2735AD094F35CAC7D6407BAEEC73AE10936229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836005, "uuid": "9d42ad8b-ac32-417d-82aa-703c1d4ceb6f", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836005, "uuid": "1369a298-dbc4-42e5-ac2d-978ed51a0e1a", "value": "49152:TP0dfmVfyr+CU8D1cuwaH6ylh1XzKxGD2sC/d3aUVJiuX7c+PzbMDpIJLKo7snUE:TPtZAl3XzKnaIcDgRjOlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764836005, "uuid": "f85d6e3b-6ffa-4fa9-a150-f905eee57395", "value": 4398512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764836005, "uuid": "dfb92524-50b2-4af3-a7c6-3d191fc7a0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836005, "uuid": "e447397d-079c-4f6a-88b5-564e198cd7c6", "value": "ZoomWorkspace.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf21044-d136-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869374, "uuid": "c58a8926-9437-4ce3-a468-9d31ddf54421", "comment": "Malware payload (Mirai)", "value": "df8dfe2ed5ede4c78d5aa0ac6236e430", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869374, "uuid": "5261e3e9-2d00-4544-be0a-0b44d5050754", "comment": "Malware payload (Mirai)", "value": "11573bc277a05684a6a2d7a83005241935337026472249f61fea359d11ed32a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869374, "uuid": "11431996-bca6-4975-90a3-32d36a3648e3", "comment": "Malware payload (Mirai)", "value": "37fc5c9ed8327ec289332c9067f2fd6dcd71759d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869374, "uuid": "e37c9203-5556-4b89-9a6d-22a33837f4fa", "comment": "Malware payload (Mirai)", "value": "713dd9f95a939f4304fc49aea4c1dc7e808341fd465995d5d879398dfdbe2f60a6093f0e7d8f389b9c47e176d3adab6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869374, "uuid": "3c2cb085-381a-4b6d-86f6-d6725e22e01c", "value": "T1235302C17C61BE71A8906830EB8AD8442F13897287FCE5675B341495B80AE69C33E5EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869374, "uuid": "999c1c0a-d2bc-4cb7-b34b-9bd296ca967d", "value": "1536:JO1ShghHtV/nDm1THD4ohfmU30LWskc9VXEzL:0TxtV/qT8o4BWSHEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869374, "uuid": "36231918-e7ee-48bb-bdf4-d182358140ed", "value": 66364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869374, "uuid": "66f36e84-8f7f-4c93-bc01-6bd52e634683", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869374, "uuid": "04e3a497-2cba-49d1-83eb-4a22b56c387d", "value": "Polar.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0649b58-d0c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764818699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818699, "uuid": "8fffa5ab-febe-4af4-899e-c08116146c30", "comment": "Malware payload (Joker)", "value": "5255940f2b2bceca7a2b1e1819226002", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818699, "uuid": "3114e630-bb7b-45ab-b87b-67630df7c1a7", "comment": "Malware payload (Joker)", "value": "11ce22db555bb6c13e37428716c9f2841b61d6ad3ab5b42632b2ad0d06d3f120", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818699, "uuid": "dc6ac6c1-e3f8-4073-830a-55d5eba8bfec", "comment": "Malware payload (Joker)", "value": "4bab1ea5300ed27241c0f385690196171e23c8e1", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818699, "uuid": "c54220e1-0f8f-49a9-879c-eb0c769be58b", "comment": "Malware payload (Joker)", "value": "055f881bc7d50f4f4421e1a51c2f07f67f029afe8440ef775680bbd80eedb72720410ae6db59dc0fc49ca698f0232185", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764818699, "uuid": "a1a58b5e-4b3d-43be-8ce6-6836d8a7830a", "value": "T152172203E78DC43FDDD3F03C595B0392661A7CA96220925B6815F25CEEB36D89E21BD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764818699, "uuid": "678d1d3e-2f7e-483d-bd67-1912085e9f55", "value": "196608:y2fUni3jniPJAjfXA8tkPAMuef+mvllAxTLff9tiEIB6H3UyA9+laRo95mLSpekM:AuDiKjfQ8CAMuG1vrAZL98N6XfAkGn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764818699, "uuid": "3670cb24-9894-46f9-9814-3aff87252bdc", "value": 20145578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764818699, "uuid": "ccfd309a-3db9-43bb-b09b-9cc076a027d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764818699, "uuid": "89e22681-8578-4206-a6ce-b23dd9c0ccf8", "value": "Useful+Cleaner_3.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e17749f-d12a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764863954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764863954, "uuid": "f188a26a-df92-4e67-ac1d-37daa277942f", "comment": "Malware payload (Mirai)", "value": "d769704be760d812b3c3cae9db279f37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764863954, "uuid": "e0c57d18-a933-4e19-8312-6561d463deea", "comment": "Malware payload (Mirai)", "value": "12170ab6d819635c5857867763fa32b96a970d19484082124f2db9a2442283e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764863954, "uuid": "73d6d2d6-6ff0-4452-872e-f6f1dac14b9a", "comment": "Malware payload (Mirai)", "value": "63064e4eae279fda8864e60c701e84907fb8ac03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764863954, "uuid": "99d95698-5095-4bdd-9d96-e5be53bf5e25", "comment": "Malware payload (Mirai)", "value": "619c8eafdee61740b516d6b081837197f3f7aa083026c1e8e6e9c8ceeb3c6530569991b9e970162420632c79244679a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764863954, "uuid": "170f9989-cb78-4c17-8a23-02ebc5e3a7bf", "value": "T19AD36DC4F68FD0F6E81215722027B7329B76ED3A113EDA43C3B89A759C93581C91A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764863954, "uuid": "ec7c2471-de6c-47a4-a9e4-c23850e03475", "value": "3072:WwBMW8BmsVHFrp0Ur9SmOOPE+Wzsand9w0g:zBMXBmsVHloNDn/w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764863954, "uuid": "c6100953-0506-4dc9-8f63-0cf509ba8ba6", "value": 136140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764863954, "uuid": "22667c08-154c-4065-98b5-730585537d13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764863954, "uuid": "1382c6b8-16d2-422f-9bbf-4d0baac5fa4f", "value": "Polar.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776810b1-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849474, "uuid": "8156e642-d681-4917-a162-68262fbfbf64", "comment": "Malware payload (Mirai)", "value": "fc2bbdba71fadb8629e602d7aea81024", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849474, "uuid": "a4fe6446-f702-4cf2-a39c-07487691510c", "comment": "Malware payload (Mirai)", "value": "122d0143bba4f82e406eced635573b094ce6ba17cf2d141637b7f5f9a7a81c36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849474, "uuid": "5ce31c9c-c8d0-4c88-aac6-c71bd36c6c2e", "comment": "Malware payload (Mirai)", "value": "847ae545135811ef89319275344673c15c5d2fa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849474, "uuid": "42167a5f-c336-4480-856b-729db3068e2b", "comment": "Malware payload (Mirai)", "value": "22c0ae4d49009efc8c990a1fa8ae966209583e2ae5284d1e91aff73efcc7cb564cb243ea1360ca05ca6571c089ec8ed4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849474, "uuid": "080fac12-e7fd-4143-a999-19200a63bf27", "value": "T1A173980A2E35CF6CFB5D823697B78E21975833D626A1C649D15CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849474, "uuid": "22b54cb3-6f71-4a8c-a614-d9a241b58f27", "value": "1536:HogWL2T87i8qXc3SEyNlnXLKgLhaV4+6uHO/YQBSmP9AAmd42+Is:HoB2T2qX4+JXLKgLwV4+6B/YQBSmP9/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849474, "uuid": "2e2324af-8046-4d7a-9738-b9e820eebbdc", "value": 80072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849474, "uuid": "6d8e3ea6-9f4c-4954-9839-f3b4b453bcda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849474, "uuid": "d2ccc5c3-43f7-42e4-a4b9-04d465c97d7d", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12118279-d0aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764808931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808931, "uuid": "f8b252d2-8f27-48af-9617-4d77f5ee1431", "comment": "Malware payload (Mirai)", "value": "fbc5bf1b7cc216eb53910fb079a00a48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808931, "uuid": "cb8f47d0-2e8a-4814-a95f-de77934e4e25", "comment": "Malware payload (Mirai)", "value": "131521c69afb2adb0bae1c737f067d45a844ad43b1872a8e6d77d34ee49fc2ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808931, "uuid": "b6083861-c9b1-487e-8edc-05ff1e04f3cf", "comment": "Malware payload (Mirai)", "value": "30cf5360daf95a6626834fbc8b9a7e7e77d9f436", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808931, "uuid": "d1bbdacf-7266-428e-a5d2-d1e1c5a3d706", "comment": "Malware payload (Mirai)", "value": "8b17a75ff2909e35f173ce8d4d06e76cde43cc966e5aa3e5b27e54508b6045ae41beb806c65fd021d6bfd393da3dc377", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808931, "uuid": "ca5821fb-ffe5-4249-91e9-1b2e05698737", "value": "T144E2E12A31CAB465D4B16C76CDBEC2A439AE2A75F9B233FE1D100D7761E509206F8213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808931, "uuid": "27d88c73-ce94-426a-80f7-e7af6e489200", "value": "768:7cSschzUWPugiQ8zfIrDqUO8i0m0QQViwmsNS8Dzffbs3Uozl:7cSsjuFyg/qUO3ZBomgSSzWzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764808931, "uuid": "8528995d-0ac8-428b-886a-e4e77a0d4753", "value": 33216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764808931, "uuid": "6bc00def-7083-4d9d-bf15-3501bcb79f5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808931, "uuid": "09cea2b1-aff4-4baf-a682-fb23954c1598", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5138b0d-d152-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764881440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881440, "uuid": "27449349-3e89-4d02-9e57-e18d0cc2349f", "comment": "Malware payload", "value": "d85a1edbbba48c92046b5a450b79ae6c", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881440, "uuid": "a46082f6-d802-4f50-92ac-fa25839a12a3", "comment": "Malware payload", "value": "131affca15b692e8185165a571990c8626828ce0a8944acce645ddff557fe49b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881440, "uuid": "a53fa36b-e219-4575-8002-36e24974d79c", "comment": "Malware payload", "value": "6b0c086c7d8cc666dda4bd6854613fd6566d3636", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881440, "uuid": "325db427-5c89-42a3-b191-a27b144b1551", "comment": "Malware payload", "value": "4759ddc495e85839aa45b5844fbd6189f4157ec0c2cefe6ad883e3074b92bcbecf650ac50a4190a4a9721233ec64f459", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881440, "uuid": "d5d27327-d69c-44e1-a56f-71aeffb49a75", "value": "T17FC4E1D04CA879F0F851E97AEE353A37FA444E4390E904DC2DF38A07FB8F425566A529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881440, "uuid": "7a2695bd-d7cf-48bd-9d3a-38966208c72b", "value": "12288:61owGMYXI7PaHXCJsB4SFstt6uqsDWCHUEEphzPYJ:6CVjiSFstt6uqsCCHUEEjMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764881440, "uuid": "f76ed521-fbd1-417a-9d48-2b78aa56fcbe", "value": 591039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764881440, "uuid": "85e88b6a-222b-4725-a0fd-83235bc9ae7e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881440, "uuid": "8c0acdca-fde0-4eca-a843-5887ec5f9721", "value": "SASGANJIL2025_SMAN52_B INDONESIA_X.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13585f93-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1764878941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878941, "uuid": "3cfc40f0-b538-4bf5-8abe-445c6fd80500", "comment": "Malware payload (GoToResolve)", "value": "3596ea3bc37499ec21418686a738f1d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878941, "uuid": "6ee76669-2b51-4296-80e9-21707adc8485", "comment": "Malware payload (GoToResolve)", "value": "1370a14de002934f3cbc4c308985d4e4ea0f33a310d67f2646530a7c714f8ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878941, "uuid": "a25501ce-ea2a-4202-bb22-7309245bab8a", "comment": "Malware payload (GoToResolve)", "value": "0abd3110af82c03dff83d35ef9df59cbc900a0a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878941, "uuid": "fb55cdd0-24c9-41af-a35b-696cd95f6874", "comment": "Malware payload (GoToResolve)", "value": "eab57d25762a293ae14af71418110b5530f5429e566539f390d2908e36c19512297421babbd19d4506bbba3f49436657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878941, "uuid": "df0765f0-ed18-4ab7-8e09-3bae45eb1177", "value": "T1FC37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878941, "uuid": "6c2a2f21-5811-4432-84c5-271d293e20ab", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878941, "uuid": "2c4009df-a4a1-4c2a-bb36-7d8ecfa4a8e7", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpx:q9WtLzgOTbjZvk/ekS/mcpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764878941, "uuid": "c6fddc94-0060-410c-869d-3d1da8efd1ac", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764878941, "uuid": "742fabd8-5f3f-4daa-a2a2-febaecadd00f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878941, "uuid": "c97d5c49-16e5-470d-9d99-06dc986a6417", "value": "Portfolipapers6421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c20ba9-d12f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764866057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866057, "uuid": "ef0299c8-d2e3-4f28-9ee4-673e1aeec1db", "comment": "Malware payload (Mirai)", "value": "0959b24c7e10b199b16bfcbdfa6d4bb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866057, "uuid": "957a03db-5cb7-4081-86d0-a3dfa017b7bc", "comment": "Malware payload (Mirai)", "value": "13b754699b0bf6e5ba9db2d33ad2ee7c6fe2962f959f5c4c86bc15df2c5c68ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866057, "uuid": "970b1640-2b4c-44ff-9902-6cf946025d2f", "comment": "Malware payload (Mirai)", "value": "d5d4c6f357d36a0593f26af481be75273af84384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866057, "uuid": "7828e2c1-bdb4-4d44-aae4-890cc85b5502", "comment": "Malware payload (Mirai)", "value": "13b72c555cfe51e075c5dca1cf87aaaeb57ce3291bdbc73978ffffe8708e9df690b98f0f7c7691c7b73df33aa4a62280", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866057, "uuid": "a04720e4-cbf9-44b2-ac27-8570137bb91f", "value": "T1A1140946F8C18B15D5C111BEFA1E518E33231BB8E2DE7212AD256F60778B8BB0F3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866057, "uuid": "03df0025-0b36-4e48-b7f3-e6e57e615bc5", "value": "3072:SKipXqkQjFQ5QHmUQ4OqFTXGEPGFam1BNvpjmR4eD8ppet:9ipXq3FPLOSXGEPmasPSR3oppet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764866057, "uuid": "65beabb3-0336-4421-bd03-f14e7e5fd079", "value": 191292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764866057, "uuid": "75061231-ab19-4cd9-9d14-7f5664843141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866057, "uuid": "b0358df2-5867-42bc-b90e-8eb0c4248858", "value": "Polar.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d11bb16-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764831042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831042, "uuid": "6cce7850-c78f-4b3e-b3cd-b444fb9d787e", "comment": "Malware payload (Gafgyt)", "value": "6bbf3b5eabf62b9c6eed0ebfa93a3e3d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831042, "uuid": "211e5798-ddd5-4d47-8c6f-9871beafedad", "comment": "Malware payload (Gafgyt)", "value": "13ccc7aef514e8fc26eb656e3ff5cffaddb1e544f048af99ddef613c97ddbf18", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831042, "uuid": "770d52f8-3c69-4e59-ba92-5a7c19de7a35", "comment": "Malware payload (Gafgyt)", "value": "9387b7ef33c278cd069c8dd8a585be16e72d850d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831042, "uuid": "bf781395-f7e5-4671-a59f-8b73f15c56d5", "comment": "Malware payload (Gafgyt)", "value": "0093179db6b2f943f5ac4873d57611592f460c1b5cf7adf3bb820b5df468b152292069c07cdef075154d368e24872b99", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831042, "uuid": "e5ed7f7a-b85a-46fb-92ad-cbd0c7368a6e", "value": "T1AE41AED720960BF36D91D83732698894B9D4A08AA4C19F466CDD3EE488BEDECA404682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831042, "uuid": "35cebc31-d751-4c97-926b-f7307fe68c47", "value": "48:vRqd8jRtttQdMR0YRLRRJ7RiT6RgCRMIRXL1Rl5NRMIRXxRWT:vRqd8jRtttQdMR0YRLRRJ7RiT6RgCRM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831042, "uuid": "3300fcc0-7800-4b99-a3d3-537712a54dd8", "value": 2111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831042, "uuid": "1811c96c-6965-4361-9714-8d07af5a3326", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831042, "uuid": "b38f2d8b-b004-4a93-a91d-90d03d60b728", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31cafe1-d0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764839749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839749, "uuid": "bff83707-7f5b-4f86-ac59-aa3978dc1113", "comment": "Malware payload (Mirai)", "value": "e1bf59fa91ea3087aac81b99ff09191d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839749, "uuid": "9c67c509-b276-4a42-b1f8-9ce4629073ab", "comment": "Malware payload (Mirai)", "value": "140a2cb988322c573e748f9f80ccb977768a2622e3ab82aca468ad5e2f8feb86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839749, "uuid": "15297424-a090-4e35-bda9-349335f0f5f3", "comment": "Malware payload (Mirai)", "value": "5a65bb7c6d52fc210bce2c426b202d5f7ba8810d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839749, "uuid": "f419196c-3459-4cbc-9d1a-f295f144ffa1", "comment": "Malware payload (Mirai)", "value": "cb80029b8ebde4854eae7dc61898f4f4787a6f3d18801bedb30e349727f3c03142ca8b92ab4dbf09b33cf0dc43cd8f71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839749, "uuid": "dbda3c7f-d11e-4f0e-acd6-b93e525bfe52", "value": "T1F7F33A01730C0647E3A31EF03A3F27E193EFDA9121E4EA44695EEB899271D365586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839749, "uuid": "df53b067-7abb-4a14-aafa-1d6ace86c1bb", "value": "1536:Bqe5UM3IZyYxruaoYC24xIDIslgyJo/LpvRw/o3j2LkvDvA0ketFS+VqfMHf1XL1:YN1C24xAIYMNJ3Uks011ata", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764839749, "uuid": "c6c6ebbe-eb30-44fc-99c2-23d435917b9d", "value": 157620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764839749, "uuid": "2fe2ac18-140f-46ba-9638-298fefa6b4e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839749, "uuid": "4990a1d9-b4c9-4ce5-83f3-55c92616f49c", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dbb672-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849468, "uuid": "c222e410-79b5-4d4c-b3b1-99922f426ded", "comment": "Malware payload (Mirai)", "value": "517033f609a6e042a6252f757021f271", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849468, "uuid": "da59c5f4-c03e-46b2-a252-52cf5e47c2af", "comment": "Malware payload (Mirai)", "value": "1452a41c2ad91c063ceef2dcdda45aa81f604f2f5130db778e09557388ed7bbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849468, "uuid": "c622232c-0794-4bc4-885b-5db97c865b6c", "comment": "Malware payload (Mirai)", "value": "b5a8c81cecdc3cb76536139ecceda61c4b625a89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849468, "uuid": "ae4faeb2-12a4-4f7e-9fb9-9eabd90466f3", "comment": "Malware payload (Mirai)", "value": "3397fad7eab9859848b8cb008bb17788847a89effd795ac499e2b4c5ff0757e1a303de531d921554d090f581b6db8a2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849468, "uuid": "f9a501f9-6809-4c89-9ff1-0fb31cc40647", "value": "T1BF533CDAB801AD3CFC5BE6FE80160A19F931366065A30F179697FCE36C321B65D1AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849468, "uuid": "6c09d625-d6e9-430a-87a9-4e7f1b29d683", "value": "768:HeBaz0tMQaaZ261DmbgiWJNS5LhZFGG9kdZnCI7PLzTaT+9uQ8yhh5Cu7VqntyP8:HUfi5Lh7GG9mNtH2T+MQ8yheu5q4PGRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849468, "uuid": "c5227b59-b125-49c8-a5be-d2f6a67b5a60", "value": 61288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849468, "uuid": "42eb47cb-e91d-4cae-ada6-4fcc0fea0eb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849468, "uuid": "9ac0a312-dc52-4ae9-9f22-287ccde947d4", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5784db56-d10a-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1764850279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850279, "uuid": "059f1cde-088f-4685-a074-c4e9a48a23fb", "comment": "Malware payload (SpyNote)", "value": "e4720633f242db55c5cb6cbdff13539c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850279, "uuid": "cf08ad9e-ff93-46e5-9442-edb6b08dfec6", "comment": "Malware payload (SpyNote)", "value": "14c47030d8220e682a1ec80c87d56c5bacf7a38abdf30df9bb532a85851259af", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850279, "uuid": "6af7314f-a8e9-4d83-bb70-52b048ebeadb", "comment": "Malware payload (SpyNote)", "value": "0fbbc1cf84b09f037b42be9cf651438a5c51bb18", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850279, "uuid": "10374cdd-252f-4f53-bfe5-b27c0a95595c", "comment": "Malware payload (SpyNote)", "value": "e3a1606c37c64f7576ffb95061e4a872ae21f3e2403f60628edc58b91219dd6fb01eaf6148b54b3b48020d98a9d3ecd0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850279, "uuid": "28eac79e-c733-4979-b754-d157453f8b6a", "value": "T13506E003FB85CA96C8FA83F56B370CA95D270F85C552AAE70561B67D2E771C10EC1A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850279, "uuid": "457647a1-063a-4643-8965-c268d95fc1cf", "value": "49152:Ry5i8QbBcTINAvDsfXf9xCrHzKU2grcUmzZzdGGxQTONeUeYql0cgRsuGikkv:0ul/NALWf94KUiUmzZzBeTv0tRsMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850279, "uuid": "19817f91-8927-44d0-9446-bc48cbe88026", "value": 3961181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850279, "uuid": "4d0ed609-de73-412b-99cf-39ccaa4b3553", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850279, "uuid": "e6d59434-82cd-4d3f-9281-0e638286a194", "value": "v.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded4a006-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875417, "uuid": "8fe26885-6342-46e2-9292-484eefa1e1ad", "comment": "Malware payload (BlihanStealer)", "value": "d2919781f5b3bc6700eb5c9900d5ac63", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875417, "uuid": "566d7e05-88d3-4925-bf51-fa7fa7ca81e8", "comment": "Malware payload (BlihanStealer)", "value": "14ea4ddddad8be30413d15759682b7f8783aab3aecca304969cac24a842d1c56", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875417, "uuid": "2210d3c7-f45a-42ec-b9d2-40ea172bbc48", "comment": "Malware payload (BlihanStealer)", "value": "86a90f4e787f57a669674a9b4fd3dcdd5542b955", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875417, "uuid": "b29f9216-5fcf-4680-9d83-5ad017e30e64", "comment": "Malware payload (BlihanStealer)", "value": "3534398cc0ee95e62944abd853b8113a68223a771e1c857d49b38aac84aa728cee00a1d20afcdf4c1e852746103877f1", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875417, "uuid": "e9bcf3aa-d7de-4ea0-91ed-68bd9dd74144", "value": "T135C3E70B5FB1CCEBD840043A57BAA22D86EBBC440DDCE35697DDDC4634D2918C8AEA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875417, "uuid": "096e60e9-6a76-472b-a8a8-75b79b00bf8f", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875417, "uuid": "d94b3405-d685-4dec-8d0f-3e9bda7c4e5d", "value": "3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hK1:eene", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875417, "uuid": "4e0b24a6-cfc0-4c5c-bb3a-ee13b8d2961a", "value": 129546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875417, "uuid": "86ed05a1-a7a4-4f9b-929f-7898bac31f16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875417, "uuid": "63cba979-e8e1-48d6-90de-fd74d744d2c0", "value": "f8783a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896e910e-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880857, "uuid": "e6da511d-bb20-4d81-aae5-7b69a62481c8", "comment": "Malware payload (Mirai)", "value": "3a51242ef11665ee0ebc741fc91283d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880857, "uuid": "0d7638ac-26cd-4d1e-8f21-559c106ba19d", "comment": "Malware payload (Mirai)", "value": "154fe6f790b0477c94ad75896ebeaa943c4c94e7de26c597998900a9aeabdb20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880857, "uuid": "fb36fbb2-f4e6-4aa8-980f-c262d1a2f358", "comment": "Malware payload (Mirai)", "value": "8833aa2f00a9f92daecd08c292dbe4cc170668f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880857, "uuid": "393c1df8-cdcc-4039-884b-64e9b87f73f8", "comment": "Malware payload (Mirai)", "value": "45f19eda0f6d944aff729fb8638fb7822cb5cd81c9ffe98dbfc134012f397295b26d278c22f7101c5edb238facff0311", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880857, "uuid": "54bae369-b49e-48e5-84a1-1cddac317c81", "value": "T1042339C19643DDF5EC1191752033EB369A36F1BA2029FAC7E39D9A32D512B02B94738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880857, "uuid": "1e6a093b-7d43-46ad-8e06-45940a0bd4c4", "value": "1536:R4siMVoqpRt1+fj4btHK9oYYZ5IwgJb4aY:9VoyX1+fj4bBv/ixbjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880857, "uuid": "32c80c26-f89c-4669-a9b3-d28d23770672", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880857, "uuid": "749c657b-50d2-4216-bca8-253535e01365", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880857, "uuid": "d2a03d11-f9e1-4de0-81ec-a98af2e3703d", "value": "DEMONS.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b47cd9-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883111, "uuid": "9cd25cbf-65de-4893-8d7b-49930924d536", "comment": "Malware payload (Mirai)", "value": "668d89ad3b3b3d4923ed2a41dc594d83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883111, "uuid": "56bdef25-546a-4c66-be60-75d00146f35b", "comment": "Malware payload (Mirai)", "value": "15b65716d6044566c43046a0dfff7cb699890dd5ea4b8bc120b72e38d3f7394e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883111, "uuid": "c872c9b5-1017-4b6f-955d-dfd5a5a3da18", "comment": "Malware payload (Mirai)", "value": "f2e414ff6fd85c8fad89db92c692da190b6d4a27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883111, "uuid": "53243ead-59ab-4f90-ba55-5c7f917ae50a", "comment": "Malware payload (Mirai)", "value": "5a4fcbdfb9f07e22d7047c339bc58f2617ef9ca2e517c71491bcc508536121b2d5ecb52cfccf609579605608013837aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883111, "uuid": "ad4f8c27-c4e2-4936-97e0-7949c4f918ce", "value": "T1EB643A46EA418E23C4C617B6F6AF4245333397A4D3E7B2069A285FB43BC775E0E23645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883111, "uuid": "43181a02-c890-4dd1-aade-98ef3e8397c8", "value": "6144:80Hg/DvEQaeE9IHzbBSxfrka/MaBpXT8VebF6N0aqO2ZZRM/Rom32eCgHmSm8:80A/DvEBeCIHzMxfrkaEaBpXTYeB6M7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883111, "uuid": "38b7dcea-b930-4024-ba9c-9ddd3e989b7b", "value": 332849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883111, "uuid": "74d8cb33-3677-49cf-b073-5c6be66e5b8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883111, "uuid": "1f4b5de1-188e-498a-872b-c07f0cc92d72", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48aad1b2-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816754, "uuid": "93142c0a-15a6-41f7-a09b-b2f8b6595c2a", "comment": "Malware payload (Mirai)", "value": "bec00a4fb5fec32b1202a88884116272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816754, "uuid": "a30c7206-e229-4fc9-a145-e1461bebdba1", "comment": "Malware payload (Mirai)", "value": "164d970e46f9c5a921d727c0c5cf82d3ced2a3fd4fee933f5c473719f2e5d3ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816754, "uuid": "b6330d66-1200-422c-b031-3f73c3976fb1", "comment": "Malware payload (Mirai)", "value": "36ded7c60b6721ca2e67e6835625e5be81cfc88e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816754, "uuid": "8f82fc6d-edaf-47de-a124-e6a6a7aaa4bb", "comment": "Malware payload (Mirai)", "value": "76ebef394bdab395528b31c5c443edcf5e887844ace8afb72ed5e1717842433fc352a6371beb0695799db10af28001d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816754, "uuid": "ad4f6b08-c517-48ec-a64a-6407a31a45d1", "value": "T12A83AE67C8156F98C0444A74E1F29D7C1B33E414C2272EF999C6C5AA9887EE8F60D3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816754, "uuid": "3ef158cb-45a6-4428-a1c2-eebc1c4e4947", "value": "1536:taeQ1pdpwoIp+CBhpHUpdelKsHa+/NQl9QMOuTK1HjwHiINBvCNXJzm:td8XpwoIp+CBhGGK+4MMTW1SiIvIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816754, "uuid": "17de441a-fe9a-48b8-b266-ced63caf9f64", "value": 87836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816754, "uuid": "fa6d64f4-519a-4bf7-b8c4-5f270f056771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816754, "uuid": "23ef15ae-942d-477d-9f9d-947e5d13444c", "value": "UnHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96be463-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888266, "uuid": "8f597397-1838-4558-be69-2646911dd7ae", "comment": "Malware payload", "value": "9efea8344225a660ce8e086fd876c141", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888266, "uuid": "0716c02d-8c88-48c9-927d-3dd67264d0e1", "comment": "Malware payload", "value": "165f98c8969b0d17042c97e09a766b11ae6de8bc0f2825696d8927bd402b1223", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888266, "uuid": "79022f34-9608-441b-ae4a-071029937ec3", "comment": "Malware payload", "value": "4124d88fbbd20a178f375e6ef4953a7fc760ded3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888266, "uuid": "95bf5f3d-4dd9-48fd-96ed-76996ff73875", "comment": "Malware payload", "value": "c2e05a413e575b39b221171f3e18e563332025159857b4a2ed9bd202329b4ac0e05bb3a48835a128ca88186baaa903fe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888266, "uuid": "c3ef4338-dd96-4ee4-a4a8-c56f77aed652", "value": "T14F11635F6F3250D5C540C508B462BBC9F2C8535F11C0773948DED931B1A8A28BF16EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888266, "uuid": "8cd48bd0-2d2a-4c76-adf7-5afdefd90f55", "value": "24:emEIde9EIdeQEIdepsEIde/EIdeKEIde7YEIdeZEIdeUEIdEu:emEIde9EIdeQEIdepsEIde/EIdeKEIdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888266, "uuid": "056d28c8-8cf3-4e6e-8052-29c1f99e7e9a", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888266, "uuid": "1f983b4d-fb21-472c-9fe9-674490483aaf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888266, "uuid": "0933d537-dec6-4202-aeac-bb1ebcb60a0a", "value": "misc.ictbroadcast.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56859004-d133-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764867887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867887, "uuid": "69b9c277-fea0-41f3-b47d-8cc8f0b9d80b", "comment": "Malware payload", "value": "066564533becb4f9c7a8cac1ffbd832a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867887, "uuid": "55d5784b-6c33-41cf-b50d-044dd2fab5a9", "comment": "Malware payload", "value": "1718b2f1372dbbe9df071205fe749bcefe8857af7e376c812168f2590e1dcb27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867887, "uuid": "8021c01a-ee3e-4062-b0d0-173a34609f5a", "comment": "Malware payload", "value": "3d192f6821c5fc4a8f9b5fa529d4521603d189b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867887, "uuid": "e074727b-e4c9-4f21-ba15-69aa45e80c54", "comment": "Malware payload", "value": "02c33f0cd3523f3628dd39d52c82ecb19b55510ea74d91d614a1dea5c564e3143aa8d449e630fb1b58c6913e1c7e364f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867887, "uuid": "9539ba6b-6a82-462a-a693-1c507d97e8e9", "value": "T17A236C2B9E0C4D63E59E4B7CB4ED63122EB89322A451F38A2DC8C1DD59A73C126493D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867887, "uuid": "960e2786-b8a6-4c27-a53c-9a8315178729", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867887, "uuid": "7fd457d2-a432-4406-91df-69ca141a06d9", "value": "768:p6CBwBcRKsOVDt0ZXxw6DZSm5E7SF1/8Ca3jUq/mfGphqpRUFK2y5ALp:p6CK2KsOVDt0ZXxdVXF1/8Gq/mfGbq/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764867887, "uuid": "2a5a57af-b542-4e08-886d-006392e47c32", "value": 47608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764867887, "uuid": "cf9a521a-fe75-44de-8c4f-07aaf83c3391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867887, "uuid": "2a03c581-88fd-4fc5-9b03-37784123702c", "value": "photo202512046988u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f5ae0c-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849495, "uuid": "f17fad8c-4cea-40a8-a6de-89a73f916959", "comment": "Malware payload (Mirai)", "value": "d6cb62a0b9a92fe20ac24ae5922d34a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849495, "uuid": "a1acd17c-ca37-4feb-8101-260814a78ead", "comment": "Malware payload (Mirai)", "value": "179cd65a1fc5bf7648c3312b13d7d90487fccecc4da46aa1029cfff28a3a6ef7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849495, "uuid": "74e2c82b-a479-4e78-b8bd-25fed1c8a620", "comment": "Malware payload (Mirai)", "value": "b045c93131d8e8885dc5f8ecacc3b5a9daff4d24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849495, "uuid": "5969e106-3c93-479a-b491-8d5b852e9c9f", "comment": "Malware payload (Mirai)", "value": "0129618c93239685b53a389742f68599b90cf2b9f9a88ac2ff9f5d246c59045528e69d10ed0bf29a5c4547b52a6a2c9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849495, "uuid": "896d0af7-c1c9-4d99-bb37-f33caabf65ca", "value": "T18E338D36C87F6DA8C5444638B82249342F63F50886A7AEFA9BC187655047FFCF6183E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849495, "uuid": "caa5bb09-1048-43a6-8083-165bf19a0f89", "value": "1536:0ndIcnkW5wtdl4ZhTZJNexd+3+4keEtCQ5d42+:0nFnkW5IEreO+4ke0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849495, "uuid": "b81e62b5-7f22-4ae9-b995-5985926a9e73", "value": 55116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849495, "uuid": "6fb15ecf-9886-4992-86f3-bb4feab018fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849495, "uuid": "628ac225-049e-4841-a0c8-10b450795195", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70ebb4c-d0d4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764827300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827300, "uuid": "52887a5c-a40d-40d4-9239-83d1310c4d72", "comment": "Malware payload", "value": "fe10024cc62500e17a46bedc100ab71a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827300, "uuid": "57abcab5-23ec-4676-8287-8444db0a1dac", "comment": "Malware payload", "value": "180fc22737e5b9981b4d0c0d35aeae5a0bb440e86c2111be19de7caefca9707e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827300, "uuid": "8ae45131-8e03-47d4-bd59-7327cf40672c", "comment": "Malware payload", "value": "1401e93f18b000e02d5fa4251c0ec51ec4fd3472", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827300, "uuid": "3e9d32f0-7a07-4eb1-8b18-14e5cbf6d5f3", "comment": "Malware payload", "value": "64acd74166495b7f9050472169d2bd18c96630a045acf5ae0dd79a5bfad81d8f33e2671aaddcfe4dbd305d5a5d70fd36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827300, "uuid": "35363b8e-4caa-489b-8829-679bb176f562", "value": "T167C31A05B30C0947D2632EF03B3F27E1D3EFDA8121A4E644255EAB8D92B1E325586DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827300, "uuid": "a3bc15cb-d470-45de-bc16-76406f063324", "value": "1536:tb8du5rROSxvVtTHEydM8pzq3P5nSv0sp9IvAgezX+tPh9vK2RB:tbyu5rROSxDHfNunS9pLgpS2RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764827300, "uuid": "2b4851a3-7578-4c0a-90d9-6664fe293317", "value": 129776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764827300, "uuid": "7b97dcb8-d11b-49d2-9caa-5bd10f3491a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827300, "uuid": "a3d11d32-4c1c-45dd-a16a-f79808f6dee1", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7ab519-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880864, "uuid": "94bafb60-a191-41c2-a095-212cfc15ae02", "comment": "Malware payload (Mirai)", "value": "68b45bb055624c07bcb751b332a7f3d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880864, "uuid": "6f70417a-3e83-4eb9-94d4-fe08a188137b", "comment": "Malware payload (Mirai)", "value": "1827c35fbd718f99feb2302ac64315b5a990ead3b43ca1adb9cc2981d91772b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880864, "uuid": "ebb87977-b296-4c8e-b1d1-23cfbb82f87a", "comment": "Malware payload (Mirai)", "value": "1e7232a37dfb7186a491b48fabd906e6629ee089", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880864, "uuid": "a001263f-d59a-4aa9-9386-d3821473cf7d", "comment": "Malware payload (Mirai)", "value": "c049e1e7e10c97356dd7776cede9c793bf63476a0399e7b899ba7a9e3f0742c27b2db485790fdd591b6c294f9cc79e60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880864, "uuid": "677315f4-ceea-4c28-8811-28c5cf0c60db", "value": "T107330796A800BD2CFD5AE6BA81160F1CF5303B6410734737A6B6FC9B5D723A49D1AF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880864, "uuid": "b9021de7-7414-417b-bfc9-ab7de6cc860e", "value": "768:zreOjp9lwpL8a2dfJOw40Rcp/u5WeMEvpaqMJTXNa4H86Fn:nNjpspQ5p402p25ptaqMJ7NaG8in", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880864, "uuid": "8c120fe2-87c9-48cc-a34f-28c88e8e4a6d", "value": 54632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880864, "uuid": "29873d12-61e9-4658-85ae-198911d447ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880864, "uuid": "0c1e996b-5130-43b9-82cb-e9b341df2f94", "value": "DEMONS.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ddcaa7-d0db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764830243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830243, "uuid": "6d5538ea-bef4-4a60-b62b-6431e4f2f898", "comment": "Malware payload (Mirai)", "value": "94b3d16036f26493b8b31e3b2659dacb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830243, "uuid": "b307b2e4-73e6-4737-bd8d-8830e9daad88", "comment": "Malware payload (Mirai)", "value": "18aa375989a592e8878a587a1bef7421d963c29673e8558eda544617663c2ae7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830243, "uuid": "bf2b1a30-bd26-4cbf-add9-37b09e583e38", "comment": "Malware payload (Mirai)", "value": "c3329156d79babebdf629f3d12539953db0ce38f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830243, "uuid": "04c3064d-6cf7-4d03-800d-3a3db486ff0a", "comment": "Malware payload (Mirai)", "value": "86ea7d0e7895de26d8d7183799b3e23d3495880293628743b136bed748bc9e468b37e15ef39cc4ae8e9fb3a2b1367641", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830243, "uuid": "da513983-a9a4-4724-b0f4-f8a3b85701f9", "value": "T121446C06B68140FFC4D5D0781BFFF632E821B0AD5279729A33D4AF166E0DE605B2DA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830243, "uuid": "a27ac32a-2c40-45fd-97e3-be97c13b8776", "value": "6144:aXBqHKwfdv7KlpyhtTBHwG3zc70SmnSk98F3UIX:asd/tTBHwszc70SmnSbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764830243, "uuid": "1fac0180-6cbc-4508-9a15-4fafb8014855", "value": 262792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764830243, "uuid": "4dcc5474-e686-455a-8364-4e7f35b2fcbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830243, "uuid": "a06d473c-95c7-4b6e-b926-67194e4d61fa", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57d363b-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875428, "uuid": "45e755c9-524a-4081-968b-55f8cb860545", "comment": "Malware payload (BlihanStealer)", "value": "c8f6fbd8fec5e3b74c5753cc549540b5", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875428, "uuid": "e70e5576-2e8c-43f1-88d9-bf3a1ee844df", "comment": "Malware payload (BlihanStealer)", "value": "1948c51d8419f61c5b69b51c5e3df89e38d99e8ff19e64d0f0a4fcd7a0791c2b", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875428, "uuid": "1a41fd90-77c9-4d0a-95c9-4facc30b27d5", "comment": "Malware payload (BlihanStealer)", "value": "da8784c1be8394012da2092114c838eae97a9ede", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875428, "uuid": "95907b30-90c2-4bd6-b925-ff588be6a07e", "comment": "Malware payload (BlihanStealer)", "value": "5bf04dda2582e2b03b05a41a2ac86c274e2c032c58ce5c9b9b937a56e8d2485b4db2258c2bd1fe296c75d604e7ccb22b", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875428, "uuid": "fc31eaf4-cce7-4115-a7cd-72746829cdeb", "value": "T115C3E5075EA18CEBD800043A57FAA22D86EBBC441DECE357D7DDDC4634D2918C8AEA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875428, "uuid": "09f886fa-1d7d-4c6c-8fe3-85e2822f2d92", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875428, "uuid": "f8a5d1e9-b820-4959-9b91-982f496da3d2", "value": "3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKT:eenet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875428, "uuid": "73940bb1-a685-4795-a2b8-d2458b18f49c", "value": 125646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875428, "uuid": "bf99683d-ee81-48f4-9663-af792ccca33c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875428, "uuid": "3335f7b8-8f76-41f9-8847-0a0d719c0e58", "value": "a4fcd7a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d71c97-d0a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807270, "uuid": "435dc8ac-b37f-45d6-bd75-0da25853364c", "comment": "Malware payload (Mirai)", "value": "58d672c17f00812eacbfe91931edf2f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807270, "uuid": "66c884f2-f683-40c1-a759-3deafb24d3a3", "comment": "Malware payload (Mirai)", "value": "19df7e1cefae47e1991e1d1b04b6ac9063c406f9e8396d59dd1f2e1c160f80d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807270, "uuid": "7771ede2-bc15-464e-92e2-92e9740f5699", "comment": "Malware payload (Mirai)", "value": "1aa498f1e8b5e4e05458014da65419d41b8ae901", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807270, "uuid": "7e6d0d9c-0319-4d0d-9600-e352c8e84444", "comment": "Malware payload (Mirai)", "value": "4a6ed60e8afca4d2845cb08496355fbb58aae5dad5b66ca2286232946991fd236253ff75aea4249d32a14af45bc01e9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807270, "uuid": "c5c4488d-92d3-4c9c-bc3e-7ad1184a1c5f", "value": "T17E23F16F90A11196CAFC8DFAF88632671D6935C83356BF1853A009DCDB3882DB54E239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807270, "uuid": "68a6917a-87fb-4e41-9bd1-055c93d58249", "value": "768:Fzfip37FLDfZtCGAiqYac9zIqARozVqEPGHqFEVwYGu6pkBz3d2aQWF:Fzfo3RDfnRURQVqjKFSwhtpmz3df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807270, "uuid": "66f0dcf7-5756-4a9c-98a7-3c87f58e92f7", "value": 47364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807270, "uuid": "9cf7f4ff-61c2-4d85-a660-052c5b27b03e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807270, "uuid": "0eee4d85-fdb1-499f-8a94-d9a7b37c6f06", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f2a03c-d13a-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764870807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870807, "uuid": "61f82324-60e5-4d86-802d-49eb8a89d43c", "comment": "Malware payload (Stealc)", "value": "ec02ab08cbd339382c098ce0ddf9b2b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870807, "uuid": "76fc00e8-2a0e-46ba-97ac-8f9ed06c586f", "comment": "Malware payload (Stealc)", "value": "1a099621ae4684088d31a86ec40772dee01507b1eeb330bfd4137842ef6961f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870807, "uuid": "6f08cdeb-e7d5-4038-8d96-f5def8a8ecae", "comment": "Malware payload (Stealc)", "value": "f71cd7fb8ceb34a1be246f24097dd74506ce3092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870807, "uuid": "83b7bf2b-ca4c-4d66-8e61-e2d2fbbb73df", "comment": "Malware payload (Stealc)", "value": "59a91b9a3c308ca6f41290d6a39f6c08634b5d462f46c87460d9051ff5bd3eec3cd07cef2279e9540730c58e64e3c580", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870807, "uuid": "f287fac4-11d1-4c20-a650-a766b8d238ca", "value": "T139251262FF43B8E9C6E640F19C9915B31561AC9387481F7BA9A0B2291CE135B7B33437", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870807, "uuid": "b9b13bdb-a4d1-462a-920d-949556f8f353", "value": "313a05c8f3f31305e238ae143783f8a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870807, "uuid": "fd470423-a9cb-4213-ba22-29636c2266ee", "value": "24576:SS18PuTEIUBZXN4Qu2RvF3gBpBQTIo8xw:98PuTEIUDb36BQTIo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870807, "uuid": "d92ca7c0-38aa-44ad-a508-4b4c4cd9e5a3", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870807, "uuid": "01f30a4a-c812-45aa-b67d-5d6686813c06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870807, "uuid": "9974681b-452a-4ff2-80f1-72c2bb80e0dd", "value": "max_global_quantum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ebd8cd-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834170, "uuid": "7b826f3f-a80d-471c-b867-b8803eeb82fb", "comment": "Malware payload (Mirai)", "value": "8377a998b1e3efa48c612169e41c18b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834170, "uuid": "c64f8562-e178-4403-8604-1d2371f1fc11", "comment": "Malware payload (Mirai)", "value": "1a122250e50018b358d530b5e2a700ae312a80de5e7358ecc19acb7604b5afc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834170, "uuid": "394e3083-952b-4fa1-a582-6ac373eee6ec", "comment": "Malware payload (Mirai)", "value": "c2c08fd77107946c643ad19c430362d7ed94960a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834170, "uuid": "473e019f-2260-4ad8-8b9d-f62741a3ddf2", "comment": "Malware payload (Mirai)", "value": "acd2ff7056cb1e732af719f2cab4f2a5746e9b57ac9fd64f1ca0f6779ad8bbf82e0eaa69e8c4482f4653ff3b6d99e939", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834170, "uuid": "e0860c20-b043-439c-8f63-3c9b296e216a", "value": "T1AC237CB198FAADD4D148C674A9248A780B53E402C6472EF95A4AC356504FFFCF62D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834170, "uuid": "d026ce8d-7329-4ff8-af79-1195698e8400", "value": "768:UaKtUwth8ANVYhxneqCBvV9grHnl/fLiMd7/qBDCIm4owE4JCrwAm:UaUUwtO1MErHlXB/qBDewBJCrw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834170, "uuid": "982f15e8-5b06-4175-8291-5280c7856b9d", "value": 48784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834170, "uuid": "c2aeb56a-86db-4580-b635-53f855ad9971", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834170, "uuid": "1a8dada5-eda7-43e7-9d03-d1e78a4cecfb", "value": "DEMONS.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a215c85c-d0db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764830218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830218, "uuid": "1149ef3f-73e6-4e0e-8f65-d41654c6bfd5", "comment": "Malware payload (Mirai)", "value": "012a638311c7ed1c46799f6038da0684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830218, "uuid": "c55d70c8-37a7-4fb6-82ec-a2ca8c0b2025", "comment": "Malware payload (Mirai)", "value": "1a1f8e4b8a3dcd91486813fa2c511ecdb1377c1a1a11a9117d7ce880b8b164f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830218, "uuid": "5375601f-a76e-42b9-8294-391fa3134eed", "comment": "Malware payload (Mirai)", "value": "c38cef842e6c5079d09f4b7b2b633a836612760b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830218, "uuid": "aee2a6e0-86c9-42f8-b3e5-9574382afcb1", "comment": "Malware payload (Mirai)", "value": "d7c16b52d6748db41af09e223567af9ace5b04ad63dbadb6ed7595bf1fe35d66d96671d9530d499b9cad22f97a770b0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830218, "uuid": "25078851-5f65-4a17-b790-ed6347a2e6aa", "value": "T15383023FCBBDC871E0A66730085687D4E5771D493A4D0E0B046E569B0AA9F553BF2BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830218, "uuid": "e4e658ff-5b7e-46ba-ae11-d48f033c0815", "value": "1536:y/I6Q84MEQLhtvz4U/fnlWb/rarLd7Hwozf+CsAVoQ5a2n07UUcMTK2ctbG:5CEO7cUcjaf+Css384P2cJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764830218, "uuid": "6981b039-e63d-4a85-84ed-e99400fdd1e0", "value": 86668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764830218, "uuid": "3938700a-1d90-40b1-918e-d6e04ca5ed08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830218, "uuid": "2989d78c-7ff3-4ff2-8e94-b2b660e2cdea", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcc7c7b-d0bd-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764817245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817245, "uuid": "84dbe728-8dd0-45f8-8518-62d9b848fee2", "comment": "Malware payload (AsyncRAT)", "value": "2b70f9692df4e6a292515fac323ab517", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817245, "uuid": "1d6d4d41-52e6-43a6-a841-6b7180e2373a", "comment": "Malware payload (AsyncRAT)", "value": "1a21e2a177f3a22bf947624c6f7c7f51a674a7e8acfa355b996ba3ae81a0e0a8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817245, "uuid": "3b9265a3-1e26-4c9b-b89d-846c70c1913b", "comment": "Malware payload (AsyncRAT)", "value": "1eeebe8771ddf87c9ac7b1308970d7f8580f941d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817245, "uuid": "d8c18679-9a3c-4e10-88de-5d34c8ef6c85", "comment": "Malware payload (AsyncRAT)", "value": "8523e4a7c6d9fae2484f34ec6b965f48fb90dfece873ada7f0db9803e1c30dc05af744e5bac2cd0abc233ed8a452723e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817245, "uuid": "b654b23c-f9da-4592-a566-532e5316cefd", "value": "T180232A0037E8C12BF2BE5F78A9F26105467AF5633603E58A1CC4519B5723FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817245, "uuid": "e2ee05e5-7255-42b3-92fd-4392f1749277", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817245, "uuid": "41b22d14-0108-423c-a968-c2474375ecdc", "value": "768:FuK99Tg44YZWUR9jjmo2qrIcnoxzDpGLvOPIUzjb8gz3ilgdniLAwTHVCBDZSx:FuK99Tg3w2bcn8G3U3bTzSmk5idSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764817245, "uuid": "c16663a1-0f93-423a-bb1b-7f4a2733b5ae", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764817245, "uuid": "ebf7621a-1dac-49a0-b397-07b78fcfb79b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817245, "uuid": "5e6f5a50-e04c-4cf3-8492-64a93219e07a", "value": "SecurityHealth.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8207b0-d152-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764881451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881451, "uuid": "0b20e1b5-1644-4114-96ad-d121e83c22f6", "comment": "Malware payload (RemcosRAT)", "value": "c8df04596d45aea84e463af745e218b5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881451, "uuid": "c769f091-a484-410d-9438-8f560282ffd1", "comment": "Malware payload (RemcosRAT)", "value": "1ac8c6e43264d5f82d7e80229c75e5d2a9130fb10a23d20cac4fc0412db14b22", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881451, "uuid": "678aefe3-d516-4dcb-9aa8-4eaafd4b7adc", "comment": "Malware payload (RemcosRAT)", "value": "5e3d8a26f2e611da2d25a85f2511714c81458f9b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881451, "uuid": "6b8f7b57-65d7-47ca-aab4-ec902f78e60f", "comment": "Malware payload (RemcosRAT)", "value": "0bea20bb1c7d469ef7b8260386470a2340e658a21fb9bcbecf8f2b1402aedccd063281c26a31a20cb79beb61affd4b78", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881451, "uuid": "ecf72f2d-b985-4e76-8c12-110522a9dac1", "value": "T1B39412400C928AFE9B136A21F1C427A672DE4C33AED309647765396A63D6CDBFD07319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881451, "uuid": "25239d81-1555-4c65-accc-c4f7cc166f94", "value": "6144:dmkC13UiWSqlMzXvasqJ/F5l2jcXYbdU6ELoo02z06Ki2rBeiqqeiqqeiqqeiqqO:MkS3U1J2zidmTUWstNiwiwiwiwiwi67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764881451, "uuid": "307454bc-3af9-495a-ae8e-f62ca249d729", "value": 447163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764881451, "uuid": "e652e56b-70a1-4b81-9c3d-581f760368e2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881451, "uuid": "c330ebee-d8ec-421b-b695-0923db8cc808", "value": "RICHIESTA-DI-OFFERTA.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76c89bf-d14a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764878035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878035, "uuid": "5f3b287f-2473-4233-bcae-859ba98420a3", "comment": "Malware payload (Mirai)", "value": "67c3ed5463f8655baf406c6cb645b202", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878035, "uuid": "e900be70-3e53-43d1-9f1e-ac4046cd9af5", "comment": "Malware payload (Mirai)", "value": "1aeb8644445ce0760bc1d6cc2e4ff7c38912d3a66e4ca47f4c244bf1be04b332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878035, "uuid": "54e8f658-0130-4f04-97b7-6e38ef17921f", "comment": "Malware payload (Mirai)", "value": "37a11f88209a6e165245359291e52a09a0036f08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878035, "uuid": "365f4ea0-be36-4de9-9ec9-5aa59ba10eac", "comment": "Malware payload (Mirai)", "value": "0f8db09ce5f26679dff07d868fa089d02cdc205bc13d9a89f17e9df4bbceb97d0634866e906f13a6ccc989f8832a2b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878035, "uuid": "00a58c2b-e23c-41b8-9cb0-4c465770b0a4", "value": "T191730995F890DA62C6D427BAFA5D114C332317B8D2DA3202CE106E3577EB99A0B7B513", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878035, "uuid": "aae87724-6d74-4607-9bab-883ef0a9323a", "value": "1536:fs41I3a8D8IOR0XLdwBhiIYZG+c7rrxS48rO/OKvtYs4wOlpVT6RRY/EaT1x9j:fsJq8ohR0b+TDxdV8rO/ZvAlpVTYRQfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764878035, "uuid": "c36c08fa-f9a7-4d53-8d90-53fb45c8d97a", "value": 74976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764878035, "uuid": "5a5dba89-851e-4512-8ed2-a4938b531f5a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878035, "uuid": "55eb3d14-cde9-4e94-84ac-bfbc45ae004a", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90d53d0-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764870683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870683, "uuid": "76339e4a-9bf2-4755-9f15-a83045247807", "comment": "Malware payload (Mirai)", "value": "877f61150ec75b28cb942c5e954a2928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870683, "uuid": "10fb0dd8-18f9-42a7-96aa-a2ac9e035b13", "comment": "Malware payload (Mirai)", "value": "1af93718cec785b6170d675e013939b17dde6cac2a4a9f39dcf88b5836ab0f6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870683, "uuid": "bcdd63d1-1b4a-4b32-9971-80cff782e5b3", "comment": "Malware payload (Mirai)", "value": "13594c0e8218c962ffcda1e0dc21be616923e88d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870683, "uuid": "ab434ef2-3b21-4fc3-ac89-86bc7f8e6ec1", "comment": "Malware payload (Mirai)", "value": "69b6ddb15c38adc9f0cb91603fe35ad016b2c5eb4555e93d349b33d4803671d9bdce3134a3148afe0a98022ce0be8fc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870683, "uuid": "06360020-475d-4b00-b171-8bc89dc1246b", "value": "T1F2C3C81E6E229FBDF759823047F78E25975833C627E1C585E2ACD6102E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870683, "uuid": "01cf5ed1-c122-42da-8e99-2cdac21f0bf0", "value": "1536:5eVxVNOugg1gILI7hvk3+y0/c2CL4x6zAX0/bGAPQxeOFTxMksFI:kVNjgDd/c74x6zAGGAIvMksa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870683, "uuid": "e269075d-11bc-49e5-ab1d-8b5b75640f59", "value": 118220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870683, "uuid": "cebc926b-ee6b-43ee-99d8-f2cb34d2c580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870683, "uuid": "014c7ccd-8cf7-4ef2-a2b0-70a15dedd92d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d36ead6-d0e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764833216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833216, "uuid": "0de7a231-4741-42c8-ada4-eba343e195ac", "comment": "Malware payload", "value": "9f6a068f52a5ed4f702c0162136370f5", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833216, "uuid": "182df428-5244-4a3a-a90f-6bf334327c57", "comment": "Malware payload", "value": "1b8046728147f5353306695fae8d9790a0dda5e9c44ee9dc17ab7369306a07b3", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833216, "uuid": "8370716a-0c77-4a8c-ad4b-b489f8e26a21", "comment": "Malware payload", "value": "1669ea9478d3f781d03a498987ad5e442db6e490", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833216, "uuid": "a15e117f-28e5-4fb2-b362-2327f36d5997", "comment": "Malware payload", "value": "70db7413e63741f4fdad52344f34d6dc532e022bc094c4745ea9a453dedd4abe5467d15200898b32b40586e39621b369", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833216, "uuid": "9211a54b-1217-48ca-9993-2b8d572db550", "value": "T1429002115A2064E95E5555789534400019652515D890A6E72500C80904426B78A55406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833216, "uuid": "745bd1a7-51fb-494e-b3c6-7e4f5e81f61c", "value": "3:VSJJFIqF1F65IFHKA0:s8qF1Fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833216, "uuid": "ee10c840-ebf9-4fec-9a5a-faf892f9e212", "value": 53, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833216, "uuid": "fb1d69cb-f436-4ae8-b604-5d9f4c9c629d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833216, "uuid": "d9aa5456-bfb7-40ee-b6b9-c08fd9842c50", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c11dd75-d102-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764846851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846851, "uuid": "55090188-a506-4d15-8fc0-8fe768811b74", "comment": "Malware payload (Mirai)", "value": "7c84a138a53c154779d4a3b80ccc08f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846851, "uuid": "a8deb8c2-6e6a-4f27-8fcc-9f3be1ed9285", "comment": "Malware payload (Mirai)", "value": "1ba51b481413f35cda4b682af825344686c521fb4da6709a13b85ff2ac6b3637", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846851, "uuid": "cb7c70ce-ec94-49da-afcd-522f03916748", "comment": "Malware payload (Mirai)", "value": "76747b91222365df28dbcfce6db53999d0b579b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846851, "uuid": "64ed2782-465f-4cb5-8022-de9597fd79b6", "comment": "Malware payload (Mirai)", "value": "41d00f68224a5aac606f1946fd2c3676d1c442176b0185ef06455afce80e32c3dbf717658a94cad94286bc509ec0703a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846851, "uuid": "3f9b93f2-4f30-4b05-b7d5-0afb5a8ff25a", "value": "T15E831A05E6108B5BC1D127BEFA5F425D33276B58A79B73125A286BB43FC27AD0E3C121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846851, "uuid": "54b36a55-16a0-474d-9818-1389f0fdcdba", "value": "1536:TjnsGHHnfbWkNO1U5LDKXrc7I+ikPxHEEG8HNl1XXsO2kial71XHB:ckHnt41U5GSPxHEn8HxsO2D+hXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764846851, "uuid": "b7339946-7713-4870-9d28-e9e7cd3ef598", "value": 81213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764846851, "uuid": "ab5bd4ad-722b-40ce-a879-94bc1c372c68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846851, "uuid": "9ceaf7a6-c7f0-4fd9-9154-31f7ed00787b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2638e2-d0db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829970, "uuid": "39fa3559-9b55-4b4a-af38-399334b037f0", "comment": "Malware payload (Mirai)", "value": "78eb37c15e26c374676e9d480e80c3eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829970, "uuid": "b1f3d54a-fba3-49f2-ad01-91959bc8d4db", "comment": "Malware payload (Mirai)", "value": "1be76d0004c63239ccda52ae0982062aeeb1d7b29a1a60e73b7bcf02986c1c0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829970, "uuid": "bff387cc-4305-4e3d-ae70-4b5390aa60d8", "comment": "Malware payload (Mirai)", "value": "df5af615467a2509931f2509cf9cfd8daa5912a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829970, "uuid": "3e4a6af2-29e5-45c5-ac1a-a1a5e59a2c8d", "comment": "Malware payload (Mirai)", "value": "fb50ad5ada7a4dd38cdaa856407d1904c9d6d3881bf46baa14e3b03601fb2568a3342f46b152e99ccab8d3a970e4b924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829970, "uuid": "5e5285e0-572c-4086-a45d-949ccf44c585", "value": "T1FF13199AFCC24A3FC1C01379A6AE5A4D3721E3E4D2CB7607CE545B3136C660E1D6AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829970, "uuid": "cf95281f-0c68-44ab-b197-bfd0aba3b9b4", "value": "768:XG2/l2Geuo2SdeQxZE2hgoG3U6ZQ+PVgOJ4MmJdtBNCw8oOM:X3JuMQxm2htqzVgOjGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829970, "uuid": "2988cabf-cce5-4e87-9737-078ec6dfa8c0", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829970, "uuid": "80457920-9136-4f2b-9450-314e3f65ffd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829970, "uuid": "2b3134b0-6517-4d9f-a995-ea8896c1caae", "value": "ub8ehJSePAfc9FYqZIT6.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbac711f-d14e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764879680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879680, "uuid": "012e8dc4-5ec9-44ac-a7a4-1daf21ca3c55", "comment": "Malware payload", "value": "1e5444acc882aefc12993d38d273f94c", "object_relation": "md5", "Tag": [ { "name": "31-44-4-59", "colour": "#375D16", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879680, "uuid": "6d7967d8-bc96-4d81-863c-ad08892eed9a", "comment": "Malware payload", "value": "1c4388f40db1ecdc828b95cefd62add423201ff1f1cebac1ee8ca898fc6a4797", "object_relation": "sha256", "Tag": [ { "name": "31-44-4-59", "colour": "#375D16", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879680, "uuid": "0830e0d0-2136-4bad-b895-948b3c923a40", "comment": "Malware payload", "value": "722b685edd517c7fff20b1496fb3ea06b0210767", "object_relation": "sha1", "Tag": [ { "name": "31-44-4-59", "colour": "#375D16", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879680, "uuid": "62c299e4-2884-4a56-a28e-dd74c0335ab2", "comment": "Malware payload", "value": "648956565ff6d0d5b8da6be055087eeed7ca3856527175eebfb61210ad77d93bb18d54f5a0ea51cbef7d365bea0d9c43", "object_relation": "sha3-384", "Tag": [ { "name": "31-44-4-59", "colour": "#375D16", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879680, "uuid": "ad0629e3-00d2-48c7-b60a-feb231a0f8d4", "value": "T1AE97333676CBC725D09C0173EAB5ED5F0568EEA7033041D3F2ADBD7A94B58C292B8642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879680, "uuid": "133361dd-6788-42bb-ab18-e6419019ef74", "value": "786432:9OWf/W60a6BXDYnDWuVUm+AcrkTkQBSGLPB5pSUjtL7:9OWp6dXY+pGLB5pSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879680, "uuid": "a964f3f5-286b-4c14-adf1-f7325342c0fe", "value": 40360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879680, "uuid": "561ad8f4-3e5a-42e1-91ab-2bd0768b6790", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879680, "uuid": "d1a53dd2-3126-4152-8556-a081a6e315b2", "value": "1c4388f40db1ecdc828b95cefd62add423201ff1f1cebac1ee8ca898fc6a4797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e24b14-d10a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764850307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850307, "uuid": "8d4eafe8-1d7d-4304-b68a-2405d4995c71", "comment": "Malware payload", "value": "b2d43b9129d32b395a08734eb8cc16a0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850307, "uuid": "12b6c6d1-6eff-483c-8b0c-6d85f307944c", "comment": "Malware payload", "value": "1d15f0700a2dda228394bf37ad20ad2bd88c7813d6aca0199a6b40c704f80bc1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850307, "uuid": "7b9c4cfa-a9e5-4cce-9247-220cb1aaf164", "comment": "Malware payload", "value": "3f7cf515a78a56b3c1b5a7edc072c9a42d5a05ef", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850307, "uuid": "164b4409-14de-4677-b34d-6d2433ff40c5", "comment": "Malware payload", "value": "a7f88f61cf28131e1f669f9578dcfcee5a92bee1a5272cbae18335ec3afec942f3bb0846ed51d2db54dd8d03fd161ba4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850307, "uuid": "f5fbfad3-6694-448a-a84d-c4b5a69f73d7", "value": "T13106E107EF84DAABD4BAC3F16B770CA92A175F04C6529AEB0514767E2E771C00DC5A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850307, "uuid": "6c9626d4-5ea5-439e-a724-7bf88c6c0f62", "value": "98304:NKZDHecFDWMvYkFQTotPIp2IGmzmzBHTa0tRnsq:QjgMQkfPIp2Ixz+5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850307, "uuid": "a35b1dfa-465a-49c2-b049-61dc16bb358b", "value": 3965265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850307, "uuid": "0d42a5d6-3148-45a9-acb1-6e872a47d7e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850307, "uuid": "7ef7d213-16c3-43cd-87aa-1c96ad6071c2", "value": "ready.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa607aa-d0db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829964, "uuid": "142e0d41-9063-4ecd-981d-bf26a0360b5a", "comment": "Malware payload (Mirai)", "value": "bd9e19088002102128eb8f979adad664", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829964, "uuid": "7a2bdd73-83b8-46e9-ae58-a1e530027c7e", "comment": "Malware payload (Mirai)", "value": "1e1b4b618235189d729fabbae78b1ee3fad32ab65f56f82197a2ee12ad0e3be3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829964, "uuid": "14f48be3-4ad1-4a8c-880f-041fa09c887e", "comment": "Malware payload (Mirai)", "value": "434b9285e4d07545f3a178509c2a859584e6a936", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829964, "uuid": "123ff7cc-d9b7-4e7d-9719-cf4a85ca300e", "comment": "Malware payload (Mirai)", "value": "a2a67807b98fc5fe2e7d192bd6f9b18c06f985e8ad35dc488accb71191925ee23319498e5849b27c94d2929003cc6d8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829964, "uuid": "6b73f676-05f4-4074-bdbf-33ee5384d631", "value": "T131A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829964, "uuid": "ea0dc2eb-248e-4d70-b4bc-c43347a621c6", "value": "1536:SpaZOuj/Q30SQXa1r3J62yqPy/RWLW0edmpwj6oNYK:5ZzjJa1rZ62yqPy/ULWzj6oN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829964, "uuid": "501f1948-fd52-4f76-b53c-958caad4389b", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829964, "uuid": "b7754ea3-79bd-4d10-9941-f15fea493df6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829964, "uuid": "bc29c06f-de7f-4034-a557-a4fa02c37c64", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a618f1-d0f8-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764842817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842817, "uuid": "90e62320-3d3d-4b4b-b4cc-67bb979a3081", "comment": "Malware payload (ACRStealer)", "value": "174f0032e6c3631bf7340e01fcc9f0ff", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842817, "uuid": "9c7d7278-0146-4e1a-b8ff-04cd9d488681", "comment": "Malware payload (ACRStealer)", "value": "1e2155a394707bb39cba0e09f183b322a7ffd5b5dfb387992cf2a14fd5751cde", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842817, "uuid": "1013339c-9bb3-47cc-b3c6-2722051c6412", "comment": "Malware payload (ACRStealer)", "value": "8dc1cd7c63dbcf25c83cff937736a83d9b66f93f", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842817, "uuid": "c1de8deb-05ff-4ce5-959a-f2604ba3c419", "comment": "Malware payload (ACRStealer)", "value": "540597dc563b60fa700361163fa42832a677f9219e6234f51959ae9ddb3aa43c6aa6296c3623ca83c73436cf05fc3924", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842817, "uuid": "b2fea1ae-00bf-4df4-ab66-f7d6c7dda104", "value": "T155054A51B6CF00F6E59C41FA881DEF67E53DB10447025ADFE36CAE1663252E12E3E286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842817, "uuid": "82a40fbb-c752-4e5b-b950-b2f01b08edaf", "value": "f9364da2e01420d9f33ccb9f7544a43c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842817, "uuid": "eef59cf9-9973-4fb4-a384-caa07b84fcbc", "value": "12288:VIyqCWP9ea6F+2Qfi29R351VytOMlXbzTtf6Rmnt24wDyXH26DhyEQghEvE98wm8:VIyqCweaA+wzTdS2TN9V4Q7IzED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764842817, "uuid": "5d6c6db3-dd2a-40db-9eba-24a8f2920dc0", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764842817, "uuid": "0da2ba09-9bfa-4fc3-8909-dbf812bd737e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842817, "uuid": "eae7af2f-e2a1-433c-a402-0d21c3d994d6", "value": "Qt5Network.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34602f9-d13b-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764871505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871505, "uuid": "9601d0b6-2f75-4fe4-8030-8a2fb50d892b", "comment": "Malware payload (ConnectWise)", "value": "10307d817b2eccac5e053b5ab835ab53", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871505, "uuid": "ade7381b-ebc4-45fd-b2f7-826fa770b2e5", "comment": "Malware payload (ConnectWise)", "value": "1e4d6715cfaad3943b71fa529402e678bd23913811b31a21481a5a8a2e1f3499", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871505, "uuid": "4f1dc487-8575-4992-8dd5-6c7e34bc9df7", "comment": "Malware payload (ConnectWise)", "value": "b835fd8056d6ffafab03363b503b55edff4838e8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871505, "uuid": "627fd22e-0e38-4b8f-97a7-952bc6c4305b", "comment": "Malware payload (ConnectWise)", "value": "8e0a821c8bf3d31c14cfaf7c53354b8b697284efe054ffed705f93fd7edc579878989b4bcf8a85720bd3be01476e57ca", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871505, "uuid": "23c47082-32bc-496b-95d0-79e730b608f0", "value": "T169D623116BF8D668F0F62A39E8B6A0B0A5377D125D22D12E6324791E2C75EC0C973737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871505, "uuid": "4ab66eb2-a9a3-485d-bd3f-f80ac568bbf7", "value": "196608:cHxcp9ym3nltDUJVzHxcp9ym37Hxcp9ym3CHxcp9ym3iHxcp9ym3cHxcp9ym3aHv:6GplpoGpFGpQGpwGp6GpoGpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871505, "uuid": "d2dcb90f-313a-4bfb-af69-26808bc9fd22", "value": 13647872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871505, "uuid": "6babaea3-54d4-4a8d-aebc-50f2261b1c16", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871505, "uuid": "f2c50fdb-429f-4852-b3c8-303870030d21", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fd906c-d0e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764833229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833229, "uuid": "e916129d-1d85-42d8-a034-2b5955c00dfb", "comment": "Malware payload", "value": "0e16d8e19e6c8043767c7791032fdbc7", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833229, "uuid": "dde909d8-60dd-445b-aa69-35d6dd58fa9d", "comment": "Malware payload", "value": "1ed28762e00db03a1bc42f2b6a442a753acf5dfa8e2e1c4159e60b0dc2755f03", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833229, "uuid": "27b7a9f3-da96-44f3-9361-743fed5b3462", "comment": "Malware payload", "value": "303280584634f2ea3531947147f5f0a572b6b09f", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833229, "uuid": "d5ea0671-1865-48a6-88b7-55e707277f27", "comment": "Malware payload", "value": "46684be9c0f203d8edc780105a778f2f69046bcff2469dccce9344b9543619d5272fe5520e49aa015e0a0e627480b249", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833229, "uuid": "706d5941-8ebc-4bcc-ad5c-3146af15b2fb", "value": "T13522F82B360188D193B3573FDBFBE449FC6722672551A585B0BCD15AAF30920D3E8E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833229, "uuid": "e2a3a141-d20e-44ac-97b4-d42be879a86f", "value": "192:RTCoAEIcvzxvHcBmaP/wb9K0YAzX8uWNNB7409gpHMPrSJ9Ejq6:RDJ71K07M9b74mgSPrSJ9Ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833229, "uuid": "a9a3ae5b-f2b8-4d75-a420-9cacc964b4d3", "value": 9922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833229, "uuid": "71ba977a-4a37-45cd-8921-74e94c63c486", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833229, "uuid": "4a2253dc-4ce0-4550-8fd3-e51d9c504b67", "value": "ps2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bbcf58-d0bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764817931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817931, "uuid": "4c80ab60-4c92-4d70-8bb0-b45985b4814b", "comment": "Malware payload (Mirai)", "value": "ebf5dd5ae8e40dde09c33bb90159f9c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817931, "uuid": "9b743275-9c3c-4b75-93ee-2ad2cc6b6dee", "comment": "Malware payload (Mirai)", "value": "1ef864be6c65f0a3d1747a1a45bf413d7fb213861a68a27b1c7635c21a50a83c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817931, "uuid": "21845cba-0061-4e4f-b82c-fb8891d9a23b", "comment": "Malware payload (Mirai)", "value": "cb28ca8a88074a7fd7e829729c030a39bc0d4e12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817931, "uuid": "88997b43-c640-4119-962b-c767bc93fd59", "comment": "Malware payload (Mirai)", "value": "069309aea7bd9df6cb48beb624e04d1a713edf39d6e30710f95cbd88097d2c841c224dbe2c85ab05592743d9e52e1139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817931, "uuid": "02feabf6-b432-4112-bc2a-3e5db378eb61", "value": "T150633995BC909A16CAC02277FB2F418D372613A9D1EF32479D256F1037CBA1E0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817931, "uuid": "ef905c4b-5807-4c6b-8cca-1dfb7a148a41", "value": "1536:QYAWwipTCkQ56eQd1e8aCwqlR8Wc1jVnyQKnvj1:QYXDpTFKGa7qmWc1Yxj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764817931, "uuid": "8b00ea6c-6e87-42ee-98f0-5475be027861", "value": 66872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764817931, "uuid": "2d27dcaa-738c-4a8f-a85c-39f79e9b7fab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817931, "uuid": "b336d8b0-6d51-4ea8-90fe-399c9d2d1066", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf24cdcf-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888276, "uuid": "0f98c012-5d62-49e6-99ad-d9ae72a7c145", "comment": "Malware payload", "value": "c02ace492d7c1b03b4946a8ed46167ee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888276, "uuid": "3d7ff21d-e969-4e51-8721-2e68b3839890", "comment": "Malware payload", "value": "20ce926e3e40ad03b1d6bf524da3dbb003ab6818a974704839ba1f220ca83d92", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888276, "uuid": "d46b8711-5934-4ab5-b74d-e5995d21d5d5", "comment": "Malware payload", "value": "068f52a720f959ee2515b616c43ab65a0845f5b3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888276, "uuid": "c4d953aa-2c8b-44e2-9e24-f4a0c53e757c", "comment": "Malware payload", "value": "744861e7a46135f985456b93113ef443996529167080c91d5363d4c6161b6740c69a7a0a61089dc5b243e2d1f8005c29", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888276, "uuid": "e6b428ee-f557-4970-94b1-05b34d318097", "value": "T15011EF5E31602210CDDEDE713BA2AB02A584C2C511D4372DEADA1AB1C8EE6387D12E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888276, "uuid": "2f90cb40-f2a9-4a22-9fd3-34bc1d4d9b59", "value": "12:78ZtETZcETZrETZpfETZXWjETZZETZ7jETZ7kETZ7bDls:etEVcEVrEVpfEVCEVZEV7jEVgEVXRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888276, "uuid": "de2b1240-fb7a-4365-b438-56100c08fe38", "value": 910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888276, "uuid": "5230c1a9-e218-4e82-bbe1-99b269a3e4a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888276, "uuid": "c9bfcbaf-7a25-4a07-a8a5-d2e3c0f316d1", "value": "dvr.cenova.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23274271-d131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764866942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866942, "uuid": "2c15195f-9997-44a0-a627-f062c85a6384", "comment": "Malware payload (Mirai)", "value": "b59cfa260f9f3094bce43ec0b05196ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866942, "uuid": "958240a9-e722-4722-9b72-639a17dc775e", "comment": "Malware payload (Mirai)", "value": "20d460ea9bf709ac442e35033cb512c5368e778ff2636bd6bce6a680b266fe36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866942, "uuid": "d1c83d15-d080-4932-bf1e-77e2d88d652a", "comment": "Malware payload (Mirai)", "value": "3879142a683f76e6bf1022558f606d73f585cdbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866942, "uuid": "d868066c-33d6-4daf-b3f7-35cd37940b0d", "comment": "Malware payload (Mirai)", "value": "227e965b6a7bb41f5009dd0d348fa4308c88313253eb1fe6a6df76ad30d93d0666d610b13d20b51e54c336429981904f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866942, "uuid": "ad41ee7f-6866-4ff7-8505-579e36e263d3", "value": "T1CB63027FC4266ABAE0776FB3843B01A0E7B26C79C5EA6E73D894A17E15575057A00802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866942, "uuid": "49197d34-6173-4313-ad3b-b5e54484be72", "value": "1536:fwVO8ytHuOsyCfHfNCBQiyaPjemkxQi3Ry3YSDSb:YVqurH2QiBMei38ISmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764866942, "uuid": "a7450500-bf55-480b-90a6-38fd32141f16", "value": 68216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764866942, "uuid": "1ac9c841-edaf-44fd-ac8a-fc11adf50ab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866942, "uuid": "038eb1c3-ee76-44f3-9461-89c47e631ee6", "value": "Polar.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285c2b63-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764833879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833879, "uuid": "60e83a08-729b-4fe0-a960-e4364eaba741", "comment": "Malware payload", "value": "ab6396cc0a18c13f5f40506b02e94a5c", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833879, "uuid": "cf2241e4-c0a2-4f50-9809-641f4e1d17b2", "comment": "Malware payload", "value": "21509e9833f7abf58fb6499e78195ca0d3906f126677d660f07589ed00f95e46", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833879, "uuid": "504520b2-fce4-43c4-8bdd-77431a5b1ba1", "comment": "Malware payload", "value": "3190e15078ceee8986ecaf24cdc0f22e016ceba1", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833879, "uuid": "309572aa-a79d-4c1a-9897-73d4d585bc89", "comment": "Malware payload", "value": "788ccb046a2938f7c5d00c4f11170989a60d07eb3732b23f80732ac4b0cb15f81689ae958e5061562c86763fa06bd5ce", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833879, "uuid": "13b262a8-13c8-4a78-98d4-27310251450f", "value": "T182B5337339AE16EA8AE236F0CE37324E641408C6BC546D9D2C92F761841677BD94E4CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833879, "uuid": "b13f29f8-3d15-4e83-99a6-12cb50328da4", "value": "49152:o5mElr9NAmNkt2LCKhifQeIr7V93J/VL46p5Rysefx04rs3g9C3f:o5mEJ9NAmNm2eKh68J/1b0xfi8sl3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833879, "uuid": "17297603-9423-4409-9c25-6c41e0eefd2b", "value": 2397724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833879, "uuid": "cf9f223a-6c55-450e-96c2-1efd5d7731dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833879, "uuid": "b97cb281-bf97-4873-82a8-3fcb04f0b2e0", "value": "21509e9833f7abf58fb6499e78195ca0d3906f126677d660f07589ed00f95e46.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3d3e46-d136-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869373, "uuid": "6f3cd91f-14f2-4fb5-b307-178bb50b0eff", "comment": "Malware payload (Mirai)", "value": "0b5697b8f27dc4b209690feec65e383f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869373, "uuid": "909c0b80-123c-4c72-ac92-5d32549c50e1", "comment": "Malware payload (Mirai)", "value": "218d9e5738bc9047f0adae9c8bfb5ad80f4b6d753394a1f301449cfdff9344b7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869373, "uuid": "f86054d0-c3a2-4fb4-b5e6-24c9afaabaad", "comment": "Malware payload (Mirai)", "value": "e369b9ae749c819e27493fef099651ccc297671e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869373, "uuid": "c83ea2d2-e990-4200-bb78-6dc5f952f480", "comment": "Malware payload (Mirai)", "value": "05b1eaf83170261670d29179ba73e43efa7b8ba19414aac9aa438e68cd862dd2413fb4ac838c033a7c05abd7ccaadaed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869373, "uuid": "3494d56d-0f44-46be-b8c4-8dc13f918402", "value": "T1011154BA02A1EA46001C4F84719D0558B6DBBFB4F4B88E99D9C614367CF5609739CF8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869373, "uuid": "ece56c8f-78aa-4c89-bd73-445b25746af9", "value": "24:TmiHQpNIBSVbKnAWdUHQPCtNdlNw9Cs6ofgaRilrlstLG/lNtoMxn:TmiHQiSVb4AWdUHQ6LdTWCs6ofg4Sls8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869373, "uuid": "5153d122-2249-414a-b2f8-6c1b55be0402", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869373, "uuid": "57eb85f0-baf2-4eac-b42a-890df3163481", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869373, "uuid": "81ffa706-ee8b-46ed-8bc5-ffcfd8923a2d", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3743db-d101-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764846505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846505, "uuid": "ee674320-46e5-46df-9ecd-addb01e7a08b", "comment": "Malware payload", "value": "aec4f8188e414df473f77258adb01a34", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846505, "uuid": "c37a0467-65e2-4c40-aa07-dcd70d1ecf55", "comment": "Malware payload", "value": "21cb07f97127a5427603d9d9540c68e0fce7e1d4863216d86799a84f32074d05", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846505, "uuid": "f32f4797-80c0-4909-802b-863e54b374d5", "comment": "Malware payload", "value": "02c6e04aebeb5e8d584a72a11c6a19e7fa1eccb4", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846505, "uuid": "5639f075-f5a1-4122-8912-fde12526db28", "comment": "Malware payload", "value": "3c4eb34add26ef8ac80f949b597472f4c98d3d5ee0e1c732b1cf9f55157a2c6835fc6c451a554cfad0028f6557a90f06", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846505, "uuid": "143243fe-7e2f-400b-ad3c-529ce20b9fb6", "value": "T153412814DFF5431DE2B2863AECBFA2025932BD15DD1DD78D0142538E5872514A826F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846505, "uuid": "bc06e118-89d3-48f5-b7e5-1cd615e35eca", "value": "48:8eHCkvWZGtmvLXwI+kQAuFqcAuDAuHTmr/KRe:8eHCPDvp+kQA0AiA8m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764846505, "uuid": "278b7adb-4b9f-4101-86d6-d2328a0502c0", "value": 1877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764846505, "uuid": "aa6f64d8-d32c-4c81-af45-a7e502709236", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846505, "uuid": "b63d7daa-c3e9-4a5d-972e-94c7c0af4b8d", "value": "Declaration of Income and Assets.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c01e85-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764834277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834277, "uuid": "871d0768-8a65-4bd5-b575-30217cb407e9", "comment": "Malware payload (CoinMiner)", "value": "e375197fe3da83871ed3a69a58cb3efd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834277, "uuid": "ff1ff07d-36e2-4ab5-8358-195fd572547d", "comment": "Malware payload (CoinMiner)", "value": "225f71e9442fd75cd407c40cd5a92b7d94693b8cca8848b1256605f2827b84f2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834277, "uuid": "16e31fb7-8cba-486a-866b-fa8c023873a0", "comment": "Malware payload (CoinMiner)", "value": "8c894a418051856e44d9352bdfc917068809fa40", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834277, "uuid": "fc2f2e72-2b92-4466-b53c-e21634eac1e2", "comment": "Malware payload (CoinMiner)", "value": "ae1dd88443f2f53384c09cd399c36941be082d8b5cc5053933639a9ff9dbf8258899fab4ac5509da2e04241f7ba6d7c2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834277, "uuid": "ef7f074e-5037-4290-9783-f06ae7c7c127", "value": "T1D4766C0BB6E258FDC19AC870475FD563BE31B89842117A7B36949B302F67E205B2DF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834277, "uuid": "c768f014-266e-4acf-bc18-0ab6b4fcf7f3", "value": "98304:pa8d50sDsb2SYHD0afdiEobXPU5a5svPEfW73/nOx69dVlVKfydkyGMMnjbPFXjq:bVf73/nOxT4yhqwvJvxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834277, "uuid": "ce781ab6-3222-49f7-9d40-57760b5c3c4c", "value": 7190016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834277, "uuid": "c13ea473-9023-4ba5-b0fa-5004ccabf9cf", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834277, "uuid": "a378cadb-4284-4435-82df-53dfc68b6e61", "value": "linux.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cddbe796-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888273, "uuid": "ecf06db5-1a2d-4deb-bc0a-9f5d148217cf", "comment": "Malware payload", "value": "2cd44e07c1209807d854eed2077d1c85", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888273, "uuid": "d00bf9de-2d80-4b44-8b1c-f4cb631ffee6", "comment": "Malware payload", "value": "22930d1fceb40131fd673d1497b5651957876f937f32509554e1de938e43ad11", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888273, "uuid": "dddf9d3e-c576-4a1d-af60-3b119513246a", "comment": "Malware payload", "value": "75fa70c9bca4193a9922612063694b2a7b11bf23", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888273, "uuid": "3444ca27-9ac3-4238-b09e-2324a6e3e716", "comment": "Malware payload", "value": "0d88ce75cc5006da6888634c351aa79e54ce5e88ab6c2dc96dabd07c913d00dc20b69ee9b64a81807621302a4b2be849", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888273, "uuid": "74b55be1-f32a-4cc0-a0e0-d802aac47e0f", "value": "T1FC1100EE28185549D278D6637CE7E501F24D876364C63B25A3CF8F3D90DAA04351BE8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888273, "uuid": "1a627a52-5599-4dcc-90f6-0625af39486c", "value": "12:78Z7KEZgKEZxKEZpVKEZXWZKEZnKEZ7ZKEZ74KEZ7heN:e73g3x3pV3e3n37Z3U3deN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888273, "uuid": "b336ddc3-16fa-4408-a5f2-38c9d5676098", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888273, "uuid": "90140b40-e186-4f25-a508-5fba74275c60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888273, "uuid": "61938d50-9598-4205-b5f5-5fb30c021a4a", "value": "router.tenda-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c557168-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829349, "uuid": "0d921b16-f4f1-4ecd-860a-3c17846dda88", "comment": "Malware payload (Mirai)", "value": "4f56eb8b366be544e2795180e85f20f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829349, "uuid": "81529b45-d200-4758-ba52-b91f8aabd7cf", "comment": "Malware payload (Mirai)", "value": "2303facdc2ccba444dd79071ce082fef243c7361f38a863a0fcd1956a5c3083c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829349, "uuid": "ee6fd1c6-65d0-4e6d-a6cf-306191122f93", "comment": "Malware payload (Mirai)", "value": "42a4b649e2518282575d5315186e9befe5ee2184", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829349, "uuid": "45f13843-4edc-4947-9c9b-287a2f6dbec7", "comment": "Malware payload (Mirai)", "value": "31c64593882749a403a9d044fa83cee515657a69602440913a270fbfa29aa2333f6c381a2d776f601aa0f2b78c5988d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829349, "uuid": "7e754505-0b52-4cd2-a10b-a0628c977728", "value": "T18813F1E7412867B5C4322AF0045033B1CA26F8573796267F056EBF2D883FF51AA64E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829349, "uuid": "5b94b6a2-6713-4241-9647-3a776b5090f8", "value": "768:ZhTPjCYZOih2sCqbK0YgVf+yajc8rc8wNmaGw+I/Q6f7Bx05U:ZhTzOitvlYEalrnuKaAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829349, "uuid": "3dad3113-d8f6-418b-98bd-4594515a9762", "value": 41972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829349, "uuid": "ff9e34a8-edad-4319-8ac7-0b910224fb3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829349, "uuid": "cbd8fc08-85c5-4474-8cb7-2f89edef1c76", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00829ba5-d0c8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764821786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821786, "uuid": "77bfaea1-7f13-464b-8507-22027718308b", "comment": "Malware payload (Mirai)", "value": "5ac2c9f869e3ee3c38938afa49b94af9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821786, "uuid": "b24f64db-0816-44c0-b573-b9e0a3a3deb3", "comment": "Malware payload (Mirai)", "value": "236781500f70917949979e79cdd40efdef1c2ffa11e698409d67bc5e0edd447b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821786, "uuid": "f94a61b0-f684-4d32-8b2d-abc05b8d5b9b", "comment": "Malware payload (Mirai)", "value": "89f5ce81fe6c97712561ce60db817798201e24b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821786, "uuid": "05205eaf-01b9-480e-b03e-4e08bf3ec88f", "comment": "Malware payload (Mirai)", "value": "0de203877424e1cb0e15435f37b6fed9d692aa5e835de11077584e6b3157c6ef6073677df20ccbaac63fb6db0d6a1da8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821786, "uuid": "e22d9704-b17d-4a7a-8b5c-8b4a15dd23ba", "value": "T147B34A73C86A6F58D668D1B0B0358F392B63A951914B1FBE2477C2B48483D8DF6063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821786, "uuid": "298c3dd8-5f2d-4e8e-9cc4-51ea9f54105f", "value": "1536:U+d78rCPGOhPbC2KtxwD7U9t19wakvTWWy6Psy/9:RmrDOhjstwS19wDTWz6Pr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764821786, "uuid": "6ebd6980-1a7f-42ab-aab4-f222da9f8c95", "value": 113380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764821786, "uuid": "357575a5-02b6-4deb-b9af-1e324f17f5ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821786, "uuid": "6ce80d82-1c07-4183-b586-cc98dfed826c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f89af0-d134-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868581, "uuid": "93ec720a-0caf-4ca4-8268-8b3a66291838", "comment": "Malware payload (Mirai)", "value": "05685b21ab869175db34387885845fad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868581, "uuid": "b35907cb-85c7-4f90-8dd0-b40f95d85956", "comment": "Malware payload (Mirai)", "value": "23954efbe0c359542be1444beafd26cba7fe09fcddca3d5e5f6101d1f2f79968", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868581, "uuid": "4742bb49-cb64-4bf7-b985-6daff9a6c264", "comment": "Malware payload (Mirai)", "value": "8e544597f532b5be38565f04bf33bee6c68904bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868581, "uuid": "101b7ef6-9146-4e44-bfba-d9648902406a", "comment": "Malware payload (Mirai)", "value": "bb68c2f6486bf8e1c78e7b5e9881b51f35432f0f3a212504f0bb5ed4996b427d7318c6cf2cd2e35cca5ca7b214e9922b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868581, "uuid": "e2653811-f0bc-40bd-9664-68055a00f641", "value": "T1EB43E891F9824667C1D023BAB75E5A8D33A163E4D2CF7657C8204B207B8A94F4D77F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868581, "uuid": "270be369-ae59-4a2c-b78e-3078dea1759f", "value": "768:rvrFVegVE/XxlQv3Z05MABWjt6hIAUeN0+8dSIheiQxbwdcJ3BdrUAho/rwtQ:Ntq/Xxq3v6htUeN0+85eiHdcJrdBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868581, "uuid": "90095900-e2cd-49e2-974a-8bf484f254de", "value": 56096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868581, "uuid": "8e9a5398-a30c-4728-a3f3-32286e3f0b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868581, "uuid": "1d355c55-b8d5-4e6a-b726-8782c0f8273b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f646ae14-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834225, "uuid": "55ce26e3-7c6c-467f-913e-6eda408de42a", "comment": "Malware payload", "value": "786940536eaaa286ffdea0c91b450738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834225, "uuid": "2aa1259e-2a35-478a-9147-76a12af482d0", "comment": "Malware payload", "value": "2538ce3d0ee84eedd2ed5f2e7d8dd28c8aa357739728b1bbab7d9cb7b37ddf74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834225, "uuid": "6e7e1953-e9fd-479d-b715-48be7db67f80", "comment": "Malware payload", "value": "aa77ef3359641f4bfd5a651989c7a4077e03c811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834225, "uuid": "aec6cebd-83e4-414a-b311-c1142946602b", "comment": "Malware payload", "value": "547e8e3d37e07e2665e5ff15e5a4769f38714ad8949856befc86ea8e3ca76ed5f32383a379297de6e2aa6e9c9a2b4487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834225, "uuid": "020f84de-a97d-48bb-88da-12bb18293ba6", "value": "T152D33A0063E50981D5AD6FB7A9B60B520B33F0161E63CF59C3DA376A9FB26C15B12372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834225, "uuid": "821f93c0-720c-4452-b7f0-83dffa0e221b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834225, "uuid": "d8a129ae-9ab6-48a8-b4f3-64c4df6e108c", "value": "3072:7Izh3HeHQSsYGGEcNWsh4Xby+E4TZuALee1IEBx0:7HzEc3sbLJ13O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834225, "uuid": "527dd2c3-0452-4171-a66c-bec7f5027b37", "value": 135736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834225, "uuid": "3ac990f9-939c-4fbc-aabe-2bb8be797192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834225, "uuid": "e5cf990c-8737-4ddc-a247-a6560a7d01d2", "value": "Uninstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fefd376-d11b-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764857487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857487, "uuid": "57e17496-66fd-4843-8862-7e95299b1903", "comment": "Malware payload (SalatStealer)", "value": "c7978a515d1a6756c110140bec87af80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857487, "uuid": "e81883e0-451e-44e9-806e-0f3898db2a5b", "comment": "Malware payload (SalatStealer)", "value": "2551eafaf5df0aee97fb2e16051b9cf425e5b93e421e113e5dbbc6206c06b66e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857487, "uuid": "ce28842d-5523-4f97-9572-1eca6ad4b07a", "comment": "Malware payload (SalatStealer)", "value": "eedbd48b594681d3ff9f96d99f7acf27f0374b87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857487, "uuid": "b17a1691-ddfc-4ab4-a0dd-d5b90486ae05", "comment": "Malware payload (SalatStealer)", "value": "9d20056bbdbcbe3eeca88fee737a8934b730dd1c3a331c47b1d0bf63c629d00b2852618362a32bd13c17e36e64759460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857487, "uuid": "86a3cdb2-3f8d-4cb2-bb74-b7397db459e3", "value": "T1A0E533328D4C2EB9F7EA84372A0126CF7445AD3F658DC64A11F439702968FCE7D892B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857487, "uuid": "bbb8788b-b167-44f2-ae77-fd0e4b059200", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857487, "uuid": "4500d5dc-a4d2-4c51-b55e-7c196f0161fe", "value": "49152:Dsu24IIAEEn2xkG32LCiRC6kclf1qrujpRMflayQ4Sc8QVWCHHv8hJUVL3x:U4IIth2LCik63pICjpROh8QVhP8oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764857487, "uuid": "fab7e430-1eb2-405b-885b-56cc01cdfc5f", "value": 3291136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764857487, "uuid": "4d3dcd8d-16e0-498e-82e7-54c798ec981d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857487, "uuid": "b0261704-ca71-4305-97f7-0f20f3cbd4e9", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5e3ee5-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883115, "uuid": "411a9aea-3100-49cd-a8f5-b7f088a87f53", "comment": "Malware payload (Mirai)", "value": "653e978931fbdf8b1b6d38532bead518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883115, "uuid": "7afe7440-ee4d-4db1-bf0d-4348544d85d5", "comment": "Malware payload (Mirai)", "value": "2570adb3ac3ea5ec5dbc071eb8761304cba619b33e978cb6fdcf1c0ae0e6dcfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883115, "uuid": "0ab0a3ca-1a39-4c5c-8908-86d04e8c20ba", "comment": "Malware payload (Mirai)", "value": "4e0f4ae1216121b9a1fb435174c2bafb204fd84d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883115, "uuid": "cc331cc5-ad16-4926-85e4-cecc61f90a39", "comment": "Malware payload (Mirai)", "value": "05a3652e56082fc040441d40ef6b6406ad1a8de3c3e60be0380be4941d26c7fa6fc6970d656a7aa9d0c4791dd1b15935", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883115, "uuid": "8df520e0-dbb5-4487-9665-755804d07bc2", "value": "T1FB442B46F8818F21C5C016BAFA1E118E372717B8E1DB72129E245FB477CB86F0E76A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883115, "uuid": "e9576b31-579c-4781-b0f6-4e769d652994", "value": "6144:Fz7LcNF3u7SDsTH0ikc6XoRsazCAAni1LxkZH:Fz30F3ueDs70i96Xssam/niw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883115, "uuid": "b007107d-4dd1-4fb1-b619-71673e6ab8c7", "value": 265180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883115, "uuid": "66a57dc4-d3fa-4964-aba1-87af21c15220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883115, "uuid": "be2a9b1f-eced-4283-a03a-edc303cfa07d", "value": "ecco.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620af2c4-d12f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764866188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866188, "uuid": "bc26ee68-4496-490f-b4f7-0fbd1acb1aa9", "comment": "Malware payload (Mirai)", "value": "79fc45a0b429d75bd72ea979dfe270c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866188, "uuid": "3672c8ac-89f0-44b0-86ff-c370422e9500", "comment": "Malware payload (Mirai)", "value": "257d781f230d9a7b52e59c03c09f6dc3aa08d61f0a0a3721bc3d06daa43f1dbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866188, "uuid": "0181707f-cd05-4871-b038-f36d2a46c2c4", "comment": "Malware payload (Mirai)", "value": "474775dee6f14fd68f5cf432fc020271ce367719", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866188, "uuid": "5550d9d4-e4e0-4893-a272-a0f32c0283b2", "comment": "Malware payload (Mirai)", "value": "072185ee4e0494ef3d1665bc25ffea70afaee1e5db512856a6ada47ddd3ebd3bf2ca63b3ca075a85206cca8656b4f3d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866188, "uuid": "8af24d7d-060c-47e7-bb85-f4e69217f64f", "value": "T1DEF38D22D9646EACC2258574F021FF785B539EA646831FBA1AA7CB714043DCCFE053B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866188, "uuid": "5ba8a763-d92b-482a-b128-f776a6abc3cf", "value": "3072:eTIhs1dvvnee0PI6QpipAvKqJibQ9J8Kj7z/OW+UZijC:eTueGKpbKqJibt0zb+HjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764866188, "uuid": "9c010e9d-e4bd-42a0-bb29-26a6c23c309b", "value": 158628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764866188, "uuid": "34f05a6a-0490-429c-804d-2b3d79b0e92e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866188, "uuid": "b73615db-fa56-439d-a8fe-53680f6adeb2", "value": "Polar.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c52c8f9-d10c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764851146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764851146, "uuid": "f0b35187-e2db-46e3-acc6-d1674154f9a1", "comment": "Malware payload (Mirai)", "value": "69e637c09e9d101eba9903aeccb012ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764851146, "uuid": "f77c24c8-ca1b-4a1a-8e56-9aa843723dac", "comment": "Malware payload (Mirai)", "value": "259acbf6cbc016bc1708b9112af4ac62c2e82a147c5181d39bafae8cec1b6459", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764851146, "uuid": "ab4d6dc0-feaa-49cf-9cda-cdca687e6dcc", "comment": "Malware payload (Mirai)", "value": "34453fbdbc873b2da47a21c9cbb0f7070018f3e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764851146, "uuid": "b614580d-2657-428f-96a0-cec9bad94cca", "comment": "Malware payload (Mirai)", "value": "b022f91698b4e9142ea95d2c85e17d978e0c6a8f84cea1013706ef269b387ed92281ef7fae7b99af36b4149fb5ee2066", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764851146, "uuid": "915d2a08-3c71-42b1-9015-5074bd6595a2", "value": "T141231A0AF603D6B7CC570BF642ABA9AE4630F9685E264D5BF31C7CB4EB139843116325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764851146, "uuid": "53c88c3d-37dd-470b-b4db-58068e160ebe", "value": "768:rkmwwa6/EGtCn5cuUTNrGY0qhHeCSvAz/cRue3:rGZGtCiuUkY0sHZ6AzJe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764851146, "uuid": "504f20b0-e02a-4204-b7ad-521759d7455e", "value": 49457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764851146, "uuid": "a8f91d9d-b2fb-48ed-8806-c2027b77994d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764851146, "uuid": "82771fc2-ef3e-4e87-bc2c-44f61186c264", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fb545f-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834328, "uuid": "529393b1-2c39-468d-97fa-20d713181ef1", "comment": "Malware payload", "value": "77782cb9d36b7f3f7498d9eebb154676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834328, "uuid": "b11cdce7-6170-4f2a-bc38-a027f2570e73", "comment": "Malware payload", "value": "26cc2fa27c81f4b13b333b667d1c4396df79d39356760b67bf071b55febdfc44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834328, "uuid": "b1171500-1dd4-4d52-a8a8-345f8fb14d8d", "comment": "Malware payload", "value": "5460eb090b32b4b3e04f50275506c8bd98df33d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834328, "uuid": "79433a67-4547-4dc4-9ca4-cbbcdc3e1489", "comment": "Malware payload", "value": "b7a63e7525dfc7dc848d928a9be1ba4370a8c957112000373711f18f92d95e00fcaabd7f4d98db16f394d58dd65169f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834328, "uuid": "5443fbfb-a578-4f6f-a8da-691437de5250", "value": "T12C272221F242D437D4236A758C5B86E95435BB512F289C873BEC2F0CAF74BD17A262D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834328, "uuid": "781066c9-3d4e-42b5-9523-f828ae76a52a", "value": "760a65418ce879c3c7de8a2dfb392e53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834328, "uuid": "fbc89e52-fce8-415f-a7e9-3ce6fa005120", "value": "393216:ef/NiEZueFvZGJmTezCQrM5Ty2BW7ps3PG90:0oyXTeO4ps3PR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834328, "uuid": "467e1ef1-8a43-43d5-9a49-f03f891ca8c8", "value": 20339287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834328, "uuid": "38a1657c-9345-4c43-9885-a3b9702edc3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834328, "uuid": "2d2b895c-e8f1-4c7b-ad73-fabc2ad9cc97", "value": "\u795e\u8ff9\u516b\u8352\u9274\u5b9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66fe79e-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764870625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870625, "uuid": "b7b37239-ea9e-4c6a-8678-b417d6e3faf7", "comment": "Malware payload (Mirai)", "value": "f61d22babde434d789df89ba1a2c8db5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870625, "uuid": "fc253231-9d08-41d9-b4b5-50e3daa7a117", "comment": "Malware payload (Mirai)", "value": "29454f2e40ef1274108226aa73ae653b6fafa770107944571239a54edb682751", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870625, "uuid": "96d32d56-d2e4-49a9-b5c0-a6c8acd4643e", "comment": "Malware payload (Mirai)", "value": "aad538d0e708e0ed13f41cbc17b166d2ce0034c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870625, "uuid": "1a2fdacf-cbe6-41a1-ac1a-49bc1a77bc8d", "comment": "Malware payload (Mirai)", "value": "ff70b8f3452ba41ac04186bc2f3111cd50dc350bcf0804487e757b256581eea6d173488bfd600e5c94594d38f8acb622", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870625, "uuid": "d16fd1bb-3f7a-4ba9-8fc8-4ea3075d60ce", "value": "T123934A22BA7A1D27C0C1A47A21F74B21F6F247DA25E8891B7DB10D8DBF256402157EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870625, "uuid": "95b8e32d-2df5-4d8a-92ba-419753006e26", "value": "1536:ZOXSQ1pxh1OIKtsasJZ7tlHwRhOYCF0VFtqSMGN+b5E8ZnkaZRthFc/:ci+p/g4ZYAaFESMGNOE8RJa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870625, "uuid": "96817487-a443-41c3-a26f-6de53295d8b2", "value": 96528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870625, "uuid": "1bf9aa23-f026-492a-b48d-fae8024b2746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870625, "uuid": "e372872f-5b02-454c-b2a0-f5bb90d38c58", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931072e6-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879155, "uuid": "0eef3d66-27a4-4aee-8f1c-f74f853f3ea4", "comment": "Malware payload (Mirai)", "value": "56980f269a5c451b9e4adb9d7d431f0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879155, "uuid": "3f7b20a9-a2d5-4ef1-ad6a-41db335f96a1", "comment": "Malware payload (Mirai)", "value": "294fc54c282a82fa858adcd6801f93c394ba8278d657d6181d8b58393ade7889", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879155, "uuid": "7f4baa57-82de-4713-b991-35e72da09bd6", "comment": "Malware payload (Mirai)", "value": "f72673e1edf3d2172202dde8072e21d6e5353f85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879155, "uuid": "a47871fe-5d77-40a7-bb3e-96fdecf93eea", "comment": "Malware payload (Mirai)", "value": "6b36ae98e06fa10a1039262a6406b0195e66488ef294979c2e2f40c68248a9961229429f889b0c0b825bc10005f1e348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879155, "uuid": "98292b30-d930-403b-b016-5afd3caa5e74", "value": "T16B639209BF611FF7EC6FDC374AE9274525DD641A21A83B397A30D818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879155, "uuid": "ea5e39ba-a0c3-499f-ae0f-dc021ec3e1ca", "value": "768:DlDScD5GY2ne8i2Sxt9yYExR5JIKI5vTemle5Re5bbvuH5XiANe1j9qE:DlDSC5G9eb249FKbI5fl8RWbriq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879155, "uuid": "49e4ad0c-8472-4b8a-9a3f-c72242541467", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879155, "uuid": "f6f4a521-8a43-4437-be99-06523288d92e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879155, "uuid": "d83929ba-9a6c-4d32-8b22-ab8025d87083", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d7eb17-d154-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764882212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882212, "uuid": "6b661366-af41-4c1e-a803-a9f95d3db8f0", "comment": "Malware payload (XWorm)", "value": "8a8457c45eb368a6ff3bf2908ab24154", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882212, "uuid": "a08f77ee-1b76-490f-a47d-c6a3249f2847", "comment": "Malware payload (XWorm)", "value": "29615df272e5a8c6a57803cc6fa08061975c2382625462570fab88d78bf5be24", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882212, "uuid": "13869007-881a-4bea-b98a-6607591c5481", "comment": "Malware payload (XWorm)", "value": "75ab3f20afd105ce9e5e9a892d9c4821d2edbbec", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882212, "uuid": "16545f90-7c76-4b2c-9b5e-86a505bd7a76", "comment": "Malware payload (XWorm)", "value": "d273319c37cb5e2ea6cd5e9fb7b858af08a5b9ea3849a9f8f1b34d17fce57d8bde2cba2e3b570b6e89c1e1b1e9bca5cc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882212, "uuid": "426fc563-7c4a-4660-93b9-4119cf651074", "value": "T15E41680702306837CFB19106456DBB2E6E06D4E37103ABBD705529AADC568F7C1DD6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882212, "uuid": "920dd9d7-e1d7-493e-84e6-3b6f348c5868", "value": "48:E5D4OjyiOjU0jDlrj4TjUsjV/jAAjZuruvDXru1unurzux2:EbjE5pC19d8qu0uu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764882212, "uuid": "a46bd4b2-b1db-4e79-9e3f-1f377e6b091d", "value": 1899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764882212, "uuid": "b3c4bb64-1526-43d7-8aff-a02331905598", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882212, "uuid": "993498f9-3eb3-4486-bf0b-b698c718cd5b", "value": "wa.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0669eeed-d138-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869900, "uuid": "568e4d5c-533a-4b87-8c49-3d81216a48d1", "comment": "Malware payload (Mirai)", "value": "f18f7f8730ece99e80c23784522836e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869900, "uuid": "0e336b19-d3ad-4be9-90c0-f2b6e8902019", "comment": "Malware payload (Mirai)", "value": "296724ae77939294f95b72db61aacd8122ab5e28f15e7873b6358316c77485f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869900, "uuid": "fb2f34eb-f316-49e9-bad1-a7a81733f212", "comment": "Malware payload (Mirai)", "value": "c926525b9ec94d264d7dbfd1053c13a233a0410e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869900, "uuid": "205ff655-73c6-4e40-93dd-0defb8cdf0c9", "comment": "Malware payload (Mirai)", "value": "8702516ef1140de0d5116bf1084bcf8c09875befe8e23f1b215a2f08721b669a5db94605a85cd619252d75ea9857bb71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869900, "uuid": "c5819cae-72f3-4ee6-bdaf-ec87d84aee4f", "value": "T1F54301BBA4C32F3DC72C053C887F63195DC0E25AD965255ADC522A322C90BA27B5838E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869900, "uuid": "8ff0c7ab-395a-40b5-8638-620557489fef", "value": "1536:0fhoNSdKY/mNXqCXZPiRDaDFcx55Mcz2xCnouy8tyw:0JoNiJ/mEC92ah65j2xaoutx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869900, "uuid": "b488158f-4307-4881-8882-e073a748a006", "value": 57992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869900, "uuid": "394f658a-d03f-446b-b860-facdf7b5f2c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869900, "uuid": "0744479e-93e2-46b0-b7cf-aa6e273d57ea", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f04a32-d14a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764878033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878033, "uuid": "305547b9-78a0-445c-9e18-9477f7941382", "comment": "Malware payload (Mirai)", "value": "94531ac53d51a8d8c1b77d3c22cf3844", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878033, "uuid": "bd0623d4-e1cb-429f-8110-0904981b3076", "comment": "Malware payload (Mirai)", "value": "29a83637b4c906296e27aa2690b9b7a898bd0b0325fe0cef756c9678586296f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878033, "uuid": "bfeefcac-a63a-4de9-887b-495e688a9ec8", "comment": "Malware payload (Mirai)", "value": "3a7e9f95da526f9736064a63cb9df39a534e84e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878033, "uuid": "3be18632-fd44-4f8f-a185-d91efc30c93d", "comment": "Malware payload (Mirai)", "value": "f11e7f823dfec3b5b7627c52c5e372175919e5bbe30b3a8c78278ed1c01b8fca4612917ec0cb97e9350e08292666c267", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878033, "uuid": "6b703db4-2505-4d7a-8f59-dd926b24d10d", "value": "T1CA330986F891C95BC5C4377ABB5D124D332753B8C3CA3306DE1406247ACB69E0B6BA63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878033, "uuid": "65494594-b7e7-4db3-bd72-4bc1a684fde3", "value": "1536:JIkpBZkXTjfAMyUndgfhjwcSCeIshZB2L+p96i:JIkp0XfIMyaCJcHYL+pMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764878033, "uuid": "d284b497-fc67-4931-a6d3-6b96c939158f", "value": 54688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764878033, "uuid": "95f022b3-05dc-4866-a4c2-8a5c4d373a9d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878033, "uuid": "86ff6ade-9ccf-4011-89f5-dcca88ca09fb", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f71d381-d0cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764823637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823637, "uuid": "9e72a7ec-612e-4a56-ac79-a06799cb234d", "comment": "Malware payload (Gafgyt)", "value": "edefa822dd444a7c30b4cb1d0440df34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823637, "uuid": "03dd77b9-772e-4261-8264-ed877ff81f39", "comment": "Malware payload (Gafgyt)", "value": "2a32bd0d89f79561c3dfbc4d42cbb8e00a6aa5691b9edb604dd607a7389510fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823637, "uuid": "9e9885d8-2467-4b30-9cb4-7e57e93302d2", "comment": "Malware payload (Gafgyt)", "value": "6e3b56f193623aec0e220f9fc9a707faf90a3ddb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823637, "uuid": "f4ff5579-490f-4486-8434-e25fb1b2fa4c", "comment": "Malware payload (Gafgyt)", "value": "f2f919eeebe0981e85b55c4a845ae24cc443af606ed216c84621a04b181b2018a01ec24b43683d4af28b01a7ae81aab8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823637, "uuid": "d66c2393-6534-43f6-9217-8320ef87293a", "value": "T159C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823637, "uuid": "d351db49-3d17-498e-9648-fa0d19f6fed8", "value": "3072:ekYPUfsgnsb0J2ag/VfDkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0DkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764823637, "uuid": "9ae710a4-3251-42e2-a9f5-66ac76b853d7", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764823637, "uuid": "146ecef6-26a4-4c71-a4e0-ed877051004d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823637, "uuid": "6d1a0ebf-3b54-4741-b15d-7a93b5627ba7", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9f676f-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834106, "uuid": "0d6e67e9-4a49-4082-8f9d-1356ecfedee8", "comment": "Malware payload", "value": "cabdd3277c10d598d9f2f90ec7d509fe", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834106, "uuid": "a35e8eb7-28a0-4a60-b094-b290acd4f3a1", "comment": "Malware payload", "value": "2a511f135e2c73df339e5c033da2a45de124edf3300aa7f9c54c81b1eacbd755", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834106, "uuid": "5ce646b3-e06c-4715-8d6a-86f831c8ddaa", "comment": "Malware payload", "value": "9bc56c97f01ed702236b8e1e7eaddd11f60c0741", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834106, "uuid": "f73cdcce-90d8-4748-b70d-3c9ac020d562", "comment": "Malware payload", "value": "0a9718ad1fb087559f5511be5f83ccb67ed2dc31c4eb501db0e4e0ece2a0e52dcf79620f02c3d7c20841abf5f6fe0103", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834106, "uuid": "72298c02-359a-4b02-a591-9625b148dd3b", "value": "T14D22BF639350C0F2D17523731C0A6B73EF854348E25D0A6A6C7285ABBEC06137E83AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834106, "uuid": "486971dd-09ac-4b57-acc8-8439e6cd4d8d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834106, "uuid": "b4dc1543-15b4-442f-a2b2-34c11409af2b", "value": "192:f/x8VvuDAwhizYoNvLRyYKpWMI2A73u0CICE3E1UyfVp7CsqWb8ppgw:x8VvVR/Nopc2v0QE0iyfXesb8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834106, "uuid": "2ac1d9da-3508-4e0a-a3f3-f40ce4a19732", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834106, "uuid": "08fef2db-044f-4837-bfcb-f3f999b8863d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834106, "uuid": "4fa85df3-9820-4402-9ee2-81b87a656ba7", "value": "2a511f135e2c73df339e5c033da2a45de124edf3300aa7f9c54c81b1eacbd755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bc5f2f-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849449, "uuid": "3e4b1195-7725-4f18-9f44-e8fa5ef8163b", "comment": "Malware payload (Mirai)", "value": "9a142a9b6aa45889e5702ed2618229a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849449, "uuid": "ee68d1ef-6269-4127-bf5e-7d92fdcc7e6e", "comment": "Malware payload (Mirai)", "value": "2a67737f52f7f55d23f75be6c1498ea530d22136d3958b291c290f28adc052df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849449, "uuid": "a88e7943-86f9-4206-bc99-1154538b670d", "comment": "Malware payload (Mirai)", "value": "10f199e255f53b7db4ad60a1801fedbae2a0926b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849449, "uuid": "47e98117-cd32-4cc8-a7f8-76ab7e54110e", "comment": "Malware payload (Mirai)", "value": "a9248cd62b878317b50903a8c143c56bcf81e6d3775cf99fdeb25c252635d54a82d2c5cdf080b0f2afdf6ab6fdee3ebd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849449, "uuid": "db275ee0-54b0-41ec-b4f4-ca2c1d7844d0", "value": "T1BA31ADCB02F502B97CA5B93373A4872472C490DB25EABE48A4F878B5814DE4C3895E77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849449, "uuid": "96b44c8e-3ff6-4ad0-a6cc-aadb3f79a8d2", "value": "12:q0FMz4a0Frg20FniWu0FZexred75a0FpLbp0FJiaa0FD23+0FpFLXTt0FSuS0Fyy:v+6sjnVrZ0675fsJdepFjiNXsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849449, "uuid": "76baa858-d53f-40f8-982b-af548b9b888a", "value": 1663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849449, "uuid": "8fbf946b-af2a-4aa9-8f07-9fee51b76668", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849449, "uuid": "54f0982d-5b31-4433-babe-ebfd77309621", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdb2bdb-d16b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764892164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764892164, "uuid": "b8d6c5c3-4ffa-4f5c-ba53-9a2138447ad1", "comment": "Malware payload (Mirai)", "value": "77b9506e7f23cbf5418f45f033548a5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764892164, "uuid": "5d0bd3cf-25de-4a28-9114-f019d08c4bc3", "comment": "Malware payload (Mirai)", "value": "2ae3b572b98f90359c36553cd7f58a25951f14f076d66a0a10caee3e40377129", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764892164, "uuid": "18a00b8c-d832-46cc-9589-64ef5428fcaa", "comment": "Malware payload (Mirai)", "value": "8af3a093d8e0f7eb33c72ee254ffe2c5199a0bd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764892164, "uuid": "7ea0efc3-fd21-47c2-a8b2-b0b9f1bd3355", "comment": "Malware payload (Mirai)", "value": "02923676290f3fe1e1a44ca4f57955720627a57df3bf976acb90a7b7ff3f43705af2d9bc53cad7d3c1e5e0a16bf8fdca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764892164, "uuid": "e72c8bd3-c91c-4392-acd0-86c51b8c6b85", "value": "T1B2436C96E404DE7CFC0BE3BF94124A05F925731535830F2BA2AAFDA35C721994C66D8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764892164, "uuid": "10b05921-a69a-4504-8c01-9c30bfd69e83", "value": "1536:PVAYt29r385gyE8Vr8tarZPNsJ8uPqottfqJN3B4:PVAYtY4EttEZPyLq6qXx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764892164, "uuid": "8bac4fb4-0768-4950-9675-350d8cd4cbfe", "value": 59976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764892164, "uuid": "79e57987-f295-44a1-8453-da6be03aec5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764892164, "uuid": "11979de7-0e58-42f8-9a00-92886bd8e600", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bbeb22-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829907, "uuid": "8f2bec61-d315-4152-99c1-5ec4c3514917", "comment": "Malware payload (Mirai)", "value": "ce6474458a11be3bc4f9aa07a89ba2ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829907, "uuid": "eafe4a44-0ed5-4e0f-b957-e424b8048641", "comment": "Malware payload (Mirai)", "value": "2af6638b891578e2146bbdb84c32f92840ddc9040d85780c89141d587a1c13f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829907, "uuid": "e6f8ecdc-5b2d-4afa-8e23-3eb274b1ec8f", "comment": "Malware payload (Mirai)", "value": "7b823e4faf764ef5da59a13b70b80feba0fd6ddd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829907, "uuid": "973cca82-2a2f-4552-b921-cc396a10b6a4", "comment": "Malware payload (Mirai)", "value": "15cf3f7f3d1e0194fe2321ab35483133bbe8ec7229bdac70f5ed8fbcedddac09c831627bc3fc42ac7ef95f9f6d766c59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829907, "uuid": "22dedae9-7900-4277-b834-e3d667b33c84", "value": "T15C03E02C0A0504F4D57BC17AE3ED47E06535079E5886CE863154FA97EA0E8FC79A3AEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829907, "uuid": "e512f23e-75bc-423e-b9b5-f3929ca8b2bb", "value": "768:cgN29x3ZpzZ5VjNuvtE54Fe7GbxBDbYsPs4P5KJSuJgGlzDpbuR1Jn:q9xJZZNKNFjBfRUMU3VJup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829907, "uuid": "f13a922b-d309-411d-8f93-4a7fa1e3c3ea", "value": 38076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829907, "uuid": "d6a39274-f9b1-4f6c-b439-8cd9433ad413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829907, "uuid": "aa22280c-61ca-4057-b618-0bb08256f467", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c84fb9-d11d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764858712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858712, "uuid": "2daa3dde-069c-4635-9aba-f5352e08842f", "comment": "Malware payload (AsyncRAT)", "value": "0f8b98e06c6c5dbd8cc97611bf02a5c4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858712, "uuid": "cc7ab1a2-5750-485f-a988-7397102b8c6b", "comment": "Malware payload (AsyncRAT)", "value": "2b750e8e2c3fe8150c947b2fb8b6974e7765edb8c57e4305a3c684d7f8c55f66", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858712, "uuid": "5cb81de6-6d5b-4da0-a25b-e0874678f6f8", "comment": "Malware payload (AsyncRAT)", "value": "9afb9625918822fdbd924f607c1361a648edf642", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858712, "uuid": "3d9fea82-c174-4a48-9fe1-041a8ab2bb6e", "comment": "Malware payload (AsyncRAT)", "value": "e94b0a4963215df1380f7ee9365825023aa916ef890e88158a89afe16ae775a359e6cd1c74850792ee612bdbae2fc68c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858712, "uuid": "a1ae5d38-ad06-4b90-bd15-8a8ec0dd962e", "value": "T15FE6123232D55E08D0B387F805A2E9BA97337F1A2575D24A20F5BE97FBB39414C0664B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858712, "uuid": "353a46e2-a984-4665-86f9-82577b2e2dd1", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858712, "uuid": "a4333a27-55fa-423b-945f-af90acacde93", "value": "393216:F7F7INH3hGZSLoMlYLQMWu0VwCnzo+vSe7PEmrkSBJ9:F7F76Xn8tQMWuCzie7P9tJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764858712, "uuid": "30c84f56-8f88-4da7-98c1-dfd6a91e9d37", "value": 15227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764858712, "uuid": "c3dfa301-3fe1-4066-9ad9-11f55dcb189a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858712, "uuid": "6898905a-b1ac-4d55-aa95-c107b490800a", "value": "64th Services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b0712c-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883102, "uuid": "aa8b1d77-e846-4083-8273-f4d551d84f7b", "comment": "Malware payload (Mirai)", "value": "f872c1f46fbc3e306b07926d43410872", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883102, "uuid": "5a8c4a61-b465-4faf-ad60-80f3e10ef4fb", "comment": "Malware payload (Mirai)", "value": "2ba5a553b3698e2c8ebf221d3d8f5eafb119136567abee4c0e86bb76b89b9b71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883102, "uuid": "d7b23b9b-f6fb-4323-9ddf-4c0ddee9711c", "comment": "Malware payload (Mirai)", "value": "51920182f4104e89a57152a6f643b04b6d8690cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883102, "uuid": "84d62a23-7879-4b6f-a8c0-572924fca504", "comment": "Malware payload (Mirai)", "value": "cbc99d2c18a2eaeac45126f0256561fd3dca6d12a55d1c43b274921fd0ca790d52351ca22b2fc75066b161360acd3088", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883102, "uuid": "d7b9f3ed-6b76-4846-9523-51265a6984f3", "value": "T1CB445A02B72C4947E1D31EF4373F57E1A7EFD98220A0B641399F9A498176E370989EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883102, "uuid": "dc78b865-eb44-425c-9f5d-b9cc0f1468dd", "value": "3072:fEfOoVI8fIGcbMv7AEoYZUMxPe6TYIjjZ3BBa/X6hh1RnW9/:fEfOoVmgT1FxPe6TYIjj1BwUnWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883102, "uuid": "d719a54f-fdce-4fcc-a14b-3137075f6514", "value": 253504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883102, "uuid": "29156d6d-834c-4325-861e-ebcd17170d6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883102, "uuid": "312340ed-fa37-4d02-bc4e-f2a42be4a0f7", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa762b03-d108-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764849559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849559, "uuid": "92a338c4-24d6-41f8-a7fb-ebe516cb9165", "comment": "Malware payload", "value": "346f40e674a9e901d137392fb40372f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849559, "uuid": "78075ded-d0d2-452e-ace3-4564495c203a", "comment": "Malware payload", "value": "2bc5de1dfe0d242ec434ec56691a0dd1b94e33eb77e5f9928b94eb19a07eff81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849559, "uuid": "354e0a30-ba68-4d81-adcf-ea2040fb08dc", "comment": "Malware payload", "value": "49d8a8b57641be38f36ca2a695812ff70409d004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849559, "uuid": "017fee27-d88e-42e7-a809-5e0cbf5d198b", "comment": "Malware payload", "value": "70b1d045afcea098595908d7fa8dc269cc0512cae7df550ae9cab7ef58b0a35ef4bf0f540198b9270c6189fc594de205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849559, "uuid": "86dd170e-4357-4c62-a2aa-fd6cb01074b7", "value": "T1930633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849559, "uuid": "9ee4c535-7122-45d0-8d6a-0baef8116c2c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849559, "uuid": "88cb5519-6ea5-4ee3-ba3c-30997c9d656e", "value": "98304:aNT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:W2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849559, "uuid": "0029b3bf-78fe-4bb5-a713-87a49375064a", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849559, "uuid": "55b2899c-9ef8-4b16-92c2-bd9eead1262c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849559, "uuid": "ac5f7088-159b-4b5a-9568-7c7f2336fe7d", "value": "2bc5de1dfe0d242ec434ec56691a0dd1b94e33eb77e5f9928b94eb19a07eff81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2fa47b-d13e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764872698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872698, "uuid": "da85ab0e-7024-4aee-a513-49a0c97203c0", "comment": "Malware payload (Mirai)", "value": "c1d2f1e19eb009f13283767365154788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872698, "uuid": "a0a4668e-e3db-4d75-85a7-fe71abdbe138", "comment": "Malware payload (Mirai)", "value": "2bd7fb12bdb9350b00828318e04c5fe0adce65b512d0504f260b0ecabf4c9cfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872698, "uuid": "b08b4677-f8cd-4e1f-bc3c-3836c40b5d2a", "comment": "Malware payload (Mirai)", "value": "876449691fd5e6b49049e5b2063440b59dd0298a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872698, "uuid": "fc64c061-f31a-4a2e-b301-3205a716151d", "comment": "Malware payload (Mirai)", "value": "2e3351de0f082ce76aa1f78a14dfe3e0cacae3d7837c92a702d7cf0dff075d950e68f6d6b5292beb26acf3dfd5eaa7aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872698, "uuid": "32231de0-0f1c-4556-bf29-f116a40dac06", "value": "T16E13F19791FB9FECF11444F255BF15080918E19DBA28A0A385DC683A1D47F7C7E01BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872698, "uuid": "9c75c79e-18ef-413d-bf50-b3c7ebb05011", "value": "768:a2fjRR9ZCUV7msZnr0/77xyg0m4tva06YxLSyWzNjCuQcwe69ym26U6InbcuyD7Y:bRLZCEm20Tdsf7SyBJk6Inouy8oyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872698, "uuid": "583584ab-d1e6-48bc-9ff7-ba55a5563840", "value": 44716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872698, "uuid": "b3078888-02f3-4052-ab75-db982b09882a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872698, "uuid": "5c3213c0-f1d1-44a9-84d3-4a7f70d6e3df", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde570d7-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829406, "uuid": "e1e59a31-c523-415b-bf21-f48ec579b2bb", "comment": "Malware payload (Mirai)", "value": "8ab08ff636f665c2d665e64bf66ce679", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829406, "uuid": "36d79588-e0d0-45f1-a5e4-bde9f3e6358d", "comment": "Malware payload (Mirai)", "value": "2bf6048008b7325779d935fe5aff3c1e5401251d55cfddcec50ee75558dfa573", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829406, "uuid": "e7064ba3-9a34-40e7-aeab-7dec2bea56bc", "comment": "Malware payload (Mirai)", "value": "f43c8798fce1f67e37a9bc727d5a770444c405d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829406, "uuid": "0e028b59-caae-4ead-875d-aceda2b494bc", "comment": "Malware payload (Mirai)", "value": "1eaf76692e3a9783fbbc141c454e32df8809c5b67442d14f9f9da44c75e298737e34483b3bb5844593c66a3d72de4794", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829406, "uuid": "43b4dc83-4c94-4e5b-bf19-4c79a9fed00c", "value": "T1E8933A45FC919A12C6D5137BFB2E228E372663A4E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829406, "uuid": "2bc1b932-650e-43a6-8105-ae7d93c83b24", "value": "1536:9Ot4/NGRVrAFcqyJwBb86PVLIzAX5iXffdXLamvt9:9Ot4/OVEWNj6PZIzhPjt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829406, "uuid": "d505dc4d-8e77-4f4b-91c8-3500dad79cdd", "value": 92240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829406, "uuid": "23132e95-9456-44da-b760-2b93812a5a80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829406, "uuid": "84984a5b-18f1-45df-8971-152d8c47367d", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8e3c7c-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764829246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829246, "uuid": "21674239-a655-43d1-abe3-d454c760798b", "comment": "Malware payload (SalatStealer)", "value": "4539e9dcb7d36b3533db54a0e574c79a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829246, "uuid": "0b9e5549-d2f6-4bca-b03b-cc967256861d", "comment": "Malware payload (SalatStealer)", "value": "2c254199d71464a87aba0f10105adf29a646166045929085242f681d4a2a5191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829246, "uuid": "f6f0a356-f304-478f-8d9e-43269adc239c", "comment": "Malware payload (SalatStealer)", "value": "44eb71131d8ff61fa7cdbad1138a49d02e0add39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829246, "uuid": "fb68d29f-545a-4c51-8842-af586d666543", "comment": "Malware payload (SalatStealer)", "value": "95d80d9e32033448f4739331f921152251dac87ae9028bce14cace2bf08dc3d71c9e34e3740e9856b5b9bc6830041dd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829246, "uuid": "ceaaee72-ac71-49a2-b59c-15e62d2aa163", "value": "T1DCC65A41FA8B54F6EA031832415BB23F23305D049B28DBDBEB547B6EFC77681197A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829246, "uuid": "3bc6b8c1-b0c9-4571-aaf5-7a581ff9cb8b", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829246, "uuid": "64329246-a07e-412b-9ffe-cbcf87e04dd7", "value": "49152:gsmXoqIXm4iOpZyPu+gyUliJkx8q8dtkqwJ7hIe3tqBv0N7GhrCYZhnlcxgIC2uv:1CoPXbZvwWjAPyBm9v/p3ZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829246, "uuid": "02248d7a-cb05-4fd4-90e4-26fb53227062", "value": 11654656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829246, "uuid": "dbf1e7f3-30b0-46c8-8bd6-155d5b7acfcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829246, "uuid": "3adc75d1-ad0a-4f35-8430-892c123774a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75fa827-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764870626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870626, "uuid": "ac9feb43-9e84-41f3-a20d-a7152b9772a7", "comment": "Malware payload (Mirai)", "value": "35363a6e1de67c561566895b7bdf0e98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870626, "uuid": "3a0c6ec7-f813-4713-a42a-ca8f586ec032", "comment": "Malware payload (Mirai)", "value": "2c820f31b7b9ec4a284954f7aa20f8d4eed5e75b045a1363a532faae531b9dbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870626, "uuid": "e022bcfb-f39b-418d-9438-e238813a0c9c", "comment": "Malware payload (Mirai)", "value": "2f6a662ffda94d60a669edc46b2ead799522d47b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870626, "uuid": "b6c32483-5021-4a9e-9d14-3e8d050f0376", "comment": "Malware payload (Mirai)", "value": "ae482a6ab7712b68c40997e8db6126dc2804edb3bf46f2cf60b2a3e402f9f0405255f616eac2056b79ed7d0383771cfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870626, "uuid": "8d0760d8-94c0-43d0-95e6-b666fe9d0294", "value": "T1CC63029FFF33926ECAC8D2B3CE4443929F180F557147841A7EE4A751C681DEB680A726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870626, "uuid": "c3de57f0-180f-43f9-bc26-2d7d39dd373e", "value": "1536:17KqJvSJMrQf9y6TPtlYIWwY23pezp54yKxagb+6WvlSw5hxlVJue:171EMEf9y6TP/YIHY0ezp54yKxoHtSwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870626, "uuid": "47047b0d-4d9d-4a44-86f9-dbfeaaa24bbe", "value": 71732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870626, "uuid": "2e571983-d6ac-4b82-a601-6bde3c0ec198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870626, "uuid": "2a74ef1e-6495-454f-bf8a-0981145e5176", "value": "Polar.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882f6f95-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849502, "uuid": "93a346b5-2212-4e23-a27c-274c3ce7575b", "comment": "Malware payload (Mirai)", "value": "0ed5ceee6f194ebc7631ffddc4a1f61a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849502, "uuid": "a35f979d-9b4e-44db-be6e-acbc78d94823", "comment": "Malware payload (Mirai)", "value": "2c8b0fd1cc0fdc83ed62a3c6e31d209e3346f760cfbd7c511174602f5565fbf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849502, "uuid": "e58b6c00-0e68-4282-8feb-11d6ec347d09", "comment": "Malware payload (Mirai)", "value": "3b3613f549fbae6775b579e27e22d86a8ebf9819", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849502, "uuid": "81c70ecb-465f-4b06-ad16-dfdb41c63b0c", "comment": "Malware payload (Mirai)", "value": "3a2df09ffb04b00d6ff73d86b04db2286de54a79b941e594b1a951fba37dad0c9a6a9bf164e4602df1252bb200ff8a72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849502, "uuid": "3b9fb045-fbe1-42ec-a07d-aa427c5065a6", "value": "T184534A217A792E17C4E4A07E25B38324B6E5678E32B8C65D7C723F4EFF1066064171B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849502, "uuid": "f1c03d22-ed9a-48e3-b725-42601b1b4fd7", "value": "1536:IDK6bb9lTEFq1X6JySbe7M/Tbrv0kv1pdYm+A:mKQ27be7M/Tc01N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849502, "uuid": "c96f6f5e-612e-4b27-aab6-aec70b8ea3b2", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849502, "uuid": "254e0fd3-30d8-4d79-ab50-b07ae50a2954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849502, "uuid": "e78fdaa0-9d5a-416c-aee9-9f4d550cb4fa", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44e0ec9-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834517, "uuid": "3d4773e0-d265-4012-a6c0-251bb9faa76f", "comment": "Malware payload (Mirai)", "value": "6fd30b124f8363bfae91ceec67c794aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834517, "uuid": "050a323c-cf42-4099-aa79-90a5d57e0b78", "comment": "Malware payload (Mirai)", "value": "2ccb5f3641f3b8778ea769a6fcb03fd14e1c1943c004ed23eb727d9d3232b424", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834517, "uuid": "9ff40097-6557-4f8f-9495-488173612919", "comment": "Malware payload (Mirai)", "value": "c44d12e742ea8ed6f96c9a0ac6dd56a853f34daa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834517, "uuid": "ddde4483-2e3f-4b95-9ecc-1a04924f0d45", "comment": "Malware payload (Mirai)", "value": "4e6d58e81fd56d130f959b6ce530b61e9a9fe372c335ebb4486aefde13ad82d9ec3efd71598a4f0f4466f8a0ba530c03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834517, "uuid": "74f47787-ace1-4d84-b186-a3b3f4d08a8d", "value": "T14F531846B8818A12C5D417BAFD2E018D731263ECE2DEB212DD145FB477C692F0E7BA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834517, "uuid": "a9dc4d23-2279-4cad-821e-09985194adf6", "value": "1536:QdnO1YaLG6KBJGaOQXH7OhJOkphJPLFIsi1qTPKWit1:5fGx7G9QXqhUkgqTPKWit1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834517, "uuid": "a2f12ca2-68c7-4340-b1f2-d78a383a31a2", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834517, "uuid": "792a6a09-0058-46cf-8451-75a65ebe739f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834517, "uuid": "ac859165-1eff-4a9b-a9c1-00cffed1ce84", "value": "DEMONS.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c6b1d1-d124-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764861341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861341, "uuid": "b1036809-d2a3-413b-823f-79cc9ba71ac4", "comment": "Malware payload (MaskGramStealer)", "value": "40c6381befb60abae2ac49af2bf80876", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861341, "uuid": "ea946b5f-6ba3-4b19-9641-e061a11f4149", "comment": "Malware payload (MaskGramStealer)", "value": "2d4c91d14ec9e2d3a5fd21eeef466a4c4be049f6b79c61d5fcf6e2b9e49f9002", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861341, "uuid": "86e7c3ba-a506-47af-9054-c382959d3185", "comment": "Malware payload (MaskGramStealer)", "value": "93fb2d169f2d73eab3950b18ddb434e0e64af6b9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861341, "uuid": "7b5d319a-2d20-4b79-bb20-6e6f32297749", "comment": "Malware payload (MaskGramStealer)", "value": "9846bef21bc285b0645a33da12b5996b2672de989a8008f333e8c15ba96dc66082afa88900b6f7c6e4758652ff7f14e3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861341, "uuid": "fd4b784b-806d-4b21-ad25-79db8b989add", "value": "T12C0633D3D2923E3CDA940272167303B06FF23254247BDB978D8B66191F17B126D6AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861341, "uuid": "a960ed39-4b82-4924-8730-ec244824bb62", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861341, "uuid": "71bc57d8-3df0-4807-adb8-87737a633646", "value": "98304:CDdQNyCB7MT1uI/WGgfEB3Va4ulpbLEMbjao6VJK4:0dQNyCKpukWGgfUFa4ulpbLzjaoSK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764861341, "uuid": "e42e1bc7-9b59-4e03-921a-81b8404a1547", "value": 3738624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764861341, "uuid": "6d13c8eb-f31b-4e3d-8388-317b8374f260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861341, "uuid": "6d6e9fe7-91df-4632-8a89-2cf81ab8d50a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bb47e5-d152-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764881433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881433, "uuid": "96b7cb6c-1f3c-4468-af8a-b6e4ad717848", "comment": "Malware payload", "value": "71bd4f310498455f5d30620a68478c5c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881433, "uuid": "3852c82b-92e4-436f-a5b1-2239eba55306", "comment": "Malware payload", "value": "2dcf10577feacf3ba5270310503dc3ad6472679a5e8fc6d87f5fc757015046ee", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881433, "uuid": "3096f080-f5dc-4668-b7ad-c2b578e25a7f", "comment": "Malware payload", "value": "951a0ca3af5d6f2aa8b4658c0336c9ac904e5170", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881433, "uuid": "9fa6638d-f12c-48cc-b529-12fa473cbd9a", "comment": "Malware payload", "value": "58ac169c62c58c2ae44b739438914d0bf346cf7803cbe37217ad16dc0c951f840b9843e2de49ead5e551c2f8c9c4804a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881433, "uuid": "1b680907-0968-4dc3-a601-ccdb49098637", "value": "T1AFD502BB58B265539A904663EB0F2C1E335B29E53724D345EA01A19C7F3B0D38E92737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881433, "uuid": "16221659-e250-4efb-968b-d231c083d8eb", "value": "49152:2Oc2yD4lTPO3CVSbTMewnuYO3R/USk2XmbdioZbtktZUoBtpXWyEVX9QU:2oyEFP2CVSXsuYO3R/USkvRZutvpX3El", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764881433, "uuid": "78c05ab2-d235-42de-867e-0065173fd69e", "value": 2953038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764881433, "uuid": "60bb0be1-882c-470d-8c60-851d456190b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881433, "uuid": "cceb4b47-aa34-42a1-b268-a166f823447c", "value": "RFQ 202518327.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7435ce3-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834602, "uuid": "74767844-b01a-40ab-8d43-953660c17dec", "comment": "Malware payload (Stealc)", "value": "ea56ecdd72906196fcaedbfc3c1fa8d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834602, "uuid": "c9f4a525-72ed-44fc-b88d-1fb924a4c5bf", "comment": "Malware payload (Stealc)", "value": "2dee48bb5ef57aaaff718c1e4d8faac27f7e89262d729e5c73320c6153e7d579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834602, "uuid": "9851eb57-6c80-4411-b9a7-a57cc74a96af", "comment": "Malware payload (Stealc)", "value": "10afcde3654feebbc6b4eab16c84ac7e7dc98e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834602, "uuid": "737f8201-0aed-496a-a37e-cd1d67cf6f0a", "comment": "Malware payload (Stealc)", "value": "13f769e0dd1f40ad8645fc970a125ef35063c4851e43384f58109701b88570467a43f31ce8e410aba2dfb77ebb8b330c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834602, "uuid": "c1dee78f-d2e1-415d-bf98-cc71f5ef6701", "value": "T1AAE48D5EE7A503F8D0ABC278CA428542E7B2B8555770978F03E146B62F376A05D3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834602, "uuid": "1609dc55-643a-4fd6-bd5d-7b10cdf31dd7", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834602, "uuid": "0a021c50-c40a-4f3a-b350-8a6c44901411", "value": "12288:1GLVpIo/cBJ9InRPehbyv8plnEECv3YZtF15kjH:1kkBJinRP6bw8TEEW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834602, "uuid": "59de64da-8cac-4249-89c2-02e116d2a72e", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834602, "uuid": "b29c460f-d089-4987-8925-2ef4c8420336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834602, "uuid": "3e96a336-8248-4ce3-aa4e-dec4dc86582e", "value": "e4d8faac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfff5578-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829892, "uuid": "eba96c93-3cc1-4e55-b5d2-93d255b89d50", "comment": "Malware payload (Mirai)", "value": "3a4e3868c6a46e9d7383f9412eeb533a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829892, "uuid": "ad79f5f7-9a55-4528-8cd7-3e7bf85c6c30", "comment": "Malware payload (Mirai)", "value": "2dff6876d3830bbb02698b21dd3a09ee743975344ea83076e4b77626ed755ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829892, "uuid": "6fc2df46-2a01-49ca-be36-a267598eaa90", "comment": "Malware payload (Mirai)", "value": "467ae9a6c27c062d6f1f983398ce41c274802c70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829892, "uuid": "8244a0e1-298d-48e1-a072-c2d134732b09", "comment": "Malware payload (Mirai)", "value": "b833ad5cd9a70e672bb8d11dd0f767e1a787a51e81e6f7649116a2399cc03790f9e55999248ae922d16562ff3794c737", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829892, "uuid": "0e87a96e-2088-49e1-ae98-5397e29c5f85", "value": "T162F2E1942349A0B6D1F0ADB3C96186E13E7F00B6D5E432F06FA9C34CD547613A976EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829892, "uuid": "4374de21-ca44-4b82-99c7-b117c8c33ab3", "value": "768:YrFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6GoVMUqs3Uoz7:Y/eRSnQjMgVuP7qtqxgtA1z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829892, "uuid": "c408fb9d-1f93-418c-b835-0b1d902f34a7", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829892, "uuid": "5dbd4eda-b523-4ff4-a970-53d828c61bfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829892, "uuid": "51cddb6c-56c4-4dd0-9d81-4fcc5f1855f4", "value": "ub8ehJSePAfc9FYqZIT6.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ade61a-d0fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764845174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764845174, "uuid": "9dad63b6-379e-42f0-afe9-be29e9caf4d0", "comment": "Malware payload (Mirai)", "value": "f8e038e744e2fefc4fbcbd283f509c06", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764845174, "uuid": "ee16962c-93f5-47d2-8739-4521bc8b8969", "comment": "Malware payload (Mirai)", "value": "2f5f77fa99edb2c65c256329be772c58cab33063291ab44e870ae39fc4603e35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764845174, "uuid": "64b5ee4c-6acc-4d13-9cea-0a5e9b7057f2", "comment": "Malware payload (Mirai)", "value": "0c5bb0adc522c64fe1f190819760f0c1cb5f599b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764845174, "uuid": "9fea551e-dd1c-4a84-b5f4-1efb3961d4f8", "comment": "Malware payload (Mirai)", "value": "46939a2b4d8548fd3268a672beb4b6ea946b0c34378f150b98600c101c5116a82ccd4bb2ac07c4bb86754cd9fec70515", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764845174, "uuid": "8a3371c1-54fc-4505-a0ae-a341ee57eb23", "value": "T1D2410CDC3A726BF35C41FF80FA712E19A00AF5C45881EE695C9E38ADD17C72EB416601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764845174, "uuid": "f9e72a0c-b485-4c94-89cf-53f9e09fa45f", "value": "24:z5EMy0MBDQF6FKXRCpp3r0onWUgHogHkvxdKX5xfxUK7fN7rJxwCN2KXZ:z56mUFaxHnHkjuJJeTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764845174, "uuid": "becf9f44-cffd-483b-811f-7b6d6870bd9a", "value": 1914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764845174, "uuid": "61cd0ed0-a6d6-497c-baa2-4daa7f40e6cb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764845174, "uuid": "beb9a504-a661-40a3-8bc6-a42bacd1f621", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8514411-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834631, "uuid": "d4302422-cbd4-46b8-919c-63f28014be82", "comment": "Malware payload (Stealc)", "value": "45ec47977ae00cf41bee9e7988a8052b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834631, "uuid": "96e96e60-1be7-47df-8b55-2ed98f466340", "comment": "Malware payload (Stealc)", "value": "2f977b90f9a83a87a6ce2f911abcba241de57757a862a1bd06b523e51a6bee08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834631, "uuid": "673a35f6-eba0-444d-a71f-c4b99bc7f113", "comment": "Malware payload (Stealc)", "value": "be15bf39116a16beac179648c361e8026badb676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834631, "uuid": "700ef720-70e3-43c8-b43a-ddb766b90890", "comment": "Malware payload (Stealc)", "value": "9d96baa69ec926e14e8b6f8cda68b581ed35aa405377e81c3e332b6c8516a7570db5db0737ad6f0272aab327a878fcee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834631, "uuid": "e00732ae-fbc1-4665-8657-f2b469e3adcd", "value": "T15AE48D5EE7A503F8D0ABC278CA428542E7B2B8555770978F03E146B62F376A05D3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834631, "uuid": "f53f80cd-1905-4ca2-a8c1-d2e03e9e8c10", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834631, "uuid": "f7420823-a8f6-4090-b78a-8dc13929ee87", "value": "12288:1GLVpIo/cBJ9InRPehbyv8plnEYCv3YZtF15kjH:1kkBJinRP6bw8TEYW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834631, "uuid": "e27da2ff-11b5-4755-802e-0b2189517351", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834631, "uuid": "139bc175-2974-4bae-ad80-53ef3b84bfae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834631, "uuid": "1be77a5d-0947-4b2c-b1e6-dac7791fff4e", "value": "0fxbvfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527b2bb1-d0cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764823642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823642, "uuid": "ae9ef491-beac-431c-96fa-a7aec3eccbd9", "comment": "Malware payload (Gafgyt)", "value": "2e13807db8c5e8de02a1f5bdba5d8d96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823642, "uuid": "f99b4ea6-fe57-40b9-a62d-aabb1995c28e", "comment": "Malware payload (Gafgyt)", "value": "2fdda0783d69b5c9791f2a76f7b4042bfd3cc39ddfea3ca4c280058ea87501dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823642, "uuid": "3e8ce6df-e6a5-4991-a0f9-924884d9b560", "comment": "Malware payload (Gafgyt)", "value": "eb76a9c0455469cd0bd5da2b7e3ca51f28b8e1aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823642, "uuid": "75ca2c51-ee6e-4983-87ef-ca6ad1b68f24", "comment": "Malware payload (Gafgyt)", "value": "1597765b2bf3f627d52415f676a74670ea2e2d10ce17dcf6672f0daa05bc4986210d5b844504dced34be91955d18435e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823642, "uuid": "fd6c8976-23c1-4736-94cd-f1eaaaf7453f", "value": "T14343E13F030957E9F13A69FCA0FE1A8145E44EF500198CD8291961A2DA437B878FFDD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823642, "uuid": "b1a9b79a-6aa3-4762-8d04-9dadea602cb0", "value": "768:/JZQKCFN90i4m9mV6/yGA28/V3GkLwvT6lJzPmOhDsvhsyQ9p7XBUl9RyFj9igJi:hEFvd086GEL4T6lRftjnBcRyagVEWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764823642, "uuid": "a8a964b3-2b3c-4f34-8cda-fd680086d45b", "value": 55468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764823642, "uuid": "7f758beb-a4ae-4683-b4db-8981f7e25c81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823642, "uuid": "4b58cfaa-1e96-49a4-84ff-1ba823cc1c64", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad5ce8b-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764870686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870686, "uuid": "354cf8fb-3829-4d84-af8b-2f299f91a371", "comment": "Malware payload (Mirai)", "value": "158faa41710ee5fc3b5046e8d8b455c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870686, "uuid": "cb366582-cefd-4215-8b6a-9bdd0bc90ad3", "comment": "Malware payload (Mirai)", "value": "2fea1728b61283e8342ecdd0ab6b80051f5683956f54692181b8dc73091ebde8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870686, "uuid": "a133e4af-99b0-4e7b-9121-7d79bbefdc02", "comment": "Malware payload (Mirai)", "value": "26763026d2f6fa04aabb1f883169b6635673837b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870686, "uuid": "0d927e0e-79a5-4441-addd-6381b87573ed", "comment": "Malware payload (Mirai)", "value": "f91e275364a4ce44f8bfb3abaf108c7c830b879755767402fe10bd831911e91b2a70a3247f4dcf03fca92d731e36a0ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870686, "uuid": "0de861d6-b0af-4731-a133-da70dd774407", "value": "T19B34B81E6F218F7DF7A886345BB34E24976923D627E1D584D1ACD2011F2029E642FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870686, "uuid": "27a36671-790d-43a2-b8b7-7ce5fd394a4c", "value": "6144:asmaJvtFwnUPhUYqBgaNgxKGU7hRGTbPnL:ZmaCnUPaCHUkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870686, "uuid": "642d4551-bd77-473d-8d9e-89185442b0f8", "value": 230908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870686, "uuid": "82d2d76b-dc96-479b-bac7-487f25cf174a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870686, "uuid": "d91fbf9d-cce0-41ac-9634-b7615dca1bf2", "value": "Polar.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e864c626-d150-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764880587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880587, "uuid": "deaff0b2-7852-4d46-a4b4-16ea7904d0b2", "comment": "Malware payload", "value": "0cdf31f4f815de72b384400c1bed36a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880587, "uuid": "50165c36-b857-4874-8fb2-c6ce09cc49d2", "comment": "Malware payload", "value": "2fece54fcae035e3b9f1daebd5f0c828693ba769a9dfd27c3af47d2780e5bfcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880587, "uuid": "4023640b-d11d-43c0-9b15-b0aa82cd7f9d", "comment": "Malware payload", "value": "0e87239f485391c0fecb6ed6beb5f57a24b1484a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880587, "uuid": "216d189d-a276-48d6-b24b-acf29b5c6e30", "comment": "Malware payload", "value": "f392ead0dce02ef8a0894bdb71dc1c1379062a233486d1617de07bda262289111c44233bf15e3468e68b90cca246ea47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880587, "uuid": "4baea3a6-4daa-4a5c-a34b-62ef15400b7b", "value": "T15493E120E7F482F7E23B433D5D8E0A955D3CEF115912CE6898EA909C6BD036B5B12E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880587, "uuid": "b9f442fa-2992-4a70-8c53-fe973657a3e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880587, "uuid": "bee79854-defc-4202-91a6-1e0f62e3b5ed", "value": "1536:urEjq2mLmKeI+u31F/NL+RNI2mLmKeI+u31F/NL+RNu:urE+2pKe9uD1KzI2pKe9uD1Kzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880587, "uuid": "31b1e6fe-08ff-4cc4-a68f-2c4a60caf908", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880587, "uuid": "1f27a2f0-7c8d-4a8c-a614-325c3385fb08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880587, "uuid": "60b86311-7932-44fe-aae9-e9c72ee184c8", "value": "0cdf31f4f815de72b384400c1bed36a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cdcd9d-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829124, "uuid": "71a99959-0fde-4812-a9fb-75b5a584fcf8", "comment": "Malware payload (Mirai)", "value": "12446369863b8de589de35242bef53dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829124, "uuid": "53a3c3e0-8a6c-4d71-99f4-91e41352d707", "comment": "Malware payload (Mirai)", "value": "306995a4b4945ba64eb5ca81b18ce80e5ade04aa0d77705b6c18d511a2654a7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829124, "uuid": "d0bb4a3c-706b-4569-8299-40eb655f1b64", "comment": "Malware payload (Mirai)", "value": "96e84c45331e74e0644bad566673b721bb44f531", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829124, "uuid": "121db4dd-dd14-4d2a-9db7-74504f290f0c", "comment": "Malware payload (Mirai)", "value": "3c7a7dbc5f9154b5e994a468370802c69be9df781f338725eb983546e6670b26b74a534ec8ded721e2c89b4935ad924c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829124, "uuid": "4e04dba4-f2e4-454f-b65d-6437db983261", "value": "T12E834B02B3480D43D1671DF02A3F37E5D3AFD59121F4BA89664E9B4A41B6EF2254AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829124, "uuid": "b5eae7e3-1f74-42f2-b3d3-6ba15ec27d5e", "value": "1536:P1UIP6P3LziR4NNcpoO9cFr+QmqOYq39EbxO:P1U3c441cFHmHUxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829124, "uuid": "918ffde3-b56c-4a5e-961d-2d7d46526477", "value": 87728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829124, "uuid": "d835ed8f-1a80-4812-a32e-ecefe9c3ae48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829124, "uuid": "ca8aa04a-cf6c-48a1-9b9b-2cbb15192115", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174f1a1e-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829126, "uuid": "65cf7ad3-43ac-4d44-a5f6-2be0979a1e41", "comment": "Malware payload (Mirai)", "value": "a5ccc9cc9eabb2b497e7f0ac91ce8338", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829126, "uuid": "405fc792-2124-4b5d-8114-8d5f31ba4ef9", "comment": "Malware payload (Mirai)", "value": "306b4d42e5f09431944c9b71413240083cecbcc1686756dce2def040535de8fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829126, "uuid": "5bef24dd-e2e5-4853-a99b-6f42e5032514", "comment": "Malware payload (Mirai)", "value": "1a9bda8fcd0cfad78f50752fdbde6f8b764dfe09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829126, "uuid": "dee4c017-0c46-425a-aa05-c622b3cdf19e", "comment": "Malware payload (Mirai)", "value": "78eb56ad8d69b074723a567c3502ed537d541dc7dbe101a297276219d8e7c6464a3e70bdb0f733b30c58123537062ef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829126, "uuid": "526ad308-a9c8-4bc6-bd13-8fee2df49121", "value": "T1CF8328C1FA8BC0F1D91B88304067F63FCB31E9695061D75DEF9A9E36DA33581A216389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829126, "uuid": "a8f54a7d-8abb-4ff6-b9c1-9b9e9e6b9260", "value": "1536:ivDwDhVtcU4xiUWaqH3FY2SlGe80WJi+Kj/Osv4gv9l7vo:sDWKzQLH3FalGzo+Kj/Oc4Eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829126, "uuid": "03e0b8b7-42a5-4dd0-8d68-ee6bd8f00597", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829126, "uuid": "5a5420e0-f8d3-44df-aebf-14a96ceafab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829126, "uuid": "7dc2c4b5-5f5c-446b-86fa-28778bf4934f", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69d7b9a-d13b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764871591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871591, "uuid": "099ad610-b2a9-4cce-81dc-058722089a9d", "comment": "Malware payload (Mirai)", "value": "7d7d9c2e0697ed92c615c7859166a776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871591, "uuid": "9fdf646c-198e-4467-9a48-2b8e7ec08ef2", "comment": "Malware payload (Mirai)", "value": "3098c8c734a15e29b0cfd4c2846597b7185808116ccbf5b7d688d830be3922df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871591, "uuid": "3ed44408-099c-40a6-ba9f-2ef94f66b3c5", "comment": "Malware payload (Mirai)", "value": "6858f06e0d2b01c2bb3ffc5ec05e21ff2ae738fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871591, "uuid": "d68c9788-ced2-479f-a905-584bf41cb496", "comment": "Malware payload (Mirai)", "value": "43db40868321d1e2b37a7894312e43f3f9870534c09d983db791b8fc5848a71465e13b838e1b08d0dba3414867c4513b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871591, "uuid": "e4b11de7-16ea-4e16-b8a3-2dc1808d75e0", "value": "T1D9837DD5FB43D4F0E45604B16077FB379A32E2BA1228EA43DBA5D932EC12542E21779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871591, "uuid": "615fa360-77dc-4bac-bd70-a57fa96aac1c", "value": "1536:wRvHjb3/DPuX8nUxfYm55QMv6MR1hdKXt4dQQdAx0LWFf8s3Sg7pP6MCwQTqsdDh:WvDb3rPuX8nKgmPQMCW1hQuif8s3SepW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871591, "uuid": "d2c9c8b6-13e0-4239-9536-5c3b4805edc8", "value": 84048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871591, "uuid": "6bc04cea-b3bf-4812-84c4-307e749f7180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871591, "uuid": "609fe0af-5233-404c-9664-62a868bfa720", "value": "x86-DEBUG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bcfad9-d14a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764878034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878034, "uuid": "3cdf3025-eddc-4c17-a77f-8db21111786b", "comment": "Malware payload (Mirai)", "value": "12e7248bc4dd9c864a2a48acdc913e37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878034, "uuid": "fd59a4e1-57d0-4d00-96c9-adc6c9d95d99", "comment": "Malware payload (Mirai)", "value": "30bd4960fa85f7ea891d37122a022869a76e49b6c7674e7fc0d6e7208d08724c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878034, "uuid": "4f9cbf55-4318-4236-907d-7df44786706d", "comment": "Malware payload (Mirai)", "value": "4b12869936acf9a72256d99ac9fb769f32f14563", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878034, "uuid": "afe9c586-732a-423d-84e4-445fa00bb0ac", "comment": "Malware payload (Mirai)", "value": "76bd064c77bf27aa69f674a1004356493e734deb897900e8ef12c46075d9b2a95f1b87a8e3659d0df8a4c60d295b838a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878034, "uuid": "7f24dbc3-d8b4-4d98-8f99-d33e18bd23e5", "value": "T169B33B4B7321CF10D769D63002B387566AFD275216E2988AE35DDE103E6474CA82FFE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878034, "uuid": "24aa9e8d-900e-49a6-86b4-06cd506e518d", "value": "3072:fqhUQGjVAarKXhvjCvk7MKLGOZyKKCTJw:fYUQDSKX5juKKQ9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764878034, "uuid": "8b19292a-25d3-4f1a-837d-242444db3d39", "value": 108672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764878034, "uuid": "6fbf73d1-dde9-416c-8df6-1713cf7ed772", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878034, "uuid": "c550e9e5-e432-4da4-9786-753ad7823571", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1c8a95-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807045, "uuid": "536db077-4e13-4d4e-84ee-7d4d1f9fe817", "comment": "Malware payload (Mirai)", "value": "4d09b7b3f04156dc5893a10df3cbd6a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807045, "uuid": "f0410e4f-0528-4dbb-8bdf-bf1e4c25b45e", "comment": "Malware payload (Mirai)", "value": "31fd267b8f0f047bd82e3cd6a3855e3fe8440fcc4abe1707c6fe72ec975150db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807045, "uuid": "9e3aebdd-0f18-4712-8cc7-07526d5739b3", "comment": "Malware payload (Mirai)", "value": "7d134cd1c8ad251fd9de18fd63b1cdbcf17c3ea8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807045, "uuid": "6d3ed164-d256-4ef8-8862-8162871a44a0", "comment": "Malware payload (Mirai)", "value": "dc641476dc9a4b52595acc07e284701344afa50fcb5b533e26147d64cf9ce6bf8bc340f5b369af1b5e92f9df89459f93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807045, "uuid": "c00bfd38-a78f-41f9-84ac-bf27058a5802", "value": "T19913018FE0B91611DDAC83711E6E7A76082DF21DA140C1EEEFE470E9952BF6171483D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807045, "uuid": "dba1778c-912b-410a-b05b-3c8bbc9c1123", "value": "768:UkDS7bNYNDlhjpL5X3r0O5boLHgmE89Dzw/p0Lkb0PCyIunbcuyD7UHQRjw:UkDcbQhB5X7l9+gmTkOLY01nouy8Hyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807045, "uuid": "1766bf30-0637-4ed8-a36f-4ac52b00e0df", "value": 43936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807045, "uuid": "eb888bef-9e26-4ff3-8513-2b8cf9c46b09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807045, "uuid": "e632ff04-889b-4116-b54d-2aa27f19e11d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cac0e3-d0d4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764827293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827293, "uuid": "e3875e08-2cfa-4d04-bca5-6e617f1d6cd6", "comment": "Malware payload", "value": "92bda60e61197088c8e65e20c7eeda98", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827293, "uuid": "365ccc36-c263-435d-bd04-32ea2057f7c9", "comment": "Malware payload", "value": "3278ec9b571f3eb1f93cbbad15e455850fb35257991e65ea79cb928a8037e18b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827293, "uuid": "b2fb5eba-3e38-4bb5-9c57-c77891c0d810", "comment": "Malware payload", "value": "e4633566a05af22ed98489eeb4a8b87040520922", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827293, "uuid": "3fde21ad-ce4d-4d04-93e5-878f7d0022eb", "comment": "Malware payload", "value": "9c6edf5c065d18ff52b9c4e657bf63809e5ab85c4b8a90a8e9e861e225358143938c9f1b3029d0378836cf750d4412ef", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827293, "uuid": "ceb51e14-7546-4862-ad34-3d744a28b8ab", "value": "T15373744C0DEB44E89A2B7C848EDF9D01F7A58943152CD5D9BA5CA8E03F5162C93F89F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827293, "uuid": "ed27faee-9fcb-4284-93fd-e1f1a7f48bd2", "value": "768:PJ2k59GHKnddhaXH+vPP77kJVkalOOw1QBHcwdBnofhD1h5CNT7MLT/UgFDGbgyC:TZnkJVZMOU88eohHq8u+PSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764827293, "uuid": "615b1372-8f59-453e-88ba-90ab7696896f", "value": 76280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764827293, "uuid": "050e970a-3969-4c22-b30e-302e35ed9403", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827293, "uuid": "dc1d60a1-a7d3-4625-b3d8-3810d1583441", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087c9e16-d0e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834685, "uuid": "9c3cf742-3ffe-4852-a1c2-8fae9843e517", "comment": "Malware payload (Stealc)", "value": "f7e84b155b1701db2f55b6288d392ebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834685, "uuid": "f73c3e93-ab57-4324-a76a-44787c81fa3d", "comment": "Malware payload (Stealc)", "value": "32a5dd5e937ff49be41ac5a319edfd699c1d4d8f10d40bedb8f90fe5ad9e6c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834685, "uuid": "a4bd0647-c455-473b-a608-bb5644389a1e", "comment": "Malware payload (Stealc)", "value": "7925d8e05f2929e4544545c83fa7cd4339f26395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834685, "uuid": "f40e40af-a19a-4bd3-a82b-5d8d921ce2df", "comment": "Malware payload (Stealc)", "value": "ee4ea859d6e1382587385c9937a8b040d61da78b9a4c803fb93fa05660dc31acea101674c136dacff10b654fc6f5f282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834685, "uuid": "9acbecca-7703-4e07-a818-28b5e7ab0ad1", "value": "T19E059E1EE7A523F8D0ABC274CA428942E7B27C055770974F03E16AA62F376905DBFB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834685, "uuid": "53757c49-bf93-489e-a5f1-6bef9a847002", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834685, "uuid": "39d7de5d-2bb1-453a-822e-e57116dd4f3c", "value": "12288:8GLVpIo/cBJ9InRPehbyv8plnE0uv3YZtF15kjHn:8kkBJinRP6bw8TE0y3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834685, "uuid": "40c97da6-038e-462c-a4b2-3daace802a63", "value": 797952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834685, "uuid": "40292b3a-98c2-409a-bf11-b5fc8f61380a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834685, "uuid": "4b2b2634-74f2-4e7f-87ce-d84dea05a873", "value": "5066s4qj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2902bf97-d0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764839464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839464, "uuid": "95b35d29-56dd-4ad2-9e79-8d8fb35d43ca", "comment": "Malware payload (Mirai)", "value": "ce69a40711c0e0fb624d61ca5f3320f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839464, "uuid": "d0a33eb1-29fe-4a8c-89e0-8101ee2f577d", "comment": "Malware payload (Mirai)", "value": "33a47cf08c588fec717cfa085c4d8fab3e9038a781f20aed585868f4bae60913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839464, "uuid": "7f72d972-5aa4-4fd3-963f-8df4cd737cd2", "comment": "Malware payload (Mirai)", "value": "f643479011c0c40991e7d2c33542ce1513edf373", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839464, "uuid": "81c1446d-00e2-42e5-ae16-3cfad016248b", "comment": "Malware payload (Mirai)", "value": "92d55660f00b7eb28de0654641ee1c79d3244adea10495f5ff6e994ea5441f1bac2583f0fe397936606327f5d1c0c1c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839464, "uuid": "4374b560-1cb5-4efb-a363-a328d04dfba3", "value": "T179F32845BC919E57C6C522BBFB5E428D372613A8D3EE7207CD252F2437CA95A0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839464, "uuid": "f9b8e9a9-f61d-4162-8612-c9a45469f3ec", "value": "3072:Nss+3ewSQcwWbfMjl4CMLwju/3PqP5ig7nBJd5:NsQQcwOEJ4CMLwa/3PqBb7BJd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764839464, "uuid": "73ec1ebc-0b9f-4895-adf1-39e04165670b", "value": 157504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764839464, "uuid": "aa2cba65-afe5-4c51-9cbd-50647ff8e807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839464, "uuid": "8b4ba5b1-1e85-4a90-9be3-262e5ba49316", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8120ce-d10e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764851977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764851977, "uuid": "0dd625b8-657f-4e34-bf10-9ffeb87c0545", "comment": "Malware payload", "value": "8a172af2bf1103cd321d88f40b3ffd2d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764851977, "uuid": "9897a005-88dd-4936-b452-0e4c31a95ff0", "comment": "Malware payload", "value": "345ee5a7c28fe2d120bca50dd078b7c5a4ae78b24017fd8e45fda6fec9f1e4aa", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764851977, "uuid": "d7b7c99c-4bfc-48db-9084-e1db0b74d680", "comment": "Malware payload", "value": "2e70d830b039a3e3d9dae38e460dfd7e887970b7", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764851977, "uuid": "4151bd69-4ca8-4ddd-b2fc-466e41818ea2", "comment": "Malware payload", "value": "dcdddd72a529be594ebbfa44390420a93e34bedccbd22589605e14da06c0dc983de0086d1b9acca21e215058b4128278", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764851977, "uuid": "b1e50bbc-1e11-4e67-b47f-2b6d0c2abdaa", "value": "T1F17351880ACF44F8A637789989DF5D41FFA54513572CCE80BE9D79942F2043FA2EA5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764851977, "uuid": "15b3c4ef-d101-4e10-ac44-bfbb0758e100", "value": "1536:Cijf5pCICTgxCyXV0LlLaulOe8Fqt1N8B12gHXXKofI:ITgxCCV0LlNlOe8z12gHXXKofI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764851977, "uuid": "fb601747-1076-4562-b162-fe06e51570e3", "value": 77517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764851977, "uuid": "7d2965f4-c9db-4f0d-8730-0bc9f1bd5bf7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764851977, "uuid": "83d9b1aa-190e-43de-8452-dab514b423c8", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e20cefc-d145-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875496, "uuid": "eef5fa01-d0e0-45b4-81c0-70076693acf4", "comment": "Malware payload (BlihanStealer)", "value": "049ee3c8c0fe9ba30de8dfa8f1da02ac", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875496, "uuid": "aa1a2e56-baae-4f28-9177-48bd22766bd0", "comment": "Malware payload (BlihanStealer)", "value": "34736869d747ab6b823dccb18775e9e87dcb2e25f2517ad2acfa4edb59c5a845", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875496, "uuid": "669876ca-493d-4f98-81d1-18dd0a0d7680", "comment": "Malware payload (BlihanStealer)", "value": "6f443ec1a218d34e2ac859b1daf7b9a2737052ac", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875496, "uuid": "e72d2820-2106-4034-b929-675ce1614d1c", "comment": "Malware payload (BlihanStealer)", "value": "bee2f43f180f43097fcffccc3c6be2fe38c34836ca8f9b4045f3a2601f5570b72e8fa616e22b4304d8ad018b4ddd3e73", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875496, "uuid": "daef340e-8a73-45d3-9171-cec946fc3d02", "value": "T194837C1769C384B5C4A2263255B98739A6AF7E050FFD93C38BC89C1D27622C4DE3E643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875496, "uuid": "011fb658-c355-4525-9512-76fb43ab35be", "value": "757708ca9fd3f4d0b8bef404d6ad71f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875496, "uuid": "f72fcbc9-0584-422b-b3be-57341c18af82", "value": "1536:vAowfbJFgjQ284U+w2EwRz/IUqXV2n22n222n22n222IIKAjoAim0lHatu5OZJUS:vAowVFgjQiUkEwt/XqXV2n22n222n22q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875496, "uuid": "96d3c4a9-ec10-4bea-9961-82e7513b754a", "value": 88588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875496, "uuid": "dd875a1c-63c2-4a31-b78e-0b0e9832d06d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875496, "uuid": "71d5f398-8501-476e-9198-3c5a959fabb2", "value": "sd7kbt9o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a43b083-d131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764867115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867115, "uuid": "3ad6765a-7647-4efd-ac18-583fa8e19bcf", "comment": "Malware payload (Mirai)", "value": "fe90565e86ac5a76b9f2061dd8121800", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867115, "uuid": "247c3648-63b0-4b58-bb03-cdc304460e6a", "comment": "Malware payload (Mirai)", "value": "352dd026786be41ce71759e54dcf19a60b002755c37e357414fcc177f55297dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867115, "uuid": "47754657-e540-41ab-ac1f-8e37d1c319c8", "comment": "Malware payload (Mirai)", "value": "ac3d28d794e2b0f5d2b3b25977464e5bcfba5f9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867115, "uuid": "acc0629e-25f5-4168-8d30-358dd3e0e8bf", "comment": "Malware payload (Mirai)", "value": "1064f70f505bac224fada726153b7509f60f4f7d9871a1b2b9016160e54441cb39cce6d8308c5b879d2fee390789020e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867115, "uuid": "80489dc2-f949-45a2-8718-f4989ac222b2", "value": "T165D3BE97F74314E1C85347F407CB4B9E3E6322825F6B99E7AC6F653A687A0DB0502B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867115, "uuid": "09aed018-b1f5-4f20-b32e-6705f25cf623", "value": "3072:9zpglPD/mNmL8jtDEWrLsH4ZvaDGgY1q:N+PiNHaWrYrM1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764867115, "uuid": "13a7dc6b-507f-4fbf-94f6-45afb1e9545b", "value": 140936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764867115, "uuid": "dd5984c5-4302-4f5e-839a-f1799f315429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867115, "uuid": "a2c1902a-49b5-4a74-b92b-7e7541b16cf1", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4efb86-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816731, "uuid": "baf74ae9-2c27-4777-a32b-8c8fdcdd8ae0", "comment": "Malware payload (Mirai)", "value": "53793903a36db1fcbe570b48a37b825b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816731, "uuid": "5de0a536-c3fb-4e35-aed2-cf426eea65dc", "comment": "Malware payload (Mirai)", "value": "3538db4788ada25309a445167882c1b946859ea61879293cb3e7ddb15e3b1eb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816731, "uuid": "f24d1c8e-1e8e-4786-9108-1ca3db6f5de9", "comment": "Malware payload (Mirai)", "value": "f3ad4dec84d21f68d1de2e940209e6fe678e3708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816731, "uuid": "91316037-6262-4e4e-95b4-b3a302dad316", "comment": "Malware payload (Mirai)", "value": "c4efc31521ca523bf38912cd8ca8bbb035fd93c3c13ead59f4306d14c87e9f8cf6337c6a9d907e35aca17d4f516ca621", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816731, "uuid": "fcf71fa1-40cb-4af2-845d-be4c49a981b8", "value": "T1C0A34A362E752E1BC1C0A57B11F30760F2F1479E25A8CA1E7EB20E4EEF2465061576F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816731, "uuid": "a8db9e6b-89bf-4122-8661-f84ddfd6ee1a", "value": "1536:MnpJV3a0ERsujU5wJNE6jDj37SlUcUhnEhYM5StZsrHt:WpravD/3+8lEhY8Zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816731, "uuid": "137cad1d-6562-4f65-a7b6-1c9f059d266b", "value": 99864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816731, "uuid": "d579f098-8bf1-4c05-895b-5cf185324eda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816731, "uuid": "59a39a70-a3fd-4114-9d84-55307de39b67", "value": "UnHAnaAW.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b11cad-d117-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1764856106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856106, "uuid": "444a904a-d85a-4b49-a56f-b20382b65c39", "comment": "Malware payload (GoToResolve)", "value": "550f6c0a0ce6a4a64069ed3f9f14b9f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856106, "uuid": "3103f780-c795-4e5d-b329-94cf2bdc89d5", "comment": "Malware payload (GoToResolve)", "value": "35cd0b36909447d5e655a606c7271d57803c90fb0695ba78a5a55b77f3257318", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856106, "uuid": "2a593657-19d3-45d7-a0c0-228effef3e7e", "comment": "Malware payload (GoToResolve)", "value": "d47e0e6d753290dcbe8128237dd565493f2253ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856106, "uuid": "49197ab9-7b02-4e00-89b6-3ea51695004f", "comment": "Malware payload (GoToResolve)", "value": "03a8b77767a22679391382a7e7323d9b551f902c0ab47e0fbbf137b9eb1331eda4dc84f922f49b551f61c592479daa54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856106, "uuid": "4068177b-cbd1-4866-94cb-3b6f8f81d36f", "value": "T15D37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856106, "uuid": "2ee40995-12c3-4e2e-9d91-f20dd8818b68", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856106, "uuid": "3d8955c2-301a-4b11-b021-fbfa1b82a826", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpS:q9WtLzgOTbjZvk/ekS/mcpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856106, "uuid": "1508e7b1-d687-41c3-9ac1-c6608ed367ff", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856106, "uuid": "032895e0-cae3-4134-9ad1-cf8748817186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856106, "uuid": "ee6e373a-f45f-4ff1-97dc-9513a1fc1506", "value": "lnvitepdf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c57dd6f-d0db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829967, "uuid": "3cc61a0b-634b-4ac6-ab2e-a1286cec1576", "comment": "Malware payload (Mirai)", "value": "d65d38fbdabf1cea47450fc58bee5f80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829967, "uuid": "ccf2bc0f-d090-41f0-8b0e-8c9fd46bbba2", "comment": "Malware payload (Mirai)", "value": "35da22f1e3d6f821e5d6070f537b9cc9a20321ca3c7f9fcd1bea2f3f5230f4cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829967, "uuid": "71151888-959f-48fa-80a6-cffe4c6281bb", "comment": "Malware payload (Mirai)", "value": "7fa076ceb27d471cb1b3808c406fad208521efd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829967, "uuid": "e90e03f5-9ef0-413b-a614-d78343127409", "comment": "Malware payload (Mirai)", "value": "46fba6799f146c8d80f5913a30309c3b7da6b92477fbd1bb055921e03c419251c34fbe1b0be65cbc26a078935ba58594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829967, "uuid": "bd096ab2-f141-4474-9538-25914845c008", "value": "T1D9733A57BA4180FEC499C03843BEBA36D87274FE1379729A13D4FE366D46E601E29C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829967, "uuid": "68058d9d-f422-43e2-a236-9643fa6d33bd", "value": "1536:BzIDxEwvZ8bouGctIb/+w4HnC+8l8AnzcUG:BUxEyZCXtIf4HT8l8AzcUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829967, "uuid": "bc72ec33-58a0-47fe-8a86-65e9a835a9d5", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829967, "uuid": "eb383296-8f09-4d9e-a4c0-7b01760ac5d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829967, "uuid": "2c65e694-dad6-462b-82ba-a61329c1ae20", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d2fbe4-d0e6-11f0-a129-42010a9c0007", "comment": "Malware payload (OctoRAT)", "timestamp": 1764834952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834952, "uuid": "2102812b-4f33-418b-ba54-c4003722658f", "comment": "Malware payload (OctoRAT)", "value": "9a5ff998dbf0f6923d0b454d89800fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834952, "uuid": "bf232e17-c0eb-4b1f-afab-61a89e9c63cb", "comment": "Malware payload (OctoRAT)", "value": "360e6f2288b6c8364159e80330b9af83f2d561929d206bc1e1e5f1585432b28f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834952, "uuid": "1f0b9315-ddb9-4e67-92a4-e58dce08885c", "comment": "Malware payload (OctoRAT)", "value": "4f4fa23e9c503b941a5e91584d6ecc3813962ba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834952, "uuid": "113eb996-832c-4b41-943d-66d495389281", "comment": "Malware payload (OctoRAT)", "value": "e4a453c1b4678ad4d9b39dacbb1ccf78bf27919b48798c7231815741c296561507ae5fd62236c3c7f4e187763e06448e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834952, "uuid": "c4f361d1-5d01-4243-9f23-e303ebd4b571", "value": "T1B324C55563F94600F2FF6F79A9B145210A73B897AC36E30E0989549E1FB3B81D821B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834952, "uuid": "1122bb5e-91fe-47ae-8a87-28aa3e52fee0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834952, "uuid": "2111b6bc-f90d-478e-b17e-21d570e67686", "value": "3072:y7P9YD7qHKLnO89zkxt2WpZirqaN5Eq52qPyFmrvixQhgtVA7fTFAbH+3ljZUaO7:Z7Or8rqc2q0qPyMKCes7fT2bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834952, "uuid": "c964d504-cee3-4356-8991-9ab828c1db3a", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834952, "uuid": "47de89ce-1f92-48bd-a3c2-7b5ca63b5a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834952, "uuid": "79a0fd29-6de6-460d-895a-5620ca5ab5b3", "value": "360e6f2288b6c8364159e80330b9af83f2d561929d206bc1e1e5f1585432b28f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de7a22c-d138-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869966, "uuid": "7eb84b4d-c822-4fa1-84ff-1f2a7ea946b5", "comment": "Malware payload (Mirai)", "value": "9183eefc5aa2ec96e29c963923f8dcec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869966, "uuid": "2495fe96-f407-465c-ba4e-42d263270aab", "comment": "Malware payload (Mirai)", "value": "3610e40c6e6833485c0e2bc32083ed9b5f3418605dbf774d315d2ce6fd1d23a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869966, "uuid": "4ad8815b-f5c4-436d-9c18-1b913bbe2eb7", "comment": "Malware payload (Mirai)", "value": "894c46fcbe120b3a9b220132b19600e0590ce1df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869966, "uuid": "e5845d81-defe-4bb8-80e8-a4dac50d62fd", "comment": "Malware payload (Mirai)", "value": "244840ac41884cb0f3caf783994a4af775b47b2f0b0401121e587892ae0fecdda49e6be352791a3c1f51aa30a5856cb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869966, "uuid": "fa16b910-decc-4ff7-a632-53bb17cab79d", "value": "T1EB046C02731C0907E1572EF03A3F67E193EFD5A225E8F640650FAA8A9175E72158AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869966, "uuid": "ba56c8fb-f167-456c-8d55-20bea52206db", "value": "3072:GViip6JmllVdGNtPC5xC8ntk+xAf9SWXkCMdGN6X:GvPBxu9SWXjMw6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869966, "uuid": "7a80d42e-8f13-4949-ace1-7b79d5859aa8", "value": 177564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869966, "uuid": "08bbaaf5-8494-4d6e-978f-b72741478e31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869966, "uuid": "fa611a27-6abf-4ab4-ae87-76746b35bcdb", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30174c49-d141-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764873835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873835, "uuid": "ccfeaf24-7853-448d-b4b6-034dacc95c76", "comment": "Malware payload (Mirai)", "value": "23b2fa9153ef18bc7ad120e241043c3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873835, "uuid": "59b148ed-f9a7-4b9b-9dda-882987fadb98", "comment": "Malware payload (Mirai)", "value": "36280dfa09ea768d7cced835436c63e5f8ff3b2276dadfa1b10a7818654fbe4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873835, "uuid": "3b530cf8-0887-4ad5-96a4-7974448b794d", "comment": "Malware payload (Mirai)", "value": "66f95d4673a1dffec76a3c0f40f10bf9c63e151f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873835, "uuid": "97024d7a-e853-47cf-a584-9cea4fe91aee", "comment": "Malware payload (Mirai)", "value": "d3583643977f4b30796ca53cf861ecb13be0d3b8ca23df4fb343784e4b21e060bf40c79567f0ef7be5aa0d6db2b15a5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873835, "uuid": "ca43b846-bb90-45c6-97bc-6fa77f89b06d", "value": "T13D13F1BAA505197183B60535D62CC886D5E71D3DB0B8F0387D0D98EA27930FA7BE4B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873835, "uuid": "14dd5363-7532-497a-afb9-493fc79cc3c4", "value": "768:g4pMYWW7zSiQWxyxrpOoG7f5xY8UZz1sQXxYQs3UozE:gYJ7mswhpO55pUkKAzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764873835, "uuid": "d9f9400b-16be-414c-b01f-78f6f9b14376", "value": 43136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764873835, "uuid": "c374a72a-7676-4fd6-9571-7e051f1f160c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873835, "uuid": "9172a8ae-c278-4a43-a8c9-96d775af1ae0", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721f8d2a-d154-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764882107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882107, "uuid": "384d3aa7-bcf5-4cde-97d4-cf6dea648f3d", "comment": "Malware payload (Formbook)", "value": "139cf5ba35663fdabcde815c1b7f63d6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882107, "uuid": "268cdfce-abe0-4ad3-850f-b19448e8be0f", "comment": "Malware payload (Formbook)", "value": "3671a3f885f39f3793f4c88e8a54005b466e1e9b20f2a91d069cea42e25703b3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882107, "uuid": "8541f598-71d3-46fe-9ca0-56776d05586f", "comment": "Malware payload (Formbook)", "value": "a814e53ee8f9fbe2adbd23e77d2c0b0798ce6453", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882107, "uuid": "c4bf0859-f8b2-4665-84b9-222ee5b92de6", "comment": "Malware payload (Formbook)", "value": "5ae8a6241d1fd45e200a869f5660301b9615227417d9515575aeaf7d6b3e16f119b60d0421ce7d045c1432a2400beaa2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882107, "uuid": "463eb147-2306-48c8-abd4-9cd8f82458a9", "value": "T1EF553341FED44E8A082CE15C783B2E054ED26B95805E617BBBE456E37A8E30F7227853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882107, "uuid": "93de79ab-aaf5-41cf-a925-933aaee54575", "value": "24576:DcJRM+y/3nDB4ZNH0XZrs+rFbiIQL2ddPiNHGlJvakgvEXklkzBcy:Dcund4DAd/TKNCik0lPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764882107, "uuid": "201399bd-940e-4e39-98d1-06854fd42d2a", "value": 1368271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764882107, "uuid": "44273b57-b5b1-4bc4-aef3-1abf2804656b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882107, "uuid": "8db4ec51-82a9-40cc-b586-dece128289b4", "value": "Encrypted_Script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50532763-d0cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764823638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823638, "uuid": "2323c443-4d87-4635-af72-22c7e1f478c1", "comment": "Malware payload (Gafgyt)", "value": "9ea2215f4f67e802b29c3ffee8124c49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823638, "uuid": "f300d587-3ff8-4127-9938-4a3b150ee3ab", "comment": "Malware payload (Gafgyt)", "value": "367c3e32682736981ce62433391c3c526b9ba174bf26cc3958d981f97dcc50ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823638, "uuid": "bf969223-e059-4b5c-be6d-32eefd8ef517", "comment": "Malware payload (Gafgyt)", "value": "a50294fcc947d57500d1f30adcb3adc0d1861379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823638, "uuid": "8d3d5bcd-aa57-4f2b-b2ac-817bb6400e17", "comment": "Malware payload (Gafgyt)", "value": "55c08a700456c9c1c938f40e0b868b2b398525df88b6b486e852bd0e256fac5cbbaccde170ecc20ef9cf1dc67dbdbd1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823638, "uuid": "466a5fb3-bd0f-4411-b725-1951b1103da4", "value": "T1E4F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823638, "uuid": "3d07e91a-c32f-4d76-8f62-8c58ad86cafa", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBQYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/6YnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764823638, "uuid": "9d96f089-2437-4268-953c-d1705cfe3925", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764823638, "uuid": "d0942140-5207-48b0-a97d-0714f38cbd01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823638, "uuid": "d1c70b43-c564-4a92-8b39-d9ae836d9a5d", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8570e9a1-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879132, "uuid": "1ddb211f-e5e4-4b4f-90eb-74176612d2f0", "comment": "Malware payload (Mirai)", "value": "ce61dce4a4c296af6edac2c7ac36da24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879132, "uuid": "337cb9a7-3511-4689-9126-69146ffab5fe", "comment": "Malware payload (Mirai)", "value": "36c7532ae02d320e10fa44f9cb43226b0bb5842a20b729b047bbbe04a37c5ef3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879132, "uuid": "6a25f1e3-9359-4f9a-b22d-88158896f47d", "comment": "Malware payload (Mirai)", "value": "1d107e19f1cb8092c49187378ff355a258ad8c7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879132, "uuid": "4e3587ba-33ae-44d5-bbbc-0b7eb2436e50", "comment": "Malware payload (Mirai)", "value": "5ce4f7b0620486ef85c1038cf4fc83be95e58cef8033218dfec038bd7c69364bd5d188000d6c61a596365973ea4bf35b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879132, "uuid": "dd66c322-f993-40d8-bd5d-fe2226dc7f1d", "value": "T166435DD5B400DE7CF987EB7A80264A09F935722154A30F27A667FD93AC720964C2FD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879132, "uuid": "c51c8a5b-20c0-498f-8674-71d64d01d40c", "value": "1536:TKgor9Y1jsTo7BPcznKElbQCklnWSQDVaEh48U:R3sU7BKQLBSamm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879132, "uuid": "705e252a-3d90-45d0-aabd-da3457799680", "value": 59736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879132, "uuid": "0b15b666-4fa4-4380-b537-ef18124e15b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879132, "uuid": "998da5a2-953e-422e-8755-16de75f55c28", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c062ca-d117-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764856108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856108, "uuid": "49afbe8b-185e-4783-b710-4417aaad3245", "comment": "Malware payload", "value": "e59cd0904ca7af9d34d4c950e3160d8b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856108, "uuid": "0dd49355-cb36-428e-9713-03904c102be1", "comment": "Malware payload", "value": "376f8b99ceea332e28ab8164afbaf59490b5840e4311e8e1b5aca911f72142f2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856108, "uuid": "a73c9121-e09c-4fa8-99e5-44d64a66e25f", "comment": "Malware payload", "value": "b76cef3044afc0b1ab906a098563a8c9b812d054", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856108, "uuid": "6507a7e3-af71-4492-853e-35b19ea88490", "comment": "Malware payload", "value": "97776de4b6f7d441f9551e787c5bd04cc1d67ee102138ed18526cbd64b53d8ed7f2e31264d6c8e4aad66efad2da31669", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856108, "uuid": "614345d7-5b2a-40bb-9adf-dc326ae56640", "value": "T122210A58EC216867C66BE4FA978FB78CA1B571E44405E254AD3D739313A0702DBC41CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856108, "uuid": "9c07b43b-5237-41a6-a7df-428e086d3032", "value": "24:9tyZfhdrigfs0pA4Aqvy6um9bCumwXVZRLwLE5XDwfsHX0nfsEUXm8SA6nffP:9UJAgfs0wqvyO9J3fR8LaUs+fs7m8ufH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856108, "uuid": "ebf087ee-d207-40af-958f-0d3aaead9681", "value": 1205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856108, "uuid": "b6583d0c-522a-41f2-af72-9dfb8d61e21a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856108, "uuid": "1b84e591-c834-4573-b0cf-061621486435", "value": "MOLVGSVTTSZVMV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bc51bd-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (HeliBot)", "timestamp": 1764829045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829045, "uuid": "a38da0a9-681b-441c-ac67-c5854d7412cf", "comment": "Malware payload (HeliBot)", "value": "6d2b690c95a9a1db4378c2bac1ab68da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829045, "uuid": "e3799ced-025d-471a-bbaa-93f766373515", "comment": "Malware payload (HeliBot)", "value": "37ae5202f43966cec314666a2c750ba2c823a1a251ac29168874cad31df48a2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829045, "uuid": "3c311f58-b01b-4b44-8d6f-3f05785f4d0f", "comment": "Malware payload (HeliBot)", "value": "e58af894ab1dddcd23b37202edad37e1012cdf26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829045, "uuid": "195f68cf-57d6-4f71-8ad6-16dc3240f4e6", "comment": "Malware payload (HeliBot)", "value": "8ff992a45093a3336844f8148726b081f9b2fc3c598643ad57c25bd2febfc0d16b252c2d954f61b19bb968fb78d07df2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829045, "uuid": "e53d9c09-1ddd-47e8-a3fe-046d4172246e", "value": "T1CAA3D717AB51CEB7C85FCE7306AA460120CEE45612E46B6FB274DA6CE74B94F08E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829045, "uuid": "ad383ffc-795c-4f78-a5e2-ed2863ce37a7", "value": "1536:kGeTzY+eXiKbmTYWZMbZMPtAw7p7sXjYggpg2ymOimW+zWBSirHzai:k4k/pOZM1p7Ngg+2ytimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829045, "uuid": "fe3813c3-1566-4106-82c1-e5fac6aa6618", "value": 104824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829045, "uuid": "74ccb6a0-dca0-4c3f-9b49-b195a53ab5dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829045, "uuid": "7f59eba7-b326-4c7a-9c72-207d711df8f8", "value": "bootingworld.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd228b97-d13e-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764872891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872891, "uuid": "e52f0df8-b159-4738-a547-46e56c085487", "comment": "Malware payload (BlihanStealer)", "value": "5759c57678b950254f66d48a1b7fe3e4", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872891, "uuid": "143d44bb-c712-4a71-aaef-6f0bc681e806", "comment": "Malware payload (BlihanStealer)", "value": "37c6d1fbe5df806b903fd09b136699d07acbdf11207183f161d3743bbd6313a6", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872891, "uuid": "75d87c42-f67c-4821-aace-b6e31f5a0901", "comment": "Malware payload (BlihanStealer)", "value": "7b7766b6e2682924b00ae0975c3736d6e94d9c1d", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872891, "uuid": "4ef4636f-ef06-40bf-9f08-0e98acf40040", "comment": "Malware payload (BlihanStealer)", "value": "0f3b8cce0951fd43aba7014f67f5425ce1b655651bdc498bd2719293b3d8c0ca65ca4aa40ae7af5984043fe9db9c70f6", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872891, "uuid": "642d86ce-04a7-4aaf-bbd0-10d5ae5e3c19", "value": "T155937C1BADD3C9ABC45150370A75977DD2AFBD051EE9A312CBDCCD092227648EA6E303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872891, "uuid": "4cb4e5ba-b3b6-4688-9af5-4a924a54d73f", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872891, "uuid": "409e7fc1-b2ce-47dd-a8c5-f1d2febd3858", "value": "1536:wAowfUJFgjT284U+w2EwRz2OlUPTHBljxIJ82CDVXhqGaavtV02MSgiuAaD8/KA1:wAowyFgjTiUkEwt2OlUTHBljxIJ82CDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872891, "uuid": "788b9653-9bc5-43de-b550-358bbfeea447", "value": 90200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872891, "uuid": "4fc4800e-191a-44d3-8802-0524cbaeb66d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872891, "uuid": "57103f3d-858f-4f3b-991a-4bf7820e20d4", "value": "microsofthelp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9ae186-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829137, "uuid": "5a2b299b-114e-4034-a4af-2cb5df890199", "comment": "Malware payload (Mirai)", "value": "e2cb614f153f8a7547f5f3ecc7c39e7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829137, "uuid": "b3624713-ad70-411a-928e-9aa252232efc", "comment": "Malware payload (Mirai)", "value": "38706391ee6e0e95d9e64e4129c6ba5487fe78135b2c931fd7e9a521bddd955f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829137, "uuid": "2355c12b-961e-48b3-8e48-eb4d31f6fa4d", "comment": "Malware payload (Mirai)", "value": "e44ec945082b0bacf4428c52a211fdfffd7df5f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829137, "uuid": "1955d01d-8a44-4f1b-a63f-d12573498aee", "comment": "Malware payload (Mirai)", "value": "1011ea9b240068c4bce62b9d8e7ce6e125ab39d1bd9f7eed94aabc91e6a81014813d6683cd6488193cedb2e522e07440", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829137, "uuid": "6efc9c5d-8b27-4d65-936f-0da0800ee24d", "value": "T180045C46EB818A13C0D62779F69F524533239BA4D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829137, "uuid": "cf24514b-9675-48a1-9a03-c7511d3268bd", "value": "3072:WMdy5RuL6KaI5dPRdLBBoJYXoCyj8UlYuysd0LM/9VamtTM:WMIuuKaI5dPRdtBAFC68cYuysdQM/99M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829137, "uuid": "0f69b6f8-3198-4364-9e0c-6971661f968a", "value": 176499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829137, "uuid": "721c3c81-a94b-41bb-9ecf-a403742adb79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829137, "uuid": "9519ac7c-4391-459b-94af-d1d14b653266", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14000921-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829121, "uuid": "54fa03ac-5698-4562-8500-23de66a39b92", "comment": "Malware payload (Mirai)", "value": "28e4379c0e56db494af0f1e6ef24a0e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829121, "uuid": "df433b10-81a5-4517-b876-8a526752bc67", "comment": "Malware payload (Mirai)", "value": "387f45f8268f325bd56540d3839f3adad7cd1947b855f5f47ea2bd1e246b70d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829121, "uuid": "44dc80ce-22e2-4d92-a889-607a6676b858", "comment": "Malware payload (Mirai)", "value": "04e3159141022377708cb57b81e33db4b14837e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829121, "uuid": "fec21f19-6314-44c4-91e9-2eb2e0f71cf9", "comment": "Malware payload (Mirai)", "value": "72163feda698d9f848c4690811edaaa30e73188dd6b00459017a9b6a333ff50eb56c80070050e7a8aaba8b61f014940d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829121, "uuid": "5ef045a8-ca12-473b-999c-9cc9b96e5431", "value": "T1EE431681F8D2996EC6D4137AA73E358E33A1B3E0D1CB3613CD585B25338A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829121, "uuid": "e3dc029e-bff4-4a4c-9ed8-d19d788cc3a1", "value": "768:vcyaknuYHAf/StW3QQoyLEFMApBV5kTCS8kTIsYcLHKIoNDitRMfgrBNNTWnDGKL:vJnbHA36AzrEFMOkZcsrLHKotR7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829121, "uuid": "dd1aafb2-9e19-4412-970b-7fb3978f813e", "value": 55876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829121, "uuid": "1bc95e3c-fdf3-435e-aeaf-8a296a863a95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829121, "uuid": "dfdb3389-9952-41ca-aeeb-fcde32edd4fa", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9b5a56-d122-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764860653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764860653, "uuid": "6f28cc70-a6bb-4cf5-a295-036954510981", "comment": "Malware payload (ValleyRAT)", "value": "6013de2ce49bb335f13d883db9946ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764860653, "uuid": "2a6e4260-3022-474f-aebd-34e98cdc0cf4", "comment": "Malware payload (ValleyRAT)", "value": "3881ade74476b99c1cb2465ba927965d4beec4c567f45df325304cf604c4833f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764860653, "uuid": "2db398e1-56eb-4998-afad-d2cf1f919aee", "comment": "Malware payload (ValleyRAT)", "value": "6f2cc6817158e9fe0431c30c13001c620b61d7ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764860653, "uuid": "aaac6a55-b7bd-42c8-b8c5-7c863ae18c2b", "comment": "Malware payload (ValleyRAT)", "value": "dcaa2918ce0db2be1db4c40f0c6c79824ee88d04495af50050fb9184134072a0a15c0a04cae09b49555f40b3e44fceae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764860653, "uuid": "e2c77911-b911-4fa5-874f-0c0716a77bbf", "value": "T130459F4773E6C1F9CE7B81F6C9214212EB7178640B389BDB25908A2EDF63AD05E36711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764860653, "uuid": "680c7a7b-e79e-4bb6-9e47-438b4a4d3995", "value": "aee5b2e0c24b7569daaeaadf02db8600", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764860653, "uuid": "1be3b7ff-43a9-466c-9b93-84e552c90e1b", "value": "24576:NjZhmWcUs8EnqneJqexPvAzoCVCJBTvNu/3fzFfo0oZ:N5pAnqnewedhpBrNunpfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764860653, "uuid": "b84c083d-0ee2-45f8-af99-221566a8c76d", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764860653, "uuid": "3d07a14e-cac8-4fd9-a124-2e32489a08f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764860653, "uuid": "feceda87-65ff-4d96-a0bf-99e454d7bdeb", "value": "\u673a\u5668\u4eba999 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005f972f-d145-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875473, "uuid": "32507c36-54a0-4382-bdd6-db5e77ff24bb", "comment": "Malware payload (BlihanStealer)", "value": "3526db3ddd22ed6e7894ee795655c407", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875473, "uuid": "81feb738-2503-4262-bc97-83a01ed792d2", "comment": "Malware payload (BlihanStealer)", "value": "3897757313782025ca18221c92286236446ecb179877dde36c6c9ca7e25b646c", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875473, "uuid": "c91b2460-0422-45b8-ae30-99acedb504e6", "comment": "Malware payload (BlihanStealer)", "value": "7bf0cd980f7c2d8e44699244dfe77296d61e2f1a", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875473, "uuid": "1274f699-829d-42e8-9f3c-09a70699fad7", "comment": "Malware payload (BlihanStealer)", "value": "27a5ccf8b2a42a84a63b8f14ae7b7efe748cdb3934143159cdfa0924d28760db70b1ee1c2f73adf5303b2603ad84ff13", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875473, "uuid": "f696f803-6628-4271-8e90-2c08a0050d98", "value": "T109937D2369C384B5C492163245B99639A6AFBD051FFD93C38BDC9C5D27622C09E3E643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875473, "uuid": "f9100033-3721-4c79-bbb9-ccc292e1c49e", "value": "757708ca9fd3f4d0b8bef404d6ad71f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875473, "uuid": "45012bd1-c07e-42da-be20-7b2f063353eb", "value": "1536:vAowfbJFgjQ284U+w2EwRz/IUqX51n2n222n2n22n2n222nIaq3vhlUHttIr+G0b:vAowVFgjQiUkEwt/XqX51n2n222n2n2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875473, "uuid": "171939c4-ef0e-419b-9bdd-e6814f4dd0de", "value": 94048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875473, "uuid": "0ad5bf23-f817-4b2b-af71-3f9f0a69d439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875473, "uuid": "887fd13b-2f25-431c-9bc4-2bd9de5c1ec3", "value": "7dde36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91881635-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879153, "uuid": "d9ef8c36-4e48-41e1-b285-4db853bccb97", "comment": "Malware payload (Mirai)", "value": "dce4c7b1f1af0949ab3c71c08bb64cb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879153, "uuid": "0eea25a8-80d2-4073-85c8-64ce96095b9b", "comment": "Malware payload (Mirai)", "value": "38b1a698be1a2a1c97d0052b9d38f722c2617f761c76afad419c45e40a18a026", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879153, "uuid": "2b00832e-9c14-4d67-abe1-5402fdbc658b", "comment": "Malware payload (Mirai)", "value": "59b58edaa2b22a6a2e6ab3744a832a2a987012ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879153, "uuid": "748db900-f0f3-4981-bb99-2c4784860e57", "comment": "Malware payload (Mirai)", "value": "ae07434baf7e5e8359ffb8cd23673a924c0f1f1cd21acc1e542edbae39e03bde3b89e15fd1d4021f731ac158d3c267cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879153, "uuid": "7696f5f7-340b-4ef9-add7-5e229d4337a1", "value": "T1CD933A5B7721CF50CB69E63006B3875766FD265216E2984AE31CDE003F6434CA86FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879153, "uuid": "4d07f408-a210-4f69-935f-6a90c26e4177", "value": "1536:H9gUezDyr4HGZjtsjCPAuSISeVbTf99EoO/3JZuibHbPnoGs0/z:H+UezkHmZuAU9EoOvJ57w0/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879153, "uuid": "5451daea-7b80-4bac-b41a-26824a25a3d9", "value": 97160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879153, "uuid": "a9b3e85c-18bb-4d8b-8c8e-41ca3dc5ad72", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879153, "uuid": "591f3a1e-cdea-4593-a44b-0daa65e52d8d", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e5202c-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829909, "uuid": "a5a35160-9d42-46bb-b7d5-0f61219eee6f", "comment": "Malware payload (Mirai)", "value": "259d23cfeaa69ef66d7e52773cd4ccff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829909, "uuid": "a943aa61-f11c-4425-994c-b6ae11902b3a", "comment": "Malware payload (Mirai)", "value": "3963379220b151f757c9af0814754680fc2de2e3b19ec7386a3faa90c7688816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829909, "uuid": "2df6592c-3cd9-4f5c-9748-11e8fd8ede2d", "comment": "Malware payload (Mirai)", "value": "4eb4f61d274bac122ce3826664c4d6eef23bed95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829909, "uuid": "d3331bc7-f99a-4db4-83dd-e16073fc7f57", "comment": "Malware payload (Mirai)", "value": "bdd266a9c707fcfa7ff16c144aabb58f2591928b3ebbc893270d4e8e94c75e3af88543d5f79a63cf41867e4903b585f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829909, "uuid": "f7ea176b-bd36-4b1a-abc4-e296d712221b", "value": "T1CD639E16D82509A9C286C5B471EC8E3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829909, "uuid": "213b67b0-9eb1-458a-b1dd-8927769182fa", "value": "1536:D/rMkOtfaR0glv2ZKsT5Z7BPxznCI0sCp8ud8:DYkwfCFlugsz9xznsxrd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829909, "uuid": "685d75e0-bf73-440c-b487-a9db353b95bd", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829909, "uuid": "1b3504fa-02c5-467c-b14a-eb32386ef929", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829909, "uuid": "106567bf-1138-485a-ba11-1eaadb1d2a43", "value": "ub8ehJSePAfc9FYqZIT6.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2b119a-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764870688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870688, "uuid": "ae26e397-33e4-4a11-b3b0-fe1350f91f6a", "comment": "Malware payload (Mirai)", "value": "e70a9557ed609c4091663234cb61e052", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870688, "uuid": "987f03d3-38d1-4855-8c73-81aaa371f5f1", "comment": "Malware payload (Mirai)", "value": "398d32e24c362148782a0f681c7147f1054372585ce416c9e49b46bb9d9cf5cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870688, "uuid": "d6b71b94-beb1-4471-87c9-9062e5c40270", "comment": "Malware payload (Mirai)", "value": "2fd9faa851d818f498857f1de66b15c243d67d15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870688, "uuid": "f727809f-8a44-4e16-a618-686a2fae2016", "comment": "Malware payload (Mirai)", "value": "ce3e4b6c2268c28246dfc06daa7be8becc9289aaf730b91becd2d7068532452e48e07360b91fe6ae93150241b5e4c0ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870688, "uuid": "f0e84b7b-8b36-4930-bd38-e68e33bb53ee", "value": "T1D1C3F80ABF110FF7D86FCD3706A90B0625CC555B22A57B3A3634C928F54B65B1AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870688, "uuid": "84b5fb88-ffd9-479c-89ea-3704749e65af", "value": "1536:ZPvZHT+DemrUy2+32vfjQJXpi7Oi97ZrnqAwg0tS547+ZSvmyei:ZXZHT+UFMJXy97M75vmyei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870688, "uuid": "3b94b9a3-cbfe-4332-9e2e-ef1589309745", "value": 122316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870688, "uuid": "f0723973-3fad-4584-92ce-909b5e3397c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870688, "uuid": "ef07256c-4d89-43ef-94f7-56df665df9bc", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e2a9ab-d10a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764850229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850229, "uuid": "42bec746-2432-41b5-965a-7661ecc35282", "comment": "Malware payload", "value": "45ece3d8d092b98b39d4d77dd89e1503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850229, "uuid": "dab7d970-acec-4f0b-9c23-8ce7885df5c6", "comment": "Malware payload", "value": "39a0ef3d45420b70892cdc05d77d974786e812da5117885bfed2f8d44d922a58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850229, "uuid": "bf4f8467-531b-47dc-8ced-2fac11e29bd7", "comment": "Malware payload", "value": "5dafcbafce556c4e069b0556787aedc7768c6a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850229, "uuid": "0ce7562e-33d8-4e81-84ff-06430b56981f", "comment": "Malware payload", "value": "655f7fdcd135563d9968570c10abbd499f19b5f30d6b9fb6d133a9d3dbd03207f68388b4f9bc6f0287daea3c61c676c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850229, "uuid": "c73ae732-36ba-4d59-a4ac-8d793fa7c7a2", "value": "T18195CF45B3A481ADFEABD1B6CA23C517D6B2BC490276861F01A47B762F33371162FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850229, "uuid": "ef49621c-fa07-401b-90b3-cedac889b12d", "value": "6c9794990dcbb89d798ebf671bb8138f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850229, "uuid": "670b6c35-9681-4ec7-91d5-2f3f3fc4d5f0", "value": "49152:p2EYTb8atv1orq+pEiSDTj1VyvBaW2DRvdB1eOKdNALoOhG+:oXbIrqMOVBRKPXOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850229, "uuid": "0ec781fb-56e4-4ed9-8803-b6ad5869cafc", "value": 2011648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850229, "uuid": "cce30d89-e8c0-4747-9dce-7dd2aab2f135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850229, "uuid": "21c1c559-d03a-414c-8ed0-e0fc6740dd64", "value": "Einreichung des Zahlungsbelegs und der Best\u00e4tigung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41734bc1-d0a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764808581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808581, "uuid": "9089de75-92b0-401d-9c9c-4d8df01878f4", "comment": "Malware payload (Mirai)", "value": "05afabf0264b7023e599aca5f2f92947", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808581, "uuid": "704e2f67-016a-442a-80d3-79000f8de14a", "comment": "Malware payload (Mirai)", "value": "39d449f3cb12f830762efa1393c92bb097fa645f00d5eb6a9460ded62ce03440", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808581, "uuid": "cca8782e-28bc-4b5a-bc81-ee33f8145c11", "comment": "Malware payload (Mirai)", "value": "ea1864e640b456c650ad6ad3d12ad1ae22c999d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808581, "uuid": "ee402854-3414-4211-a7ef-d475d6d783eb", "comment": "Malware payload (Mirai)", "value": "198db54a7661c6d74a732e1ab441b2f8dbaec7af134ce154adf59b9d95b55d4d25d58b63be61a564c55fc56d2e3e195c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808581, "uuid": "e764f79a-da40-435a-9a00-d5796354f16a", "value": "T1A213F145D5FC8B2CE1EEB070989F74859974102AF408A672F14E9D721939FFB1B09ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808581, "uuid": "ab3b9919-3aa2-4077-839b-3b68ae12b4f3", "value": "768:RDu0fotbeNpCd0In0ZPB3hNpLjAC6A9oBjbr1pJ/n3DbKidDYcRq6GunbcuyD7US:lXmXd0CG0C79UdvrdDYunouy8Hyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764808581, "uuid": "6b110468-53ad-40f9-8a97-3b7c571f0ab4", "value": 44904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764808581, "uuid": "ac9a3800-1f54-4b59-9cd9-a9d6262c9395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808581, "uuid": "c764bb24-0970-4753-8f27-a6885814b72e", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc479fd-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807041, "uuid": "e8916686-fa7d-4054-9706-6f4e1b0845ff", "comment": "Malware payload (Mirai)", "value": "634c61439b5e6f6c498978c526538247", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807041, "uuid": "395ebd2f-44a1-4171-8413-add234317891", "comment": "Malware payload (Mirai)", "value": "3a08fa170e111c4f0c05148c34a78edd1f4a35160ec1b6f237cda0b4f4eef22e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807041, "uuid": "8b2a3a96-6baf-4815-82a4-66693b9eb57d", "comment": "Malware payload (Mirai)", "value": "ece0e7b61fd55c17bc4d174a45c695229b6bc82c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807041, "uuid": "f625360f-5dfe-4183-b643-f6aa0b9cb719", "comment": "Malware payload (Mirai)", "value": "a36e5d444de62628147fb696f30862be3dc1d0ac5de2e12bab68334c257110943f6a393751a54c59ae00f84fde3f39bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807041, "uuid": "9e09f8fd-5f36-499f-8d48-1846ed317511", "value": "T1C354C7067F618FB7D89FDD3706FE4A1024CCB45652A92B3732B0DA5CFA4A98B05D3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807041, "uuid": "23e3ca04-aa1a-4539-be90-e8e5ee8a32b3", "value": "3072:W/rkIyUyFr2yKyMG9oum3FBaZ6D5HDHOvb7sK/DSY2ijQFyJA5:Kc9oumFBS6djHOvkaDmijQFyS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807041, "uuid": "4ba52b56-59f9-4d5c-88f1-408c0e4d2eae", "value": 284840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807041, "uuid": "46e07762-5250-4e27-bcfb-f5af3bb08de6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807041, "uuid": "4a5c868e-057d-4fbf-b694-d238a64dbee2", "value": "sync.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48872f64-d0ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764836510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836510, "uuid": "e933906a-051b-48d3-ad5a-c5ff0462115f", "comment": "Malware payload (Mirai)", "value": "8526f000e047e15ebb7a79f8cd833b65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836510, "uuid": "236ad49f-a9a4-4ff0-893e-579b3509a497", "comment": "Malware payload (Mirai)", "value": "3a627b8126fdf1d4dfc538ea300ead37cac74b62e8588fccbca49cf5425cad0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836510, "uuid": "4aecbba0-2a73-487e-9c75-28b26f2c066f", "comment": "Malware payload (Mirai)", "value": "e4e0389e5039c62b0654c753b123a3399d2cda30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836510, "uuid": "4b14d495-1656-446f-adf3-914f82827e57", "comment": "Malware payload (Mirai)", "value": "477260bbeaa22266b5bc318a66c8577c91ad6074af1784f7bc5df8b17c330f38d5a24d5cdc8b651673b368de3d2f509f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836510, "uuid": "353eacc8-2338-43f8-b98f-f6c6a937ed69", "value": "T1B1430B93B950FE7EF40BE73A88C34735B230BA5645930622A3677D665A373C4386AF05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836510, "uuid": "ad990ef2-df0c-48a1-a0fa-e1e66d94b68a", "value": "768:rYuIQg5ZKa/x6vJ9flw9OBB8eZqvanvFxB7vJXKW3O59yAwRAudw:rYQg5b4dkMB8eZ3nvFxtvJJOadw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764836510, "uuid": "dd1a553e-8d34-4bcc-a78a-def42aca592d", "value": 55818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764836510, "uuid": "ec312f20-64d1-49a8-bd24-3b4e9af92f9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836510, "uuid": "0c5474e3-ff0c-4dde-bf8b-76934fd0679a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea42f6a-d10a-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764850184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850184, "uuid": "1a9d84b5-0c94-490d-a723-83d51a7ef8a4", "comment": "Malware payload (AgentTesla)", "value": "3684add34283e337f7fb005f5de50283", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850184, "uuid": "7023fa69-c010-43a8-a2d6-83b7e89a1a3c", "comment": "Malware payload (AgentTesla)", "value": "3a9f10bb04e9ea7938e5c7254e45450e405f95e7be166417f142a58db7a5b0f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850184, "uuid": "8e5df152-aa88-4a1b-8943-d563e04f07f5", "comment": "Malware payload (AgentTesla)", "value": "2e0c4a62d6cc7b066bcd57fb5ddb49e36b8b370c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850184, "uuid": "c47da9d3-e5a4-425e-a19b-fe4b792ceaf6", "comment": "Malware payload (AgentTesla)", "value": "61881642df2406fda29f599bdaeb75b9af4ee2bec8fc009089b7620020cf053b4efe5baa126af5dbec4a5a9348dd5508", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850184, "uuid": "dd5b4476-367b-40a4-b6e4-590551484f39", "value": "T13F45F2158D846FB4CFA89A1880FE161D93F05B8F445A748AFB2BBD46AFF7744060F189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850184, "uuid": "c31054f8-6520-4679-b5c8-10b7a6de2204", "value": "24576:mNotbrtnsIXrFGjcI8uYvud+zLY3yTm3x/2:4ShsKjIj+KDF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850184, "uuid": "e1ef485a-63de-4aa6-bd47-636a7c90fc3c", "value": 1223223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850184, "uuid": "624eee49-e910-4d1a-a61a-ed16c5dab7ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850184, "uuid": "1b499d96-3523-485d-8745-2a0c762ff441", "value": "899062726767.PDF.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d7390b-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883044, "uuid": "f233e7a1-26e2-448c-b5f8-eb4b63d1fd95", "comment": "Malware payload (Mirai)", "value": "2ed641aa70afd97f460d7aa9dd26dfec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883044, "uuid": "59342ab0-d27a-4dad-b4eb-a576f0fa8a0f", "comment": "Malware payload (Mirai)", "value": "3ba520d7dae8aecc795ab46d0e3d739952aac458f6e5378dc553cb698e7e4ce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883044, "uuid": "44b1671c-614d-4eb5-bd97-a9d8df1fdce9", "comment": "Malware payload (Mirai)", "value": "b108146a92d0d97de0bdd87be0ea0c4576bbaf0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883044, "uuid": "00065702-dd32-46db-98c5-568fa85df2b0", "comment": "Malware payload (Mirai)", "value": "317322171669c425e90ae2aa2284c39f32dbc5cef3b852685acceba70781b38f93f32b11b8ea4e5d9a9add6576e7296a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883044, "uuid": "503e2a61-d5cc-4d3a-997d-bd4ec2c1744d", "value": "T16F23F1349A8B61C9EED08935EB7280CB21FB1CE8587D17EF37D84E18954F68302B5366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883044, "uuid": "5fbaa61f-fa56-46a2-bcd3-5016fb7416d8", "value": "768:ZvJOQIA6giaMs1P1e+4zjo88H5eZrOC/zfkBus3Uozb:rOvsP1erzjo88HmrB/bkBTzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883044, "uuid": "6559015a-e1c7-4d45-978e-13e193d80cb8", "value": 48132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883044, "uuid": "34dcb7ea-f180-4c32-acb4-1717a63fc41a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883044, "uuid": "b8e491e0-6367-4807-aa3d-9ec5b3926119", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72003632-d154-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1764882106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882106, "uuid": "318c1ade-e3f9-4c02-85bf-654dffbebbe4", "comment": "Malware payload (Phorpiex)", "value": "af0df9a3393c6767d9abfe96d1c3d1dd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882106, "uuid": "4a751663-ec8f-4fbb-8720-0e21ae9f05ce", "comment": "Malware payload (Phorpiex)", "value": "3bfe06669545cf2b91a149149cc23073d631e237f5aaac237dbe7da67b227477", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882106, "uuid": "0652e894-d342-4ecf-8747-a1088b107476", "comment": "Malware payload (Phorpiex)", "value": "b7bcc018ded4fc95ba2ccd145cbb8350d70afad1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882106, "uuid": "b4dbada7-4fbe-4dc8-a9ca-07d7ce636f4f", "comment": "Malware payload (Phorpiex)", "value": "4db1c1c1c990519a667a5d6e1884bfc111e5c5cb1dec7f2018d4c58dc83dc0a8a29e7df16be06b2592e7f119e11b1188", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882106, "uuid": "29a294e6-4a9d-48ba-b739-5f94572741b1", "value": "T168123A1B7E8A0071C3A14DF06AB84B9D4B7D542327D561EFB373C58A1F64385A0472AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882106, "uuid": "4af440e6-fd5b-47ce-9b11-f1fb1b2f9591", "value": "9db3169f0849392a7cd91364b6f1368b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882106, "uuid": "fcb8d260-aa69-41f2-a05b-688f969330bd", "value": "192:U7gEffYwcoBPsZ+C82KFJxTZ+zmFhyMN:UPfoX432KFozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764882106, "uuid": "d7c2c2e7-b586-49e3-839e-3ca3437bacd8", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764882106, "uuid": "267d0e38-9f24-4696-a88b-168a22b631ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882106, "uuid": "09c67430-a553-4d73-a3a3-073797162b4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5aa6e4-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834099, "uuid": "ef753759-bdfb-410a-987b-be7f40c7f4ff", "comment": "Malware payload", "value": "addb8390ab00288e58dc79b4e8fe2305", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834099, "uuid": "3fc95ee4-c06f-4403-9148-d045de600fc0", "comment": "Malware payload", "value": "3c0a6f866aa4d74d0b39a2b9d11692ffa7291fd46b414e73cd5f9c7f9f030b75", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834099, "uuid": "9a897bbf-51e7-4f6e-9218-dfe3921fdbd9", "comment": "Malware payload", "value": "c7575492ea1e762313609db15220dad199eb1d2e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834099, "uuid": "f92e8ae1-1fce-4fbf-ae8c-3aa727235edc", "comment": "Malware payload", "value": "fab98c104e9bc418f55acdb7a58360d92d94b2c32ad5e650cf783ba2ea6529a134b6c4101752bd2c208431253872c89b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834099, "uuid": "a39ba462-45ad-4a43-85f0-abaac10b3f8d", "value": "T112961203F78E492ECEE2B97C49A313715615ACAC1910538B4D02F318BEB76D99F26BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834099, "uuid": "34582287-0560-4a89-b090-250158cfd549", "value": "196608:whN/nAsoG3N/CDfIn9RoKbMAGhBhsADsEdHexOsRsQsfsdscsusGs5sKsO:whLoG1Cc9RXaXcxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834099, "uuid": "550512ed-1548-462e-925e-42f599e68ff4", "value": 9037065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834099, "uuid": "ef775a08-9565-450c-b5f9-27d4e855be37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834099, "uuid": "e79b6653-9ed2-443d-9831-2024af9d618c", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecabc14d-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875440, "uuid": "f4ca8b58-35ee-47f9-8e36-fa3c679e82f9", "comment": "Malware payload (BlihanStealer)", "value": "ca979cc3110f376b6c9344b026421678", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875440, "uuid": "54cc195e-61c4-4ef0-af80-00065d16f9b5", "comment": "Malware payload (BlihanStealer)", "value": "3c212ab514d92d25a9335ce47f60e239a5f2b0966ae088a5fc4a9c2248b2493d", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875440, "uuid": "3666e5db-7d8f-40b0-ab41-891712b7f48a", "comment": "Malware payload (BlihanStealer)", "value": "197110cb9090c5aead458095e7681c45c7d981d8", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875440, "uuid": "107b1114-baa9-422c-8995-081a1ac1b3f1", "comment": "Malware payload (BlihanStealer)", "value": "b0f3edab770688eeb214b8303d954aba3bb4f0c2f83a0ba54704de531782b9d74ac072bce5f8127e9e732d68c2226920", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875440, "uuid": "fcf1a0e9-36c2-4288-a319-7a82692aac32", "value": "T1DD837D1B6DD3C9ABC0A150331A74977DD6AFFD051EE9A342CBD8CD092226648E96F343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875440, "uuid": "fbb65e5a-a114-4c8c-a260-b490e2600280", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875440, "uuid": "e85fa33a-8ab9-44a3-9490-88ff36034765", "value": "1536:wAowfUJFgjT284U+w2EwRz2OlUPTHBljxIJ82CDVXhqGaavtV02MSgiuAaD8/KAo:wAowyFgjTiUkEwt2OlUTHBljxIJ82CDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875440, "uuid": "6cd0cf1c-abff-4929-9ebc-73776edf6a82", "value": 86820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875440, "uuid": "6cee9516-fe15-40d7-b9fe-623370d3672e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875440, "uuid": "d026ba57-68f0-4691-a945-e25a0946658a", "value": "a9c224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cf8639-d15c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764885658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764885658, "uuid": "21d12c13-dac6-46c3-bda9-10a779a1bfc3", "comment": "Malware payload", "value": "67afe8ff562e4a1411168af22ff48243", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://www.seqrite.com/blog/9512-2/", "colour": "#174D6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764885658, "uuid": "cb21e071-cec1-4e58-b48b-8e48000a3302", "comment": "Malware payload", "value": "3ce5ab897b7f33bc1b9036abc8e7d2812b385fbab404dad686afaf9fb83fe07a", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://www.seqrite.com/blog/9512-2/", "colour": "#174D6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764885658, "uuid": "297f60f0-277d-4ffc-b4f1-2a63653c0af2", "comment": "Malware payload", "value": "d797186c361c2bb42b46912c734136448dda83f7", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://www.seqrite.com/blog/9512-2/", "colour": "#174D6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764885658, "uuid": "319cd8a0-fad3-45ee-b38f-4c94944fa058", "comment": "Malware payload", "value": "c1b99e61728640b3deeafc8530308a594f9ac08bef68ff0cf2a147c4f93fd22ff708d46e69d764067ee25c4157ce7c6d", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://www.seqrite.com/blog/9512-2/", "colour": "#174D6D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764885658, "uuid": "0213bca5-121a-4181-a9ec-6dda86ba8434", "value": "T119746D87BB857CFAC216823489AB83793334F5E013535F274964F7321E66AD0AE87527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764885658, "uuid": "f07e090c-d603-45e9-b08b-fd2d4c345e59", "value": "64be7641a660f28b6d53e98b0bb9a5e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764885658, "uuid": "d26e8740-4d4b-48e2-acf6-19f72e9324f3", "value": "6144:p7IXkiikKaUAR4IhcX2w2TckBHUWq+9yN86IpKIGlAvZq2qB9S99NpNNYOlZCKbO:snwX2w2w3tPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764885658, "uuid": "90ad22a8-17c6-42e0-990c-c771a4b4aac2", "value": 364791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764885658, "uuid": "57a77878-1b47-4fca-b568-55fe61ea07cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764885658, "uuid": "60982e5a-8341-47c8-9957-717d4362e9fe", "value": "hmhewg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0570de43-d138-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869898, "uuid": "0ec17447-fb39-4199-af20-675ea5bec68b", "comment": "Malware payload (Mirai)", "value": "efbc39345ecbac3a8a36de7b640287a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869898, "uuid": "68854e41-8264-4196-bca3-608bf7decffb", "comment": "Malware payload (Mirai)", "value": "3ce7d183184405ed38075102ec9277340c97f313f578fae77f8772fc34921f4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869898, "uuid": "70387ab5-78dc-48e4-b7ae-10eaedea9eac", "comment": "Malware payload (Mirai)", "value": "bb823c9f89697ccb00ab04d57043a6a8ba1e1388", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869898, "uuid": "4bef6e7f-8d15-451a-9372-1c9bbdde52be", "comment": "Malware payload (Mirai)", "value": "be82e5e234d25605c8a0bddc6658b2efc28f9939a6a304dd99c60ebaf6ed8d475e771701bebacce590ea2bd812234677", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869898, "uuid": "3d55f1d0-7bba-4476-844e-c2d528e745e0", "value": "T1E323F1CA0A359C9CC159823296D9437B3B60579A7E84F81B0767E7CBCA0F0F5AC136E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869898, "uuid": "b9f74b6f-7bab-447a-8f4c-c8a7e1ce07e4", "value": "768:Mt5S/TLewPwBLgMexqST++7b0Hebq6VmcZ1xz6HMiNlT3KKL4JgGlzDpbuR1JW:oCTLNmLZ+7xq6Z2FLTrL4VJu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869898, "uuid": "2ab5422e-300b-434b-be73-4d72c456ef18", "value": 47688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869898, "uuid": "27d511f8-d352-40c6-8dbd-0177927c2f5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869898, "uuid": "9c2cbc64-653c-4363-b07e-da0f9b58f79a", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee611df-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834185, "uuid": "d83b0392-d413-41b0-b6c1-19d1dbeae299", "comment": "Malware payload", "value": "16fdca30286f5bf6ed36b86a7abed7a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834185, "uuid": "8f4e2cdd-5991-4b00-b6dd-a10c6b5b9ae5", "comment": "Malware payload", "value": "3d3c4c96e3aa5cc8eaa8d33f260a30c7f5116fb2dae0df357b85f3fd20706de4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834185, "uuid": "4d7b80e6-bee3-4f04-9287-fc91b8f1722e", "comment": "Malware payload", "value": "4eee7e658ee5a239907fba3cb0a2057a469722a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834185, "uuid": "01a809ba-a1b8-48f5-9c1e-ac5a66bcb059", "comment": "Malware payload", "value": "882c36536345fcb1184911758bd00d0bbe086ec1b79b114942e2fc543164cead93642cccc26557c23ff0dd3613081d0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834185, "uuid": "07e5f98c-90f5-4d46-9f35-e72f8aa72c23", "value": "T1B2D7ADC0EF36F54EE7502469680122C4694AAC34B3A4D9A0FFCBB6E261690D59DF1F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834185, "uuid": "f0bd6306-a15f-429e-a6f1-e2fdf3794e15", "value": "7c055e26af737337507c305ed09986ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834185, "uuid": "f4f95a51-380f-4e5f-a6b1-8d52dd06d9dc", "value": "196608:CCN5/BHxX+ZpXXfFw0ndw17lZEFTRpe7Itemq9uUCHTyILHHMHayqVve:xLHQZRtJC17lZEFFs8tJ1TyILMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834185, "uuid": "8084d515-2afb-4dbf-89a2-6097790e7794", "value": 60156768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834185, "uuid": "ffd37b36-cdff-4e2f-9055-945fb270b326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834185, "uuid": "3aa7e905-5ea1-4628-b2bb-8fa0844197d7", "value": "InstallTool_51272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec64a7c7-d161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764887895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887895, "uuid": "272d45fd-5a1b-4759-8cd2-a0617f25339e", "comment": "Malware payload (Mirai)", "value": "d1c41b5f6347885194c6c5565970155a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887895, "uuid": "d7934a95-3645-4155-b8e7-f7222bc5dd19", "comment": "Malware payload (Mirai)", "value": "3d9f01f9423cfa7912a40dc0f8eb6698a680573ede781881500dcbc7096b2d70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887895, "uuid": "b80836a1-cb8b-422c-a8c8-d158f7a68528", "comment": "Malware payload (Mirai)", "value": "6e61651d0e2e3d13f769e05659cc2613f9a3a52a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887895, "uuid": "f4b67f51-bf0c-4df2-bf08-9d0e5dd95e01", "comment": "Malware payload (Mirai)", "value": "3b61190af07b8c6b7e24dcd19a33222a8e7c72c0fe41b53b902e1e56aa4176382f2524ff6f95620d20cef5ab78f971e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887895, "uuid": "2a35f0f7-bc4c-4cdd-878b-626d54b8b3fd", "value": "T10A932955F891DA26C2D9167AF65D528C37231BB4C2CE7202DD10AB362BFF91B0F66C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887895, "uuid": "7e4beed8-9288-4857-b8c7-2653d70c9729", "value": "1536:idTWLGUBOAVu2K5G5udXNUMX8O2bzqJPV6OxVulGcj8dOr9uFm1Ir:KTWLGUBOAVuzG5udF2b+iOgSqud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887895, "uuid": "daf4feea-74ba-4248-b4e4-50e2ab28486e", "value": 95660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887895, "uuid": "b122b4bd-3889-44ea-815a-444a4b7bd0e7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887895, "uuid": "c7f8567b-90eb-40dc-a9cb-42c2a51c029c", "value": "frost.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8664463-d117-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764856133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856133, "uuid": "8767149e-5c9b-4398-ac69-c47b1405f98f", "comment": "Malware payload (ConnectWise)", "value": "7a5a6f35ed59221f522378326b66c8cb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856133, "uuid": "9c4af422-f3a9-4442-8fb9-b50c25a4dfcf", "comment": "Malware payload (ConnectWise)", "value": "3daebc60bc239882c44fd9090ea68d9b6e1982e1dae9ab4e5943fb05d42875ab", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856133, "uuid": "67e2df20-9cd6-407c-9a57-9a870c6910d4", "comment": "Malware payload (ConnectWise)", "value": "587b4a989382596da0a44f34dbd360f594d95b14", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856133, "uuid": "d8b724c6-efe2-448e-a31b-ea5fc1a0e9f0", "comment": "Malware payload (ConnectWise)", "value": "9df4c8c7816343b55e3a7baf75422dda1f463c07909ddcc48bb4b90b2610aed4e67ea01c61f6fa92d4c2eaa0bc6eab7b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856133, "uuid": "047866a8-411c-4290-b7ab-6f42fdb69086", "value": "T16AA6231126E89134F6B31735FE3A56F55A3ABC25DD23C12F1268B91A2A73D808D72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856133, "uuid": "d0e56b82-2ee1-48fc-af97-aa71cf4b036d", "value": "196608:osuCcGaDpxmcYMDMsuCcGaDpPsuCcGaDpAsuCcGaDp:nuGdhMDLuGpuGYuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856133, "uuid": "cd79b4d3-df79-4f50-9e5e-8fe78defa76b", "value": 10059776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856133, "uuid": "e10b62b8-e269-4a11-a04e-24bd30ce864b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856133, "uuid": "48f28af4-035c-4ea0-bcb9-ecf4f77a6994", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5de8d6-d12c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764865050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865050, "uuid": "2e39637e-368b-4569-af35-d5436615e439", "comment": "Malware payload (Mirai)", "value": "03e1df5bbba2c6194fae723e2e989585", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865050, "uuid": "cba526df-3879-48d9-8394-d3c8b9672472", "comment": "Malware payload (Mirai)", "value": "3ded37e3d2d777303942bc07f638f2bc79f63aefdf687d52f2964f612bc8a95b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865050, "uuid": "e098da0e-d437-4f22-ad44-48a5bd3a05c7", "comment": "Malware payload (Mirai)", "value": "4267d86a58e5e77729240907e39b71a583721371", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865050, "uuid": "5f3ee4db-3be3-4ee2-af38-4eb974c5fc9a", "comment": "Malware payload (Mirai)", "value": "76576b8981a6362e679045b5032190f1476b5946fae49da65b83a2f8b7a5e62deddb7cf70fab343798c19f530514209b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865050, "uuid": "4b039682-73b8-4b96-b925-213989b55874", "value": "T1DB143ACBF800DDBEF81BE7764C530905B130B7B254521A377257B96BE93A0A50927F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865050, "uuid": "4fe13d89-3375-474c-8e42-6eea5a5d00ab", "value": "3072:4Wtd+0HwVQ+mzAwENftPcx2EE0y3Q2Nt5JBNXxdZWNeE61VKjbiwLSAcnC8nv:R+0GTObEqty3TNt5JXYYE6wL3chnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764865050, "uuid": "f5703568-4391-4573-986e-21ce145b752a", "value": 193312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764865050, "uuid": "7e2aae12-2aa6-4942-a3ea-49f40c6b11ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865050, "uuid": "77c19938-5ef1-4eb2-832e-21308c95ceae", "value": "Polar.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30be6311-d141-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764873836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873836, "uuid": "c533e7c4-396e-453e-9903-d278aaaafae7", "comment": "Malware payload (Mirai)", "value": "ce2f93c1f0a54faceee118cfe88ef93c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873836, "uuid": "e5e9ea72-400d-468f-ab2a-202d6e777451", "comment": "Malware payload (Mirai)", "value": "3e12f6f6af32ea4d54176d6af7996882ac19af5ac045ee6225e04becd3d5cd29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873836, "uuid": "e9838cfc-d59a-4533-9f40-d4dbc12425e7", "comment": "Malware payload (Mirai)", "value": "3332d1e5dcd89c002400e851639cb9de538acd1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873836, "uuid": "4955eb97-5c14-4e1a-b0ed-1bac30069b66", "comment": "Malware payload (Mirai)", "value": "c8ea62b7b86c4549c8ca9eb601170c4e62bafb68b2bb7b4c538a1e674bc8bed08593a6386e3055372c477ebc4b474276", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873836, "uuid": "034e62d5-c632-46c1-bad2-ee29dda11bde", "value": "T122C31945FC415B23C6C612B7FB5E428D3B2A17A8D3EE72039D256F60378B95B0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873836, "uuid": "c3681f2e-56d1-46f2-9279-6e8d12adb31c", "value": "1536:JCDwI4fG50nVg/QDED9+19jAd424V8G2TTZtt1qLj2x1buddLqlEmwyw6FPRbxG8:MDwLYhQDU019jc4r2/Ztt1qYbu7wSbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764873836, "uuid": "381491cf-2da8-4b07-9bf3-122de15485d8", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764873836, "uuid": "79ffb55e-9c47-4397-8847-6be7ddf66115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873836, "uuid": "656a204a-bdcf-4f56-9a0b-cf8ddceb458d", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d9f7bf-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834575, "uuid": "4bfb34c4-49fc-4d50-b8bb-3715c7a29feb", "comment": "Malware payload (Stealc)", "value": "10c3e91c8052878c182d30f57d8dab4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834575, "uuid": "73dd81e0-b4b9-48a1-840f-c60740a83286", "comment": "Malware payload (Stealc)", "value": "3ec41ebc9acb444fee5a1a94dfe97b783972513a0de1899f387b79b7043812e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834575, "uuid": "17f584a2-8e42-4909-af81-1d1a39dbf454", "comment": "Malware payload (Stealc)", "value": "bae0b8e48c2d6a87c04afe2f817453e2487e81f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834575, "uuid": "11cbac59-1d4a-4693-8e44-848aef596e15", "comment": "Malware payload (Stealc)", "value": "0e2cbeae427257d840a05839682337c91032c24ff858a74bbe9047bd13d47d4136e3f9078cccc3c6fc6df8c0098f3acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834575, "uuid": "67132fd1-9aec-4231-ac2d-ca890fb01ec8", "value": "T14D057C1EA7A503F8E0ABC174CAD28542F7B278455770974F03E196A62F376A0AD3FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834575, "uuid": "b8f3ad63-60f4-4f5b-8c2c-7a60c2c46751", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834575, "uuid": "c65c4a70-38be-46fe-b781-7e6913a78a09", "value": "12288:RGLVpIo/cBJ9InRPehbyv8plnEz+v3YZtF15kjH3:RkkBJinRP6bw8TEzi3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834575, "uuid": "9dd6f96a-59e6-4810-a421-c2ed7863ed60", "value": 797952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834575, "uuid": "05e41bfb-2498-4923-b8dc-074efd21df53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834575, "uuid": "bbc34943-a823-4fc3-b68b-cf49e35b56fd", "value": "16wsad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b2971e-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816745, "uuid": "95b2f193-1f22-4d68-939a-19f4aa7f6eb4", "comment": "Malware payload (Mirai)", "value": "343919351482555642ae867fca00546d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816745, "uuid": "d5909fdf-2661-467f-a4ae-3c44cd7c0316", "comment": "Malware payload (Mirai)", "value": "3f7ff875624b4e65102f58073d14b04d378f0cfaec5c64aaef59f6e87e29ac29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816745, "uuid": "2f0c5d91-b116-4dfe-aebe-4f96c2d1ec2b", "comment": "Malware payload (Mirai)", "value": "1985fa84c19b4ac12da793f0dbd0a4a756531e57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816745, "uuid": "19dd2406-31fe-4b35-ae90-067b877c75f8", "comment": "Malware payload (Mirai)", "value": "d5e3fce08e703577b45ba0dadaf08ecf95972b49b160d6d6d6b515baa264cfc67c894fcc9c2e735023f8fde2ae5aadf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816745, "uuid": "6f9ea28d-da2b-4578-937a-b998b328148b", "value": "T114044E42DA818E13C4D6277AB6AF424A33329754D3DB730699287FB43F8676F0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816745, "uuid": "d1716cf9-1ed9-4e6a-9031-979fd89946e1", "value": "3072:pOnGlcc7f++c8x8+baop4oR6LvXEf2ISQyza976rvRM/9OglkwHNFR:EG7lRbaop4oR6LfER9976rZM/9O+kwH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816745, "uuid": "c462a05c-af28-4baa-8664-525a6e4f54ca", "value": 185506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816745, "uuid": "cf3774cf-6905-43d8-937f-6c3fe24b3199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816745, "uuid": "7beff221-3481-468c-a813-dab158780b28", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa662df-d141-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764873861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873861, "uuid": "064de676-3f2f-4bd8-875b-7d05f6ed5499", "comment": "Malware payload (Mirai)", "value": "7fb48702e6d58129110c76f8952e49dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873861, "uuid": "05bd1954-ba75-464a-9af8-ee710a6988c1", "comment": "Malware payload (Mirai)", "value": "3fdb23b5fafa4f2b2c59e5b30de6a941f953b995c2b826a4ffecfbdea373bf0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873861, "uuid": "fc5751e5-fae7-4752-a1d9-6e1e6acaa3c7", "comment": "Malware payload (Mirai)", "value": "0c7f73c83bccb4572c198bb8e0f5fd4354366f4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873861, "uuid": "ed64d61f-a085-4583-829d-73ca3c2d2b63", "comment": "Malware payload (Mirai)", "value": "4eec0d2e463e0846236b89573a825f3462f306eec9a3498e500d74f99daa7572241b76420466b3a72ab71d097c6e29ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873861, "uuid": "e8776c60-5bfc-42ca-9f94-2a8a5fad2086", "value": "T125932951FD825613C6D122BBFA6E428D3B2653E8E2EA7203DD205F2177C681F0D77A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873861, "uuid": "165da372-f6f7-40fb-ba91-451a45504ffb", "value": "1536:FWKfB7ByQgaFrrjwg3ZxOb7uf2wOUM9ASbqiO2C/mRrEqyXvrJ:oKfB7Zr7C7sOUM95oqMrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764873861, "uuid": "007c738e-b964-474e-8efe-eb9441d7c151", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764873861, "uuid": "b3f19754-b84b-4929-b5b7-af43e04eaa1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873861, "uuid": "cc948ac4-926f-43ac-b3b0-d7c19560b6e2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd2f931-d131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764866963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866963, "uuid": "ec4d1cc4-e658-495e-a3a4-ad63e7359128", "comment": "Malware payload (Mirai)", "value": "e24d4a0ab3ad2c3c40a279f2b371bd2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866963, "uuid": "a9cd8704-1c59-4bc5-b3f8-f3bb7455d02e", "comment": "Malware payload (Mirai)", "value": "3fe49d268aff36e623eb346633f1c19b5f30f5ceb9dca829ce3f12bab6e04e38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866963, "uuid": "14c8d47d-0795-4127-9808-68e812a60f14", "comment": "Malware payload (Mirai)", "value": "297aee61c70366c431c91dbe292d0937e4b1f50d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866963, "uuid": "bbef4bf0-dd0e-4e61-9171-94984b2a2ebe", "comment": "Malware payload (Mirai)", "value": "6a8d12c459056138d5456d9d45d3a75db56f514adfe3c91107772a199493072fa2d320d0c9f6ad1f480d4faa1513659c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866963, "uuid": "b25f43f3-aaab-44b0-b95f-fb1309a3cb64", "value": "T1C773F982B8D2891AC5D0677FA66F619D3361A3E1C2CA3103EDA74B11378716F0F26F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866963, "uuid": "bdc99486-e682-49b7-b9e8-5a8138d8527c", "value": "1536:kBfytbd5eKrhwtxfmYHPFZkr0R4o5RF+BPR3opddsI:ofytbd5eKkmYHP609ivKdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764866963, "uuid": "c66345e8-1ed1-4e1d-8079-ec773375a884", "value": 75268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764866963, "uuid": "95db707c-aefc-49e8-93e3-b239e455aca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866963, "uuid": "01973c79-ed0d-4c5a-89c3-8db26b5eefe2", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943c0646-d0e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764835349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835349, "uuid": "b4f6f956-c9c9-42ad-9d40-3c41863bff12", "comment": "Malware payload (Gafgyt)", "value": "029ef6dc5bbc838678c0f8e67b7d343d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835349, "uuid": "3d957915-4668-4b81-afc7-7ec0d3befb5f", "comment": "Malware payload (Gafgyt)", "value": "3fe4b6d70c7a65fe7b10c0cd67f7b5bec8a6d65e79beb7151a1268355e258c7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835349, "uuid": "c8780074-1b2e-42ec-8779-dda0f60550dd", "comment": "Malware payload (Gafgyt)", "value": "8f22ea2406dd132638d7505666124c210ac1db09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835349, "uuid": "32b874f0-b995-459b-8e5b-6a2949f49356", "comment": "Malware payload (Gafgyt)", "value": "177a4d9f0d466b882b3d498ebaf725d3e723bcb2c9afed04dabe4cba7844925662f237a208310eff790680b608b26595", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764835349, "uuid": "38295085-ac07-4d69-a314-12f8babd5656", "value": "T1F2C33C09FB404B57C0E127BAFACB424D33238B54779B331A5A289BF43FC6BA94D26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764835349, "uuid": "ba7b5047-d755-4795-8ec6-e002806d4b8b", "value": "3072:Gnszxf5P/m6YFSGub/bi5ag6CM/98InpT8dz:Mszxfl+6YFSGk/uagjM/98CpT8dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764835349, "uuid": "94291773-1a5a-4f28-b307-ef55490c97a6", "value": 118402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764835349, "uuid": "b6789334-6000-4e6f-8dae-6de1a76a4335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764835349, "uuid": "47176299-bb6b-40da-b5be-1d804d775a8b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88d50ad-d124-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764861689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861689, "uuid": "831d63dc-12dc-462f-a9ac-fd29c9bddebe", "comment": "Malware payload", "value": "3c5e3d5ef89270a50f27fb84d512a24a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861689, "uuid": "076d98b8-89b8-40a9-bca8-3f37f50dbf55", "comment": "Malware payload", "value": "40458250b78202193bec6b8d4f831265477e7756418e1bbd682143491cd03c1a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861689, "uuid": "bcd0c7c9-6818-437a-b764-1b4a8f249ab8", "comment": "Malware payload", "value": "9292d3bf0836474f22c936ca04a400d3f4f48557", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861689, "uuid": "6a1a5849-a0e7-4ecf-b514-f627f8a5145b", "comment": "Malware payload", "value": "decbe1911377fde4c5646b337ea07d9ac1f062b391b8404abf018e596ac7584257801206a1aa66cf9747b7f439439178", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861689, "uuid": "b750a89c-8fc2-4cc6-9f9c-a7e1852143b2", "value": "T1FA21AD115BEAAB25F3B60E351873A7398A33F84AEA42CB2D9045414C1C2A6019D7EF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861689, "uuid": "f459838b-ac8c-44eb-98b3-cfcab94d4e4e", "value": "24:8kJ4JItfJFegAP6d+/x4dBIN8OYqVhH2yncmO:8k8gU3X4dBINVBRc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764861689, "uuid": "08f5ad7c-3222-4da7-ad10-82a8f384e7fe", "value": 1287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764861689, "uuid": "f7562def-24df-44f2-96c4-3f26d0fff849", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861689, "uuid": "33305e78-b5e0-4beb-8e98-d8b963587d1a", "value": "Rechnung_2025_11_33828247000801.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a45e704-d0cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764824970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764824970, "uuid": "2652905b-aa55-4633-896c-c7a660efbf68", "comment": "Malware payload (Mirai)", "value": "8480f18b1c51218776327e8a0d531d30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764824970, "uuid": "6a8b8920-d8d0-44ab-b627-67f4703601dc", "comment": "Malware payload (Mirai)", "value": "405b5506b6759506b8b928de20abf58d409cdff7dc3d21de9736d91a2cd194ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764824970, "uuid": "057cc55c-a390-48f5-b3d9-de190e98db40", "comment": "Malware payload (Mirai)", "value": "b9e1353ccc2009b728804ac8d4a6d7c953aa7771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764824970, "uuid": "009f59d0-bc17-4f40-9673-4a012566fd36", "comment": "Malware payload (Mirai)", "value": "8d0ce52df0eb99663e9a13b54fac3a70183931cc97b846d66e93a7cefcb2a9a2ad02ab230b1aa0de72a5ca283dd63366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764824970, "uuid": "c4421c9c-2046-4d8c-a82d-b506f8ae514e", "value": "T15C634BC9F983D4B6E857093010BBBF639DB3D6BE2168DA43C3A855369D12502F416E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764824970, "uuid": "5531f490-5c4e-42e3-8ce7-3dbdfb46de3b", "value": "1536:ltWizyApqj4PfWjF7lOvZOWsIyq3XkZSYd:ltFyA0j4HWBJOvwfIyqsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764824970, "uuid": "340d3298-6764-4688-ab6a-208c5c884cc1", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764824970, "uuid": "846993c9-6b7b-4ba0-ae45-be7a05370731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764824970, "uuid": "5a0bc068-e349-48ba-a420-ce0b2c028f82", "value": "ub8ehJSePAfc9FYqZIT6.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43358f3-d11c-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764858273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858273, "uuid": "8eb2cc9f-7345-46e6-ae93-d49d6142f5df", "comment": "Malware payload (SalatStealer)", "value": "a9291693aaee24ada6a4a15f8cdcf7d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858273, "uuid": "11ed19c8-0e53-4f27-bc49-89642a1d9446", "comment": "Malware payload (SalatStealer)", "value": "413acbfbd979d63b8e4b80a7689956b5e2f5f648cc562c75170133c3d729af07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858273, "uuid": "88fcb416-ef74-43f9-859f-22096046c7ec", "comment": "Malware payload (SalatStealer)", "value": "10daa8b2caf99848ce522cd4c224e5b914cfd7d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858273, "uuid": "c4c9761c-d3ae-402a-a9ba-d1ed59c0900c", "comment": "Malware payload (SalatStealer)", "value": "5c574eac7b67e721e301171a7d7f20e79d6701fef8176d42f32056de19b36a6cf8a1ca228b43b9812d1037764123018a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858273, "uuid": "89cf7a56-1562-4951-9e1b-972f3a2cf91f", "value": "T1C2E5336AA2676EC2D5C07239A7FC5210D54CC5A3F2D79C5D7FCC2F3D0896528A902EE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858273, "uuid": "8f0dadf3-203e-4211-adbf-1bc5488c276a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858273, "uuid": "8c0a0cad-72bc-4604-a51c-1c2051762269", "value": "49152:eYJwmYz0GSh+afNEbKWeNv+JovxA8P9w10hrfCpePgAvas1G4dBJkQ+8nTSZJD:3wrLkRWk68VJhrfCpeI/X8nOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764858273, "uuid": "fb8f98d3-e1a4-422e-ac7b-09c104c2fd3d", "value": 3291136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764858273, "uuid": "a0c19aa1-3da7-4a7a-85cb-65be558ad2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858273, "uuid": "b221bea2-6e58-47f2-b5e8-dc471c1861e4", "value": "DC9E71D3B5G4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0829bcfb-d0db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829960, "uuid": "766c1c10-0190-4b85-bf0e-bebd626641e1", "comment": "Malware payload (Mirai)", "value": "f0e0edbf1aaeba7eeaf0f13994d06477", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829960, "uuid": "91b3df46-cd81-4558-aba9-569b43b14972", "comment": "Malware payload (Mirai)", "value": "41fbf6953e62318371282e0b9cf6a1008a047a1d84c6fff8e155dbe215d546ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829960, "uuid": "f3eda6c9-aaca-4ddc-831b-7e926d7a2921", "comment": "Malware payload (Mirai)", "value": "3112d16c2cb3c0693c9b32232c1e51221a6c6cbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829960, "uuid": "5e34a273-72ea-4cf1-9c8e-dc526e518425", "comment": "Malware payload (Mirai)", "value": "0e120fcb45e48514e0e02b473a09bb5c8016b092e026043bc9a4e88f5b423a3a31adec645947fe71f5a7be472c549364", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829960, "uuid": "56dd1e09-0197-4bb9-880b-9024ed89fce3", "value": "T148F33A46F6418B13C0D61775BAEF420533239BA4E3DB73069928BFB43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829960, "uuid": "a84b152d-b532-47d9-be73-d34d8152c954", "value": "3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6MjCHDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6OCHDj1M/9V03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829960, "uuid": "5e702ba1-11cb-42ea-923d-9428a9396af5", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829960, "uuid": "882bfb21-64b1-4945-a45e-544098dc97af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829960, "uuid": "719a6a1d-71fb-4b57-8585-321fc530bb1b", "value": "ub8ehJSePAfc9FYqZIT6.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b79719b-d0d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Hailbot)", "timestamp": 1764828489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828489, "uuid": "0780ed55-f8c9-4037-93ce-ae5987af6b7e", "comment": "Malware payload (Hailbot)", "value": "0ef7286804cab74d394fc5f2d08f77a3", "object_relation": "md5", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828489, "uuid": "3e418cae-aab4-461b-94fe-ef76c6d326af", "comment": "Malware payload (Hailbot)", "value": "426d84fd6dea5e277999691fd2c0e0b3f65747ffe309d2437ed8983bc3c2da92", "object_relation": "sha256", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828489, "uuid": "3c40eafc-09aa-4ff7-8be5-6b1092101457", "comment": "Malware payload (Hailbot)", "value": "8f0a00e5201bbe0243f62af08281505e5c842228", "object_relation": "sha1", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828489, "uuid": "e30e2dc6-ab0e-4884-950c-835d334dc176", "comment": "Malware payload (Hailbot)", "value": "aee905b9901f1841b88b1f49ca3963ddb681b7232efce7fe98c631820256d1364ca5bd66f89b0bb978422e0552d1821e", "object_relation": "sha3-384", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828489, "uuid": "dd4dc275-4ac2-4c50-8255-1758952d2505", "value": "T14FD097E62863083BCD44CFABD37310E3354AB883A81072CA31B7C302DE6C3A07B0A185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828489, "uuid": "e98fce43-9bfa-43ca-9ac0-5547eab00cad", "value": "6:hx6eGrl49KGKwz8JnoafaI9uN5tKKuNYRE:nP9MJoaCEuN5tRuNYRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764828489, "uuid": "71139f96-f325-413c-8bcb-3b5489b3ff51", "value": 249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764828489, "uuid": "ca96f9b0-6d7d-46b3-862f-99712015af98", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828489, "uuid": "bcda0892-aa10-4a68-bc48-bd264e12d3fb", "value": "massload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2979a2-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880862, "uuid": "f7507db0-286c-46b4-a880-3c78807496f0", "comment": "Malware payload (Mirai)", "value": "3a6585e7b49a83214fdff142c496a37d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880862, "uuid": "cdbaf41f-ea5a-4133-a356-48f48c8fc9db", "comment": "Malware payload (Mirai)", "value": "42818e9c2e20c3c288a02e3eac4e4ec813e9f48470b652606e0c7bd9f97b1f39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880862, "uuid": "2d643a73-9931-42ef-85e3-752ab23fbaee", "comment": "Malware payload (Mirai)", "value": "ce5d72ef6e6f22bb3e301a6d4921bccd78c3776c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880862, "uuid": "b2679b4d-bab2-41cf-b5ad-856e8e32859c", "comment": "Malware payload (Mirai)", "value": "aa02edb8c6425f10ac24b3fe22aa2f44ad16b40305ed7ba48542c5719b893d6e1a8a6e71633950f9dfff6700e546bf3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880862, "uuid": "27a75adb-73a3-4642-accd-4707e5f5b04a", "value": "T138C33A46FA418B53C4D51B7AFAAF41493322E798D3DB730689186FF43F8666E0E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880862, "uuid": "8d52057c-5bdd-4b05-a980-461eab96f75c", "value": "3072:SJkHK8uzHYhlKgZPqRJd7qNl7K1+b2L8M/91ce/:skHK8uz4hlVPqRJd2NJb2wM/91ce/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880862, "uuid": "aadc2db9-9b5e-4a29-bf32-701342edc595", "value": 128096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880862, "uuid": "4e1fadd2-420b-4e86-a839-9c6099203230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880862, "uuid": "0da03c08-58b6-4235-a480-3fa2771a17af", "value": "DEMONS.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc2d4a2-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834348, "uuid": "4782adc3-0a93-4c08-9d80-ecb9171f80ff", "comment": "Malware payload", "value": "0340db1ef82a5f88f063aa3c7faf6613", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834348, "uuid": "6bd9bc40-adb8-4e9a-9aa0-b29230401d74", "comment": "Malware payload", "value": "435e2d158a050e1d1f11f30384655deb3cb3df85d9204a11daca225a57e2e9c5", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834348, "uuid": "5b47af74-f177-4eb7-8dd0-eb053623ac6c", "comment": "Malware payload", "value": "0222f3f0e1fc59143f0db432d1275931510b7bd8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834348, "uuid": "79931d24-91ff-4942-876e-31bbd379f6b2", "comment": "Malware payload", "value": "311cae629dd734136b2b9ae7f1bb7bb4d4204fb2cec427398bac383c5cf768d9a817542f6c4725cf3d4f03ac5c2049f5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834348, "uuid": "d6be5010-84c0-4d6e-a62e-6a6bb471df80", "value": "T11E6733A0730DA91289C19F78207DEDB078B6B14C6B9B056B5D82FD6B4CCF2754E8AF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834348, "uuid": "a3d1424c-2e6b-467b-af75-d1dbec95245b", "value": "786432:7qbG0mJoOWwXP+A5yvfqbG0mJ2mJpNKB5wY3E:l0eolE35Q0I2mnEwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834348, "uuid": "db34fa84-b28c-4ca0-b757-295d3c506e6b", "value": 32533215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834348, "uuid": "b3e7f5ad-7f1a-45e6-8aad-cf5ddd8049b5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834348, "uuid": "24393303-c483-4080-9e9f-7ac82434b604", "value": "\u8840\u96e8.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c3afd3-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829900, "uuid": "be48253c-0b71-4994-8b74-fad95cdb9ac6", "comment": "Malware payload (Mirai)", "value": "8d9d938cf6c433f56f6459cc8536ae16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829900, "uuid": "1058eb55-fd0f-415f-98bf-6df1af273a0c", "comment": "Malware payload (Mirai)", "value": "436962fa88d60ef9cd91886d4fa31d8868c72fca45eea552d9a8bbe5a30fb3a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829900, "uuid": "bddea7c3-b2a4-4b35-b877-50ba080bde52", "comment": "Malware payload (Mirai)", "value": "7d992925cccce845cae49e1c2fe8b60685f18398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829900, "uuid": "e10faf25-866a-427f-9a1f-2fa9f41f8570", "comment": "Malware payload (Mirai)", "value": "7f9b32ed1642d19fc9ffabd562ddd4f8d1d3bbb8806bc46e911458bce49af845568cfaf853bcd0f1795865d807489ae5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829900, "uuid": "c5f4f28d-76b8-475b-a6fc-f9fcd9bc86ce", "value": "T13A03E15AE5A0B05EC91F2C3F628911BA0990F1D5B14A3B3B5729CCC5AE3794FD48C8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829900, "uuid": "de8951a4-4f0d-415a-af94-8c9d84fd9c5b", "value": "768:CF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0FrzWW:El5JnsrXvrKy9QjyBZLvDmR0Fr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829900, "uuid": "b8622a3c-8fbf-44c8-9626-725b829c65a8", "value": 38640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829900, "uuid": "3d79511f-f033-4e1a-aa42-0f7af56bdd4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829900, "uuid": "737b9c4c-9d63-4633-957f-9524d0a7a47b", "value": "ub8ehJSePAfc9FYqZIT6.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077f90fe-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764878921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878921, "uuid": "e67a88a1-de37-4228-9118-6b0d7620ebd4", "comment": "Malware payload", "value": "2fe36ea173eaa37fb915c956ce30ec50", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878921, "uuid": "8e2542b4-b3cf-4cf5-8afd-c361b6d881ce", "comment": "Malware payload", "value": "436e57a5e2daf1c5b4ece8851a7b7517c1fbc9e69acba8fac3806aa160f251b5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878921, "uuid": "ad3a05e2-ea38-4954-967e-708f42e1b72a", "comment": "Malware payload", "value": "bdc7f127d318a27cec7ab992430cbc22de6cee32", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878921, "uuid": "ffa32748-e145-4f49-ad53-be4b20188c1e", "comment": "Malware payload", "value": "43edfe6de2aa3b8967acfde358d50123a0f5270decd6b7ebce9398863092a90c4d54f5dcad867233289f2141eb285448", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878921, "uuid": "12e4bee0-9124-4bb1-b14f-5875cc17ba43", "value": "T1EA253330348293929C879AE47F190B39EBC7478DDDB556301BFA7B70E68A61CB631271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878921, "uuid": "a91ed4bc-3fcf-4a3c-b60b-32c44925ecb8", "value": "24576:rdp/HgYq+SvVIOiyOW8p45sxaIPgUB4Lbj13REQcBuXgHVWd:rfHgY7SvVFy4ybTBOlREQ0Cgod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764878921, "uuid": "9fcf435d-078a-470d-8c69-d7bc3e64bce5", "value": 979690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764878921, "uuid": "b91e079a-bbd5-4b8c-91f4-b6dca3856709", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878921, "uuid": "0f6e9958-aa4b-48f3-8933-5c863ff62368", "value": "MIWIFIRepairTool.x86.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa9bed0-d12f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764866426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866426, "uuid": "98ebf701-a062-470a-88cf-eecb94dd9ace", "comment": "Malware payload (Mirai)", "value": "ab002f707af9a4054c0fcb4e5fa22a68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866426, "uuid": "d10f55de-88e8-4bdd-80ee-733c6d012266", "comment": "Malware payload (Mirai)", "value": "43abb0c9f2b7a8f8ff5abcd3135ef027129fe69dc0f63d8f352883d079f897d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866426, "uuid": "e4c57ea5-58f3-4483-b395-b74a72260933", "comment": "Malware payload (Mirai)", "value": "881c7b2d7891adb1196f68f8a666e746d031380b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866426, "uuid": "7dfa075e-45b4-4529-9022-ae083b17d11c", "comment": "Malware payload (Mirai)", "value": "09de67446518da04ddd04f02217615bbfa229abdbcde646d2b8f0c84385736ab4f4615499085e0cd4dc1c8ea6b8f4f6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866426, "uuid": "342f966b-bf89-4c61-94b9-e71db89aa95f", "value": "T10AE3488CF68BC1F5E8074970A066B3FFCB32A47840B2D65EDF99AF35CA235419616358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866426, "uuid": "6c0dd461-6c24-4954-8ffe-22a0f8a93160", "value": "3072:FUSe5pBZUf5e0b2O9aA6d7XEjYlfJnXVl2F3tlj:FUpH7q5db2O9oRuFdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764866426, "uuid": "b61602c7-5836-4d78-a861-9a12628b34a7", "value": 145772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764866426, "uuid": "7605b413-324f-47d9-b3e0-6e979d6b8394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866426, "uuid": "e88a5bbb-e01e-4557-be08-9634ecf74431", "value": "Polar.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebebb6df-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (HeliBot)", "timestamp": 1764829053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829053, "uuid": "0be7e357-5aa3-4576-8fea-92e5ff0e81c0", "comment": "Malware payload (HeliBot)", "value": "beef080ac09c51e44e5251ada2e1d62b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829053, "uuid": "1e427275-5ff2-4f29-a657-9de3826142d9", "comment": "Malware payload (HeliBot)", "value": "44873dc0fc06e0cae727f357cdf61d79b92f08d01506a5e5a9802c85ac771034", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829053, "uuid": "7c0d2e04-9229-4a44-b098-7f388ddc0770", "comment": "Malware payload (HeliBot)", "value": "2a0f265a180a0d96094b951534bf81e5f8f59def", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829053, "uuid": "9246e551-8607-4df2-bc13-d25691be97fe", "comment": "Malware payload (HeliBot)", "value": "2f8ee324641cd072b1b2e9ebc7f4f814fa2c7e43e82818e9263b064706aac84dc3d51c9db8527841fc594341307d73d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829053, "uuid": "3e63ade6-80e3-41c9-a4e7-889a68a9e53c", "value": "T1F6A33802D5508B57C1D2177ABB9F426D37336B68939B3321AA247FB82BC279D1E3D121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829053, "uuid": "7f0bc88b-e54b-47e6-9bae-0001337cc3f6", "value": "3072:24obK0vGayP+wlgGmWrkzMPE+mBQO/IXZFW:24o9Ga2lgGkkE+mBQO/OZFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829053, "uuid": "49efc37e-4461-4d2e-a083-ef90569ab988", "value": 106529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829053, "uuid": "c1c7c104-02e8-4150-8183-ae76752513f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829053, "uuid": "0abb3435-8d04-48c6-b051-74d8c1814fa0", "value": "bootingworld.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce3ebd7-d0a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807983, "uuid": "b56f8100-dfd5-4c89-87fc-9daa0606668f", "comment": "Malware payload (Mirai)", "value": "ecd7d3e5bded17964f071763551d8b35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807983, "uuid": "faa8c95c-21d4-437f-bc97-2c84a73aaa83", "comment": "Malware payload (Mirai)", "value": "449a2fd41cf4dd7d78d0d1088a976591e10c375bc88bbde6a554976602a0fa8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807983, "uuid": "fb7a361f-2839-4657-8156-9e7e4cc2c247", "comment": "Malware payload (Mirai)", "value": "04421905c43f09be7b6868136ea6c879bd918305", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807983, "uuid": "1dde8966-f3dd-40e4-a55a-7525bee62246", "comment": "Malware payload (Mirai)", "value": "09e0555b90dafb9e19a4f88fb5f45981a51c02e1f240c89fc9bf29400a576a499ba47d298f4113b737abca8af669f445", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807983, "uuid": "50d72f90-f964-4826-a7a8-6b7dbbe4a027", "value": "T167D3B44D6E318F7DFFA9C63487B38B21974923A622D1C585D1ADEA011E7034E245FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807983, "uuid": "b8a1c867-c0ee-4dcd-84e1-9dad43172d2c", "value": "3072:vJP0fbMP2+CKSGsQM60DgjyWG4dqRH7cko9:p0fbMPDCKjsQM60Dgj9sNcko9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807983, "uuid": "1d34ff87-d3ad-4332-ad21-24676770ea19", "value": 132328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807983, "uuid": "e52e5e9c-bfd2-4ad5-8c74-a7982e410557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807983, "uuid": "cfb58cb0-5260-44d0-9364-fc3672c75df7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85630f3a-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764831029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831029, "uuid": "42e72fa3-edc5-424c-83cf-8148251afd6e", "comment": "Malware payload (Mirai)", "value": "1df8e1f69ed253f3b6e36164defb382a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831029, "uuid": "fc0e5968-f64c-4e8e-a3c1-fc6486c63939", "comment": "Malware payload (Mirai)", "value": "4543f33125d0623caf587df3b1d70eeea9ba8b14fcc81cd75ebf3d803c560d86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831029, "uuid": "cdd9ef48-ec2c-42bb-87e6-2e568a3adb01", "comment": "Malware payload (Mirai)", "value": "d264d1e09ffec518f436d7a972ed0b4b8d75b21a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831029, "uuid": "450c86be-44b8-4a07-a434-49bd859f8a75", "comment": "Malware payload (Mirai)", "value": "b14324e7da126c0462316adbfd41b586604bd4a14a3f05523ebe20d085ffd795bc926af268456b680732db5a2298991f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831029, "uuid": "d1374852-0df7-4dfc-9f6a-b0cf88d32a43", "value": "T12B935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831029, "uuid": "2c657994-1516-48a1-917b-39da46b35fa4", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3ayPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKKifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831029, "uuid": "0142776e-e466-4bc1-a6bb-70c293dfe33f", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831029, "uuid": "cbfea4e0-cd17-4300-842b-f50f4bba1fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831029, "uuid": "a1a1d806-6e32-4535-8b84-23358ee26cb1", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bd2631-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764870629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870629, "uuid": "26171d7d-002f-4025-9b82-8e6b934f1151", "comment": "Malware payload (Mirai)", "value": "3b5074a51bdc078bedc4d2f0e6e1f17d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870629, "uuid": "cf644dd3-1220-4eb1-8b1d-dd578cd3071a", "comment": "Malware payload (Mirai)", "value": "454471179a4597a4b1ad3fc46c7a1a5a39f1b9246f9a284d9e42a869215dcfd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870629, "uuid": "61e28b6f-e441-4794-a25f-e98fa00be831", "comment": "Malware payload (Mirai)", "value": "e25769cb700caa520966a05a2d89d82ef18c4180", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870629, "uuid": "ad24c041-f0cc-4b2b-85e8-b91188db5b5c", "comment": "Malware payload (Mirai)", "value": "8d80096c74fc343cac61db38c885e8c590a46e1a6bc23f75a9fb8ac14692512fa24b2da60554f72950725a07632e41c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870629, "uuid": "d8985c25-16cc-4ca1-9697-6cb06d802f65", "value": "T16923F1AFEE44E8C5CD9C7971139C16926D6821C13A5DCB9EA35D0D8086B720239EF2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870629, "uuid": "4e3bd6c9-3c8e-40f6-b41e-b3494fe3c685", "value": "768:I5iXeMKbg0d5hMDS7V2tEvdZyeQli3KeEciYAhM9xe7Gt+yE832Z0G5BN+08tFGj:HXeZh6DSJLZyvlOPma46cyNKHV+00q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870629, "uuid": "ab2e2546-394a-4870-86fa-00fce82a01ba", "value": 46756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870629, "uuid": "0504f082-c3f2-40e2-8682-4987d97dd0bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870629, "uuid": "fbb67132-a685-4945-a4ed-265cce3803c3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82dadef6-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764879128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879128, "uuid": "14128ea5-b2d2-48f8-a13a-bdd2b578e5bc", "comment": "Malware payload", "value": "4dcbc07ae4c2c0b76b331a3a5cbc6927", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879128, "uuid": "d54876cd-2d98-4d81-bcd2-ea2eb9512a9c", "comment": "Malware payload", "value": "4575e0e7c46b44ff7e6873272cfce608df85fd8867bc262a1a72e8327c144d98", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879128, "uuid": "af31d41e-a374-4440-8f62-74768afa59ba", "comment": "Malware payload", "value": "57839343784c92371ce62b5ea1074301b51e11fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879128, "uuid": "0a83e392-4c2b-4230-bca1-c41b9c30390b", "comment": "Malware payload", "value": "3f604abf46013568cdce12e907c36ad0f0073c749a81baff1ac806003016631d32f9ee6647e9d0e8b36ef83a60574dd5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879128, "uuid": "567776bf-74e2-4859-b50b-eba577f48036", "value": "T136F0A0531097214A6E2BFE1CA22963F571069CB4AA90013DF6ABED52CD7CE32320A468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879128, "uuid": "8d63bbff-5743-419b-a371-57b23ff186e3", "value": "12:5/qKwNVlru2yDl/pBlBgf5DoaZMwH1sP8v:kKwpurh/fgf5lmwVsP8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879128, "uuid": "f4e08b42-a064-4571-a0da-2c7d79b650a9", "value": 456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879128, "uuid": "912f25a1-87e1-4ae2-9f2a-13fb3b1c2704", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879128, "uuid": "2b291b50-b423-427b-a91b-5272034cc364", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25006d0a-d118-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764856207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856207, "uuid": "13028051-2d5e-46c1-b8ae-36edb2e98ee7", "comment": "Malware payload", "value": "ef22eb4e87f4f312a734bbae7da1831c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856207, "uuid": "a676bca9-2dd5-4f61-beb8-3efc1a72b745", "comment": "Malware payload", "value": "464b97fc61b3df70c20552e03373f8b8b460e2028731114a1a1245c48e59a31b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856207, "uuid": "6236e62d-0368-4ba5-a949-4298bb8cb881", "comment": "Malware payload", "value": "460308aa084213778b476dae8890fe3606d0f961", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856207, "uuid": "6d3e0dcf-e238-4035-88bf-5dd3d04b503a", "comment": "Malware payload", "value": "43401787a8384600aa3e214c271bc6329f2cc66ba8e09f2db33bf10c6a4e172e18f860c344d5aaba0669e24754f74e66", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856207, "uuid": "ed1f822e-b213-4d19-997c-def59c5fa615", "value": "T1E1717B5027E85505E1B97E3EECF953128966B941DD72C93F4870820D1A54603DBFBF36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856207, "uuid": "f36bcc4f-9c0f-40c4-8450-76fbaa773807", "value": "24:8gGw2J23tEqCMCUD1p+/C+ikBdF2Qkj8lAdEOf9dFrlzYYT/sL6UzormADnF9g4b:8g1d3KGLXj5dplxxIv8mxX50I0axr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856207, "uuid": "2c88e693-dc3d-4820-9132-eb6f78904612", "value": 3553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856207, "uuid": "0c80c3ba-a990-4f2f-b70c-de11ad0bf475", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856207, "uuid": "d975a45b-4e9c-4d91-8b2f-3a00ff119220", "value": "MOLVGSVTTSZVMV.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b5737d-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764829041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829041, "uuid": "2250896c-8981-4436-9eb4-f7674b68510a", "comment": "Malware payload (Gafgyt)", "value": "bd3c970eea9e2a0ef5c9178d0f54a9ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829041, "uuid": "535ebcf6-ef3b-4570-bf20-e71a18af9810", "comment": "Malware payload (Gafgyt)", "value": "46c4b7833b6b70391c2d8dd1b9dddb9a650569c7af6ff926cf692600c5f0566f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829041, "uuid": "6ce791c3-225f-4644-bc19-2de88f47b70c", "comment": "Malware payload (Gafgyt)", "value": "3c1713dcad3e2a761e0ec417c2f9b6bc8512a77c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829041, "uuid": "09b0da3a-1232-4e59-970d-6786724a1464", "comment": "Malware payload (Gafgyt)", "value": "8fbf048e157eb1ac424a9a253883c413b04eb684931ae5097dfdefdf35f0e70372c26d2eab6edf6f557bd5b83101d594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829041, "uuid": "b68f2871-fccf-4f40-af02-54511f649f8d", "value": "T1F1933A277B230E23C0CA557112E30331B7B5D74938FA4797BAD16EAC2F16A8439167E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829041, "uuid": "6bdeb6e3-9706-4b0c-b253-5f8b771d5ac3", "value": "1536:D5JHzqN8qKmtxa5Fet1wdcdsH33mX0Gq4/cOf3Tj:aNbKm7qFIwad633mX0Gq4EOf3Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829041, "uuid": "be2a2ba7-a5fe-45b5-bd0f-7676ae731d68", "value": 90411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829041, "uuid": "9009c91a-edc7-49ef-9ca3-c39d3d51b7b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829041, "uuid": "5e814e95-05dc-4692-b1bf-fdab2b9f52ec", "value": "bootingworld.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6634f19-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829071, "uuid": "efa806c6-f2a7-476d-93c0-79d43fff215b", "comment": "Malware payload (Mirai)", "value": "4c0bbc50646c87442a173121e2af06f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829071, "uuid": "b8b5f882-2ff1-4eac-a98f-a2a16171bb2f", "comment": "Malware payload (Mirai)", "value": "4757eb17b86dad8f628009c2ad874d7ff8e80900c45b9155f33a4a27ee011e6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829071, "uuid": "9663869c-63f7-4792-97a0-ca9765b7da11", "comment": "Malware payload (Mirai)", "value": "7cb02eb0c92b280018980d54d116ffd13224dc2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829071, "uuid": "ab4ffc1a-bc29-4391-a347-6eeed7b6352f", "comment": "Malware payload (Mirai)", "value": "e30202ebf2c7379bfe6d480e95cf0009241124fbbf3e2023a2106d5223daf8abadb83a21e7d84c33bbd8495d7b384c0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829071, "uuid": "0af258b9-af7d-4452-89e3-343cc52b2580", "value": "T1DA03021B31364666E85BA03C01DFB14B281485ABB80799F17DF44837E7ACF04AE7D257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829071, "uuid": "8208c113-6a9b-4e77-8cba-be1aea6da21b", "value": "768:xgQcD4ioAAYVyCH1DIQcjxDyELLLl4bZZxOTOCZVf0FZnNJ4zm7TnbcuyD7UHQRN:a6diVlth2xDNLLLl4bZZxexfzzYnouyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829071, "uuid": "50190d8d-e52b-4b61-84d1-3a3f61eace7f", "value": 41288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829071, "uuid": "bd025b96-bc78-44b3-b14b-58fc9a8e72dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829071, "uuid": "8fd05c58-304e-4815-830f-353544a13f97", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a01332-d12f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764866379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866379, "uuid": "d81cd1a3-0119-40d3-8e89-7cdc75d6853b", "comment": "Malware payload (Mirai)", "value": "43e56f7cc307e9b74063df4ab568ab72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866379, "uuid": "633f02df-45dd-498e-815f-9c9759b3d275", "comment": "Malware payload (Mirai)", "value": "47b0a3737f2f2d883517a4e1d993d46df24003b94ccc219362feee6c401fa1e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866379, "uuid": "55516b4a-1841-4ffb-ae9f-da30709a7d98", "comment": "Malware payload (Mirai)", "value": "8cf1fc606e5b60747135346e71a332d0fff8fa93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866379, "uuid": "f9e16de3-0861-4461-a215-685613223bc5", "comment": "Malware payload (Mirai)", "value": "96263da5ffbf079425a954b4314f6db74258479eabf47ca5d389cdf88d14ae77e1ec0caa35aff566c490ed7221a1a882", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866379, "uuid": "11d696a9-cf04-41c7-9179-920da4907cf8", "value": "T1E443F204A6F1A740ADBB02762CC7569A08878313FF65EFD34D6DED066E28E9147349C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866379, "uuid": "084be2b3-4baf-4c5d-9fa5-05f1da9325e6", "value": "1536:TuTxXK6JFGpLY7mb/sloTX2cr2/MMfISDY718J/9Unouy8Hyi:ilvJFGp8K08bC/MMAwU8JFkoutd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764866379, "uuid": "35d9b027-146b-4fb8-a868-b45225781ff7", "value": 58904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764866379, "uuid": "7c22a411-40f9-43b1-96da-0906b33afd83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866379, "uuid": "a557b45a-94b6-4cb3-a56b-e275d26e5f1d", "value": "Polar.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d07ec8-d134-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868280, "uuid": "bcf23729-bed5-4af4-ad72-6e65c5ea9c65", "comment": "Malware payload (Mirai)", "value": "9696b434cef6e18760770e1d3ba9874e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868280, "uuid": "ebaad394-2f0b-4bcb-b394-394a61ae980c", "comment": "Malware payload (Mirai)", "value": "47ec0403042e9903bccce439cb96049d9cde2c49bd4b2e59154959c0069fea4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868280, "uuid": "56e4d0d1-aefa-49e5-9d57-c975ff992081", "comment": "Malware payload (Mirai)", "value": "0ac2deaa566360e8b78d69f9d82f29aca490e0b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868280, "uuid": "c35ce2a8-219e-4a55-a6a7-752547369286", "comment": "Malware payload (Mirai)", "value": "e0b74372a51efe6d343f15d2561cdee9b8da79df12eacb3b30679f053d8cf393fed3a1d8171ffc88e10a14f00e27cc0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868280, "uuid": "91cb5a22-98b6-4064-8ad0-9f801c7741f3", "value": "T175044C56E7418A13C0D717BABAEF4245332397A5D3D7730699246FB43F8279E0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868280, "uuid": "3f986540-9b9a-4eb6-8d73-aec50821bd45", "value": "3072:GxktOitbO+AAagk4B/YnGswmhsIXakse1+XUnPM/9CY3tZ:sksitalAagk4B/YGsvsAaReUXUPM/9C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868280, "uuid": "21c23bbc-fb0b-469a-ac71-2ceecb98ba18", "value": 180727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868280, "uuid": "343eb84e-4dcc-4305-a315-4ffe600b1860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868280, "uuid": "a12dd0e1-9f84-4576-9027-7655f5b5b271", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d86f81-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883047, "uuid": "a7e879b8-e93c-4542-9e81-c1a8e73d1aa7", "comment": "Malware payload (Mirai)", "value": "2c1180dd5c60384156c024019e87a47a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883047, "uuid": "ce10313f-ec5b-4157-8eb3-868307ce9b6e", "comment": "Malware payload (Mirai)", "value": "4804240c1a0547c1b2a11e020c87f27cc86eba76ab724c536bad0b3afd8b0fae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883047, "uuid": "0bf4affe-5097-444a-ac61-634aaeb80232", "comment": "Malware payload (Mirai)", "value": "a9f91d8e44e96114a05c210eb6c457f285b86508", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883047, "uuid": "b244eab2-29ed-4a70-b041-3e9c47f657ca", "comment": "Malware payload (Mirai)", "value": "f61aab37e3522eff2c8e0b47076b5043b56f1e81ca3b23c4ced9c098924673c7430ae32cabb10892f3909b836986380f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883047, "uuid": "99a7c59c-7173-458e-8c0f-392c2110fee7", "value": "T191B3123BBD255972DA719372AE880B41F1410C7CE0E572BA7C700B0665A5B887C7DB3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883047, "uuid": "04270780-0a00-4b52-ae3f-726db277a8ff", "value": "3072:nzxSvngbsVNE/MJwnB6mYyLf5L1tDQMppLBS:zgvngwTCMJwnWyD5L1zppLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883047, "uuid": "21bea4f3-e4f1-4388-b20a-709bda75a118", "value": 110284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883047, "uuid": "41f1cee7-5fcc-413a-af32-2ed15cb868a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883047, "uuid": "b71ee8b0-929c-4389-8158-8082cda0fa07", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d193c603-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834163, "uuid": "e99fe5e8-eb0e-43fd-8060-7331c332039e", "comment": "Malware payload (Mirai)", "value": "5114a1c3f5908c63a2407b7ab46006c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834163, "uuid": "0c3af543-41d2-4273-b5b1-a24a9f81c3e3", "comment": "Malware payload (Mirai)", "value": "48156032977963c4cdcdce60b43574534a23e56cdb5f3f5d551e59058c1def71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834163, "uuid": "69c38ded-fb10-4303-b162-8cf50b1d971b", "comment": "Malware payload (Mirai)", "value": "066d9689203b4238b195b99d28ea1736ee0f0584", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834163, "uuid": "9495aaee-acfa-405e-9fa3-2ab2a473bd5c", "comment": "Malware payload (Mirai)", "value": "61f34b419f6c8cf7fcdcac6c185ecff82ef12fd06533f30249d1e48a0ed06e345dd9987faa74e70490e780bdd884aa26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834163, "uuid": "99e94d33-87a9-4c88-a8bd-ebddcbd4ed76", "value": "T1EA333A4332280A07F5A65EF0BD3F0BF083BEE99125E1B184654F9B564235E73188AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834163, "uuid": "ed056f5a-fe4f-4c78-9ea1-963998a30158", "value": "768:ffQOM1vLx13THWDKlRE4hs3fU+1z3YDnBm6g94zHdsYVyKlRfWXXfiS+AmOz:mZLx13THMqfpT9mDWkGRuXq51Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834163, "uuid": "f6c56ce8-fff7-4030-9126-526f01cdb4f8", "value": 53164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834163, "uuid": "c7a90a7e-f32f-43b5-8b6d-317311b65920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834163, "uuid": "97eda664-f0da-43e5-96b8-8b89980d78fe", "value": "DEMONS.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534aa54b-d0cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764823643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823643, "uuid": "94b9211e-c441-438d-ad5e-5ac52982e675", "comment": "Malware payload (Gafgyt)", "value": "ad5002c06a377cd265b081afd6946700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823643, "uuid": "2ff26f70-fa76-44ed-bed4-f43e45b1ee37", "comment": "Malware payload (Gafgyt)", "value": "485600a97866207f946d6552fc71bdd876d7466ebe3f7c832c52399f538bcd2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823643, "uuid": "fca18c00-f74c-4b9f-a261-40dffbc6acbc", "comment": "Malware payload (Gafgyt)", "value": "7599661ee727fef480e061edce3771b1c62573da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823643, "uuid": "e536e724-0e82-4753-9642-b6612e8b12a1", "comment": "Malware payload (Gafgyt)", "value": "479f1e1a374eb9c046a51c23ddbb034e864b7fd10ac1df1b7fcd270f34893ee91a6d5e040c5affcb1e034d2a461a1a38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823643, "uuid": "423c8b7f-a074-4685-ab63-c12c04d1434c", "value": "T15DC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823643, "uuid": "e64f989c-3a68-4fc7-aa95-4ad982df31be", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeREdWfRZrmW+IFj:Ted0W0MZQHBd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764823643, "uuid": "6d2055b1-c66f-42e8-9d95-79d3cc57f2d8", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764823643, "uuid": "9ec0be11-c077-4572-9ef2-a17c436299e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823643, "uuid": "470112d0-07f9-4480-b947-4711aa36c245", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cc1461-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764875216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875216, "uuid": "f01e7183-e464-464e-9938-66e278ff9c1a", "comment": "Malware payload (DonutLoader)", "value": "8d49293d20fba985a8db9e27e0519b00", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875216, "uuid": "8ac284f6-772d-4bb0-861f-a931a6837ac9", "comment": "Malware payload (DonutLoader)", "value": "487b6acddac1739cc3a60cf049c4c33fc6b90df631f71b414775e3c83661afec", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875216, "uuid": "aada3e0b-489c-4d11-bc5b-277f92b002f9", "comment": "Malware payload (DonutLoader)", "value": "921f90b9e96112d457efc92325afcdd638d72274", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875216, "uuid": "717551fd-e5dc-4fac-8af7-b3edf6825f0e", "comment": "Malware payload (DonutLoader)", "value": "c9d7fd941f8abcd149c04f3db317ce6620f7792cbd98a68cf08f44c4de71587eded200387e9277f51095b007db0a067e", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875216, "uuid": "15d97c20-48a6-448c-8f76-ea65f6115fa2", "value": "T1CE548D15BAA810FEE977C17CC9428906EB72BC464761E7CF13904AA62F277D09D3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875216, "uuid": "7a59361c-cc80-40b5-ac42-e7ddae152d00", "value": "53e19d5243b4f25d48df742c8d94ac9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875216, "uuid": "65813d3e-b494-4677-9b9d-63c286a68f60", "value": "3072:ufRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OlhCxFUo:ufRbGY6EDNNAuHe28Pl2ncxlUvR2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875216, "uuid": "1bc45a7d-964b-47e1-ab52-f6b9ecb1915e", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875216, "uuid": "e5c08816-4757-40e2-a4a3-4cc0d66f7ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875216, "uuid": "4943e895-4a70-423d-a9b4-be405689cc4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a120e30e-d15c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764885621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764885621, "uuid": "119f8e04-bba1-44fe-849b-ca0f9833685e", "comment": "Malware payload", "value": "d4ed6eced759bad5757c5c0bda13d878", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764885621, "uuid": "5eb1635e-48ac-4812-9396-4c56402f425c", "comment": "Malware payload", "value": "48b9f78899b8a3daaeb9cbf7245350a6222cbf0468cd5c2bab954c8dbbce3995", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764885621, "uuid": "0cabddce-9c9a-433b-b96b-2bc383d52390", "comment": "Malware payload", "value": "a4a5aedec4e5c392d0c12ca774d92fc747187c5f", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764885621, "uuid": "094c078f-1e56-407c-94fd-426f199774ed", "comment": "Malware payload", "value": "47f89f4a8d5e320595d53c63bf9de276c6f177c7093552217b77d593797e7c09e49e72138620bffbf6093548a300061d", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764885621, "uuid": "33492982-dc31-4221-8cf6-997d2b8de51d", "value": "T132746D87BB857CFAC216823889AB83753334F5E013535F274964F7321E66AD0AE87527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764885621, "uuid": "ecfc7395-e9c7-4893-aa2b-16ddb59ac845", "value": "64be7641a660f28b6d53e98b0bb9a5e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764885621, "uuid": "a0ad822a-30ff-4876-924d-24afdd793fcf", "value": "6144:p7IXkiikKaUAR4IhcX2w2TckBHUWq+9yN86IpKIGlAvZq2qB9S99NpNNYOlZCKb+:snwX2w2w3tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764885621, "uuid": "1365d85e-4fa7-4b6a-8932-988e5e0a0d2a", "value": 364611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764885621, "uuid": "c2973f7d-4bdd-480f-a2df-404e497a72d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764885621, "uuid": "aa26e361-f132-4059-864a-f9cedd7093ef", "value": "s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e233a34c-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875423, "uuid": "4befc6d9-0392-4485-8161-9c04b7076bb7", "comment": "Malware payload (BlihanStealer)", "value": "39f949de799675f617480a1d61759c6c", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875423, "uuid": "4ba01584-1123-488f-a07d-4b71362469f8", "comment": "Malware payload (BlihanStealer)", "value": "4a292ed98d130e690a4ce0aa61b9f150a0406d9b6b96440557f4bf5ba7f0bd4e", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875423, "uuid": "1498c3db-6f13-4bcf-b7b9-b968ebb940ec", "comment": "Malware payload (BlihanStealer)", "value": "b56d24aa262ea74c17198aa4b41ed6156d6a99d5", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875423, "uuid": "65b9bbfd-9b85-4c21-87f3-d9e535b5bb96", "comment": "Malware payload (BlihanStealer)", "value": "caea52f553bd49b212927e90af8eb2455a887f29c01133b69005b09b0c36ba7ead1779c598881cf16e95c869f6490ea2", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875423, "uuid": "c1083003-0b91-41a9-8d58-b8055f148cc7", "value": "T145C3E7076FB1CCEBD841043A57BAA22D86EBBC440DDCE35687DDDC4634D2918C8AEA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875423, "uuid": "b00f68d0-b012-4a31-adc5-e4aac6c3ca03", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875423, "uuid": "7ed9414e-ec8b-4635-8271-2a72bae29fb2", "value": "3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKR:eene", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875423, "uuid": "41bf3739-276c-4ab2-9bc4-9fe1bed50ca0", "value": 127466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875423, "uuid": "e31f40e5-6035-4e49-9c58-a56d860e5163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875423, "uuid": "80ed4bc6-6c72-44e8-aea0-28a09dde7584", "value": "d9b6b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edc2257-d135-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868814, "uuid": "24e879da-25c4-4dbc-ad1d-a3c7aebce820", "comment": "Malware payload (Mirai)", "value": "bae146fc467433113e3d264e94373fac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868814, "uuid": "e1a1cdbe-71cc-401c-b948-28a1e0cd0783", "comment": "Malware payload (Mirai)", "value": "4ab42faf4a5e211a577f57b0ee5cd4883b0e272b385b660f33cd76286ef034da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868814, "uuid": "9b314835-47b1-4497-8130-81a27c4f8657", "comment": "Malware payload (Mirai)", "value": "0ec750bbbcce268a429f3c17d8c38e2f0c1abb78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868814, "uuid": "b988c390-b9bc-46d8-b7b0-73b01ed35e95", "comment": "Malware payload (Mirai)", "value": "4fa0f93b83fa1a3db443fba0e56ffa0e4dd8d85818e3b84a59c11d5c9ff720750c1217a75a5e8623d44e3771c5de429d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868814, "uuid": "83a1584e-455c-444e-b7d9-917deb5ed24c", "value": "T1F2B39D32C4156CA4D5954034B9E5DF392B23E1C093631EF71AE5CAA798A3ED4B809FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868814, "uuid": "a97b5592-ec45-4f52-8ad6-a5568ac68747", "value": "1536:m/QJyd3WjIYFYQLlUH4UVC7WuvChTRZKyMVpLLq5CK+3n:moJbjqQLGcWaSTRgywLq5Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868814, "uuid": "1fe9cdad-7919-484e-baac-ef37cd94df45", "value": 108256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868814, "uuid": "76dd0b44-b11d-4a9a-8050-4a81b4698e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868814, "uuid": "506f30cc-2db4-4fa7-b5d8-58a02fcfe8cf", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4f4852-d138-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869962, "uuid": "43f7c38a-f149-4734-a8bc-d8e2d13b50bc", "comment": "Malware payload (Mirai)", "value": "92012cae0d24cd383d29418aaea28c5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869962, "uuid": "04692689-53a7-4622-9fa5-26564b9803cb", "comment": "Malware payload (Mirai)", "value": "4b01cadae864cf243a42ce2778e8ad578dd594df6ded35e0302e5c57adb88fcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869962, "uuid": "536fba51-94a8-4318-a3c4-f31a318f70c7", "comment": "Malware payload (Mirai)", "value": "f2a0222647d4ee7a715ae4ca9b8f9dcb1fb5d526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869962, "uuid": "8f32a2ce-cacc-4794-930a-49f3342c5693", "comment": "Malware payload (Mirai)", "value": "6b49c53c0fdf7de8c8d88f8d917c35dfded0673b43d21eeb6865cffd9431462d0007ed2d8628aea9ae86d11475c4b799", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869962, "uuid": "db922f74-dbca-4df9-bb65-35cc8c9dfa19", "value": "T14FE3C50E6E359F7DFBA982344BB78E25964833D627D1C585D1ACEA011E3034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869962, "uuid": "8d22b317-c2ff-48c6-b629-609a56b0ef42", "value": "3072:3hjeVvmKYZNwwky05qRWfmheo09UqIF0QDXsFPuLCGvn5HJ85T5MfrN3hOXDgYvs:3cVvmKYZNwwky05qRWfmheo09UqIF0QH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869962, "uuid": "3db4786b-668e-49f9-b9f8-3651f97efa54", "value": 150132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869962, "uuid": "bd629c5a-07a1-49c4-835a-b6be2b754aa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869962, "uuid": "ddf99034-5cad-4a70-bfe8-5f54d58c6b94", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5122cc65-d0cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764823640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823640, "uuid": "04f14d19-4c44-473c-a945-c00dfaa788d7", "comment": "Malware payload (Gafgyt)", "value": "bc80254811c98b3ab7f9e1d48388edd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823640, "uuid": "c2fc1eaa-3e00-44c0-8349-26ab8b41c873", "comment": "Malware payload (Gafgyt)", "value": "4b192e426d8db3a1202638e0dc9055be97dab7a2d02fa2895b44e69fdc1d388d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823640, "uuid": "19397071-5e0e-4c85-8a71-9c6fe79140fe", "comment": "Malware payload (Gafgyt)", "value": "c5f9f8d62837934f301d5e8b891a2711a58bbe14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823640, "uuid": "35ca6a14-d72a-49d8-a1be-5d7b97e4eb55", "comment": "Malware payload (Gafgyt)", "value": "0d55d7f7c6dc8d0848af83fb688edeef3ba5d9ee74c5e5b949d55955fc15463719eecf8ac53427f3b7c3822495f15d03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823640, "uuid": "fc97cf6a-17d3-433d-bb6c-ef987a0957cd", "value": "T1DF933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823640, "uuid": "970cb9ba-6fe2-476f-aae6-eeff2cee4914", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8cl4umXxVqDrstKfz9e:Q97vk51RcG7AGl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764823640, "uuid": "5260c408-e0f5-4e1d-a54f-9f784e43f1de", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764823640, "uuid": "561d457b-6350-4899-9280-c910b57e005e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823640, "uuid": "cee472a1-b0c1-4292-9839-eef610180aa8", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722fa1ce-d0ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764837869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837869, "uuid": "b78c393f-f937-43d5-ae80-ca1fbf5c87bb", "comment": "Malware payload (Mirai)", "value": "c9843fb3dbc5cbc8e1597faa70ff56e7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837869, "uuid": "ca2ad0f8-3080-4a9d-b9b9-3c2b0a4cf0d9", "comment": "Malware payload (Mirai)", "value": "4beb0024c673e4533835a04e44d9dc5c40dfa36865f97f5a492ac25acd88dd0f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837869, "uuid": "c5e9caf4-faf7-43f5-9d22-4b1ecd3643b3", "comment": "Malware payload (Mirai)", "value": "453982204c96357453b05a14cc9d3ed3790b1bb7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837869, "uuid": "58ab1ffe-dac0-4a0c-a3ac-069cf91d7465", "comment": "Malware payload (Mirai)", "value": "418fc5589068467fab7317a750be01f5131de90baff144e3645b48a5c8b2fb1124804a4da37ef6117f32d5ba6f03d342", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837869, "uuid": "53260836-8315-4acd-b026-6ee2f4c4e402", "value": "T163213EFA0290EB02045E4F847899440CB6D9BEF4F0B54E9CD8CE887575F6A197386F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837869, "uuid": "fd256587-8e99-4bfe-9f2b-ccbd5c810240", "value": "24:MNLsK1swNIBbs8bK4s53skRsWQPrscNdlNwasls6ofls9RilEsUstLGgsUNtoMHR:MNLsK1sPbs8bts53skRsWQzsydT3slsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764837869, "uuid": "8436dbc3-f307-4bdc-a7ae-ebcef233f76d", "value": 1174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764837869, "uuid": "4bd20025-b9fa-4b72-b8e1-12be0884fe88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837869, "uuid": "a779b887-a2bc-46d6-bbd6-3a6d0f0b8e88", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50144cc-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806708, "uuid": "bf76b103-5746-40cb-a024-edcbec5d8645", "comment": "Malware payload (Mirai)", "value": "258b2c7efa07b1d3e0d493bbc3793f73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806708, "uuid": "911eacf8-1ed4-48fb-bc11-a219ab85d396", "comment": "Malware payload (Mirai)", "value": "4ce8e52bc027e61ed898a967a35ccc826c52d9d5021cabaf8c6001d6558a0bb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806708, "uuid": "86512234-f417-4221-9074-7492e42ff405", "comment": "Malware payload (Mirai)", "value": "2bc7ed8682096dc56422aba8185a40b54573ab57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806708, "uuid": "5ef6d7b3-60c2-4eff-8797-2529abf0f019", "comment": "Malware payload (Mirai)", "value": "430c807e5220d0c33c838b4ab3b01da4109ccb4e6748838b8bfdf9d7aa6d0563458a5040095f54bb9f4382edd59b2d7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806708, "uuid": "9fa07971-101c-4d24-90bf-c79b24a2e9e0", "value": "T1AAD34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806708, "uuid": "042dc601-e03a-42f6-a8d7-799e139dc6eb", "value": "3072:BxioDMQI5nr5aO4nt3qZg2IWu6b4MX7LkDM/94PmPw/t93:DioDtI5rcnt3qZgPWjHX74DM/9YmPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806708, "uuid": "fed6abbe-ba1f-44dc-9be2-058e0ab1cb25", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806708, "uuid": "baca103a-c1f5-42c9-b3f5-a2419564ae98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806708, "uuid": "3bace453-61e0-48e6-b27b-77f08627c5a7", "value": "uYtea.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4e6ac8-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879141, "uuid": "1c000820-7f6f-4dc9-bbf1-d0a48b716b31", "comment": "Malware payload (Mirai)", "value": "c97dfe6a1b540691a4f49f957ca417e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879141, "uuid": "c95db1ee-77a8-46c6-af79-dde1c1d8802f", "comment": "Malware payload (Mirai)", "value": "4daee208fee768e21a2a5b7340ab7e82c3f2e03ff5c2e5b8458e3fa905b49e90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879141, "uuid": "5f1463f4-2853-45cd-8d6b-81c905542ffd", "comment": "Malware payload (Mirai)", "value": "0021e551976ee8e907234a6bfd9125dc6f910582", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879141, "uuid": "4aadd406-4f6e-4bd2-9aa4-8248d6513171", "comment": "Malware payload (Mirai)", "value": "2cf76e49a8ac2b3407b0f1ffe00fdf333cb293aacf7972eccd6fe0429a41c27d87685d3571555d206222a3129f072584", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879141, "uuid": "86522885-b252-4fdc-9eec-06e432d8ab4c", "value": "T1A4338DB3C42E7D94F14AC278B9244B385B23D40696833EF5A68AC6974047EDCF6593F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879141, "uuid": "53c1a9ce-b30f-4e78-9848-4f50da418957", "value": "768:QeoaI/HTfpYtWja5FLMewtAjewnlqtDoKndEzNOalv+e574udChUoOQmEMYCsLNU:DoaI/rpY6OrwtAFqo8EZz5+0d+oYCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879141, "uuid": "4490ac59-f0f9-486d-b648-691983f29a22", "value": 54700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879141, "uuid": "0c776210-f287-4327-8739-91e67e58f072", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879141, "uuid": "fa617361-ea12-41e3-b1f9-db18fcb42951", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ba97ef-d164-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764889060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764889060, "uuid": "1b3507a7-0d8f-43e8-b790-501d82bdac51", "comment": "Malware payload", "value": "002529cf15b51d667748cc9d4cbee5d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764889060, "uuid": "54a35e7f-3d39-4dbb-9cf1-dd4e6b7612da", "comment": "Malware payload", "value": "4dec401b7d01d16b35bb30a691ba7325fea19d25509a954d86c7e635272aa50e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764889060, "uuid": "0432dbf4-a2b9-4722-a156-69282417799c", "comment": "Malware payload", "value": "b1786c5b8f0fdd08a3db267d028bd65b8608dc01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764889060, "uuid": "deb664ed-1f95-42cf-874b-5abacf056996", "comment": "Malware payload", "value": "88dd80fce6342032178640ac1a736964aa359544f54f6d5160191b6d949bc3c0095535c0be8a5ea916e0ed06682bc97a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764889060, "uuid": "03603fcd-0a2e-4618-a3c4-a99906f55d53", "value": "T1D0438D76C87E7DE0C54846B4E8219A791F07F501C6672EB65A82C9A74083E7CFAC93F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764889060, "uuid": "a68d81b8-feb1-423d-bc6a-3520a94ee41c", "value": "1536:EaawtyMA/mS0AEX0a5I5NWUKY52IGrmaC9ou:ENkAn09ECIHKu2xma9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764889060, "uuid": "00e1c438-4234-41c0-ba82-72eab1302317", "value": 55520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764889060, "uuid": "fffa65f2-4fa3-43f7-a0f4-eb14c560fa8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764889060, "uuid": "a823ef54-1ad8-4d3a-a10a-af859e15a754", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d067699a-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888278, "uuid": "bc7bf6ed-2c9b-44a4-839e-3e46dea356ef", "comment": "Malware payload", "value": "b25a02f27723c2a6cb485edeb3769b8f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888278, "uuid": "52b2ba19-3d0e-4769-8559-8a30eb294452", "comment": "Malware payload", "value": "4e103138905a171030998c1d73846076438c6047b9e3578fee10c0f4d9da2039", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888278, "uuid": "c55a40c1-c323-4222-a861-33a2b6208f84", "comment": "Malware payload", "value": "3f28e3857b875d4dba1104d5d61e0d84b0b4cb0d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888278, "uuid": "7bbdad23-45c0-4d10-a236-8f900e2a30cd", "comment": "Malware payload", "value": "3c3dafbe34a6782484e9e4785a2f3e61372a418e033c94804e2bea92c0aac928d618d76d95bc4f3cb793f4c85decd9ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888278, "uuid": "c03f22cd-c7d3-401c-8e50-a04b187e6762", "value": "T1451130AF2C119A92C528E68CF8F7FA01F30EE24D21D07F2982FE8731809AD147902E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888278, "uuid": "26a665d7-2b48-41b1-ba48-295a102773ef", "value": "24:eUM2SvM2SiM2SpWM2SdM2SgM2S7qM2STM2SeM2UE:ewSfSGSpqS1SMS7OSDSSUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888278, "uuid": "e4c26171-c628-4276-a111-f1505bdac8eb", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888278, "uuid": "b7a1b775-7fe8-4adb-b175-4b026ed26870", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888278, "uuid": "5ba8a280-d56f-4187-949c-53381676e7bf", "value": "router.tplink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07347e6-d167-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764890479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890479, "uuid": "93644b46-6088-43ae-b185-0d68db5f1240", "comment": "Malware payload (Mirai)", "value": "8929a9c569701ab14fefd49fa37344ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890479, "uuid": "2fb016b4-faa7-41f0-93f5-123fc9291dc2", "comment": "Malware payload (Mirai)", "value": "4e81fb9a5b5e6f5d43d705c6fea94a54bdc1bbf5401f7edf6ecc787dacf72562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890479, "uuid": "d7d20ddf-d645-4166-99f7-aa7cec469fdc", "comment": "Malware payload (Mirai)", "value": "86aa4f74629349de977a0c1c8f99cd6898843c91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890479, "uuid": "447963a8-e59c-4257-8d09-271a461bbad7", "comment": "Malware payload (Mirai)", "value": "1f15572b246270a4bb06c836835f9fc6ae0040ce64308e558fa8d8e038f45e5e91355bdd14761c90a5cc32c21e9edaeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890479, "uuid": "d912c2e8-8980-4100-9e80-713faa5c7000", "value": "T195534C2179392E27C4C5B47A61F78334F6F6170A36A8CA6E7D720E4EFF10A442117AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890479, "uuid": "03c889bd-5af7-4aee-b9eb-f17424996bb0", "value": "1536:xO8WqSYTLYsJ0CABucVZerJVW4Ng09xq0lgj3GlJe3:xgj9a0uwUxg0blllJe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764890479, "uuid": "19dd49c1-2176-4e4c-9334-76da87b6a8d0", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764890479, "uuid": "d0020253-4848-4945-93bf-5239671e8187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890479, "uuid": "55288094-6cdd-45b7-add2-5dd4e3f213af", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b063de91-d109-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1764849999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849999, "uuid": "a13b6325-f1d0-49b7-bf8f-3780751c5b1c", "comment": "Malware payload (MassLogger)", "value": "620590beb3156635c919ea599925d187", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849999, "uuid": "0e8d5c75-d9e6-4886-9e99-c28cc23a1020", "comment": "Malware payload (MassLogger)", "value": "4ee64c11962f9722cfb4beecff8d0ef89b0d158f6a2d5cc150ac742091149e56", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849999, "uuid": "9c0de5c1-993d-49f7-b19b-7b0146414db8", "comment": "Malware payload (MassLogger)", "value": "927f326bfea3f8f1db40160fd6fb301c5e304c19", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849999, "uuid": "d5c8ec33-62aa-4a65-855f-5df1a305c641", "comment": "Malware payload (MassLogger)", "value": "bff268b23cf33dfe21e20f55704d544ee34c9a1efa431ec1e8007d305d7144109880b16893a4df915b16c9dee5dd24af", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849999, "uuid": "69fdefff-6e22-4ff0-a412-08ad5bcbb122", "value": "T18C55E15E5461ADC2A000FEF0F541AFA7CCDB5394122346121FE568AD6322D83FFAB6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849999, "uuid": "b41d276d-b8f9-4eb6-b90a-9511bc8cbd26", "value": "24576:ldoxGK0Zh2zU6b4MlOaTTFmtZrL3pqtLq8iVc8Xt0ZFKsEwi:Qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849999, "uuid": "a2ef3ef5-13b6-4cc4-aaf9-404c4f7f2171", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849999, "uuid": "4a3c0fa9-528b-475b-8677-9ecbc4dc0b6f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849999, "uuid": "110afdb9-be38-473b-928b-b62ce55be894", "value": "e-dekont.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadb4c94-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829911, "uuid": "b2c91ec9-cad6-4161-b87e-a3a4c7718cd4", "comment": "Malware payload (Mirai)", "value": "655b412485254008e0da2decb7964f2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829911, "uuid": "5abc18fa-22a9-4444-9f71-7bfab0857be9", "comment": "Malware payload (Mirai)", "value": "4f779b276c0965994ff7c14af23bf20909398b6c29ee53d92a7c0595737f7be8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829911, "uuid": "66f2608f-a70c-4a39-b71a-0fd8923efd96", "comment": "Malware payload (Mirai)", "value": "115f9e8c536ffcedc37c896ce105f1f457f533c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829911, "uuid": "044f3af0-0eda-4253-afc8-f6df3c8fd85f", "comment": "Malware payload (Mirai)", "value": "ca7a9f5e64a985b840eb450dbcb3c8f0fca27c04444596fe10785bfa73ce84f087cd2c4fe821c70d5a7c39224f364dad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829911, "uuid": "8e76f0fe-bcd2-4720-94e4-d6702dbbdb65", "value": "T10383199AF800DDBDF80FDAB74463490EB931E3910A931B377767BD53AC721A14826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829911, "uuid": "cc4dee56-c9d2-45a0-9c09-7a8fe0ffaeae", "value": "1536:4v7sC9KZbx5uW8eLoPSdAYA9lJPc89s8br0hpsBq1HHbqFiQpsrH7I1n:4G5hLsd9lJP4npeqp+psrbI1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829911, "uuid": "7827035e-7b0a-4114-8d3d-b3e4a8e3af53", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829911, "uuid": "f4904a93-1e03-45ed-9308-702078fc91ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829911, "uuid": "040213ea-2fca-48bc-a55c-326cc56ec6bd", "value": "ub8ehJSePAfc9FYqZIT6.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1239b1-d0a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807738, "uuid": "68b3c97c-f75d-4a6b-a4a5-963bb7bc114f", "comment": "Malware payload (Mirai)", "value": "d5e738cf0f509c9da194510f7b79b20d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807738, "uuid": "39eba065-517c-45af-aef4-e6dfe32ed811", "comment": "Malware payload (Mirai)", "value": "4fbc8be43f8d47feab328015c4c8f5ba87562f880e73430c8c981f2868e51628", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807738, "uuid": "0ecb6d11-d9b3-47b0-a571-1f3f5b4d0444", "comment": "Malware payload (Mirai)", "value": "eb267e7d87807f7d75fa6d04649708c572869494", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807738, "uuid": "a0bf3612-bc08-40d6-b90d-66741f3af511", "comment": "Malware payload (Mirai)", "value": "96436fe0ca82d36477fde346bd5c25753a6053d1af2ac7349a072be8686b775686282ab4245d312caea1cf45e726a6e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807738, "uuid": "49992b8b-cfa0-4cfa-927f-e92fb59a395d", "value": "T143C2D0226D58AEE1E3F428F88F3C4B3B544719ECC298357229496C28CE8680E93F95D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807738, "uuid": "603424a0-a777-4331-b389-32a5111f2ee0", "value": "384:XV134SVaCxcs0Xu9x6kx0MsRL6K5oxJXhe4Sd9pWLYlRkK7xSYchymdGUop5h9:XlTcsQmx8x6gq+RblrkYcs3Uoz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807738, "uuid": "ecbdf09d-5522-4e0d-a85d-d75fc65436f4", "value": 27548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807738, "uuid": "5870b99a-fa11-4006-ac0a-7b61f8d7b2c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807738, "uuid": "612b2077-1759-42ef-aa7f-4008fcd69e68", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1212a2d1-d118-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764856176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856176, "uuid": "5814346a-12a2-44cf-8a10-8d6c1f9a7ae9", "comment": "Malware payload (ConnectWise)", "value": "86877867d05b4f0bd9baa7a531c1402d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856176, "uuid": "16e50a41-6798-4db8-93c8-3b7705ed7401", "comment": "Malware payload (ConnectWise)", "value": "50ac7b0a399d34c252ec159aa6b3da6b1cd760acf130e8fae07f08b7a48008c7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856176, "uuid": "325042d8-9b7d-4fb2-ac8e-fceb0320088b", "comment": "Malware payload (ConnectWise)", "value": "9987b1bffb0734044cb8c9c97cf53454d98ed7bd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856176, "uuid": "473235e5-6194-4981-bbcd-ab50701721d7", "comment": "Malware payload (ConnectWise)", "value": "f6a77bf8d1a0ecc5870ed4619e93ad37c89c254c94249521376e0cc0ed485197e497c28f2f23d3d3244013c797d5879d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856176, "uuid": "b8979617-3d24-4a3b-8a56-1451f07d80d1", "value": "T1BAA6233662E4C026E2B71E39E9794AF25939BC468913C15F533C794E6871E81E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856176, "uuid": "e8ee0f51-1f33-4fb8-a4fb-5573252ae890", "value": "196608:T+kLGB1R+Z3/s+kLGB13+kLGB1S+kLGB1:ikqBbokqB4kqB5kqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856176, "uuid": "41b35393-642b-4230-b694-9a0e531cc441", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856176, "uuid": "54ce7ba5-9623-4677-a693-200570166ac5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856176, "uuid": "c80fe2d4-bf35-4567-a9a1-49b1ea4d9868", "value": "Trent_Swanson_PunchB0WL_Invite_Dec_2025.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a655f902-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883053, "uuid": "d053c370-7a78-4388-b795-ca2f2ad35ede", "comment": "Malware payload (Mirai)", "value": "5d7e582c9776bc8aca32df9f5b3e651c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883053, "uuid": "044c3d06-f4a0-407f-a395-29dd2196a882", "comment": "Malware payload (Mirai)", "value": "50cc2c8da3709dc27531e98c097f490e00883a7669af50dce9c2437abfb6b693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883053, "uuid": "672ab56a-8c89-4c40-8147-b3683c39a646", "comment": "Malware payload (Mirai)", "value": "746d211d5ae99ef647f343d9a2944144fb303212", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883053, "uuid": "f25464e9-9baa-4467-b4e8-cc8c36a11ed7", "comment": "Malware payload (Mirai)", "value": "3bd6ad8ade4629be3c9c9871f5acf7620eb612cb974727d9efcba9042c817d0d339d3a9c859e68d5756163801959d727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883053, "uuid": "90ec1b9d-1eba-41b0-a37e-133a38b69a5a", "value": "T1839312FF22A10B9ACB98D4300BB25BCC1B7A579392304769FB39B763525B0633C66542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883053, "uuid": "fcc528ae-694b-40aa-aa5e-10054340f83b", "value": "1536:XRoRPsrRPeeSPSz/yNnCsII9I0KLgc3lmLY7qGv03+j+tTxp8IaQ1jbA/IJw07YX:XitaeezzCCsIIiLgc3lBjK0+hxS01jbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883053, "uuid": "5624f349-f96f-4f09-9e5d-05f265559d5d", "value": 88984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883053, "uuid": "f7883f39-8d65-4380-941f-872b0e965807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883053, "uuid": "dacb42e2-15d0-4c4b-bc3d-5f5bcacc1fc9", "value": "ecco.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dad3149-d0cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764823097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823097, "uuid": "a042c14e-566b-498a-9fe3-94a42e32d0b4", "comment": "Malware payload (Mirai)", "value": "61b8c5128092a6c3380c49c28c0f6ce7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823097, "uuid": "fe37bc3a-8d81-4f2d-b276-71ba66ff5989", "comment": "Malware payload (Mirai)", "value": "511a6785950c9665a50b7476d8de2c56548f0d0fbc5672d643e609aba766bed2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823097, "uuid": "eed70f8c-070f-4115-8820-12027135a345", "comment": "Malware payload (Mirai)", "value": "7b2712efceb89636ccaf35a4c47e97b09e3c6234", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823097, "uuid": "0823d204-be83-48fb-bf4c-bdc5b5b01414", "comment": "Malware payload (Mirai)", "value": "9f9b36ec07339fcf55a19fb79811f442bc15556e925d26cfb6d6f640b4aa5cb44a3d8f22074643f2f7d6368f8c935ed6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823097, "uuid": "c0582a4a-6647-4ff9-87e0-794d9b313d56", "value": "T191D3F746F8819B11D5C152BAFE1E124E37231B38E2DE73139D246F747B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823097, "uuid": "0d3d2e10-880c-4375-a06f-c430fa965c1c", "value": "1536:QonGwms8YYHinaID52BReL0BXygttIemdPaWabHk4d6iEx1bs+5FBZdij0m0Vehi:Esuin9cR46XvfmdPaWhx1bRDBZ/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764823097, "uuid": "e0788c57-e881-43d8-8323-2703eecefbce", "value": 140316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764823097, "uuid": "b3193cd9-618c-4ca5-8df8-aae188104484", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823097, "uuid": "ce082a16-9208-48a4-b37d-6f6baf01cb5c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907a0fab-d136-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764869273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869273, "uuid": "b08e6be4-4348-4bd8-98b6-ad9dd91f8493", "comment": "Malware payload", "value": "59be89c91c593994ca345509fe558511", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869273, "uuid": "20a5de21-d3f7-459d-9889-d233f05e62c7", "comment": "Malware payload", "value": "511f0db9df1376eb703320d0977bb45a63d8b0052aacbeaf0e7cd7688af3a651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869273, "uuid": "5e71093d-ca51-4dca-9b78-3d96596cba9f", "comment": "Malware payload", "value": "76a84331d76195cd906b8ddcb25a0d03b61f0166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869273, "uuid": "7f9e488a-2387-43f2-b857-69ce39b80c35", "comment": "Malware payload", "value": "4131e9da6bc4ca850ac6b1f3618d0b247308a8dac5f7239b9189d8d1774299c894091f7b9cc441c0679d32e70961be2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869273, "uuid": "d9f9be96-aaa7-4a2c-bd05-9c1e979291af", "value": "T15AE623D73EC9A1A8C0C78E31628B579C72F2A2CA8EB75A2D37C61C039631F63454557B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869273, "uuid": "a9eeb318-c27b-4040-9f0c-6807ac8d41e8", "value": "663db01aac141130c0fe8631c0bf50ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869273, "uuid": "dac41642-adb4-43c1-b3da-1d7415696c76", "value": "196608:R1ghkkArUdYOn0QIsD02l5YDTn1fghTn5GRhW6FSTCa0MpAwQzYYVkD2ulQ4Th:R1gpijQ7XlSDTn1fgxnOLrrzYw9aQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869273, "uuid": "b782835d-2ba2-4adc-b1a2-d90afb96f1d6", "value": 14865920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869273, "uuid": "988168c4-5083-402a-9f4a-b41a5d54ee50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869273, "uuid": "11726792-ede7-4c1c-a41c-6e91c860d24c", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb11c5e-d0df-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764831684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831684, "uuid": "6d1e39bb-d74f-40ea-8b3e-9acf51229671", "comment": "Malware payload (RemcosRAT)", "value": "322f45440ebd1a9fb595d97ca758eb3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831684, "uuid": "c6b189c0-f5d4-4182-86c0-09a696a0a6d1", "comment": "Malware payload (RemcosRAT)", "value": "51ca2922329027ba99c1bed19d4c89404f57da0e5d5ba7f2c18081bbc0cccc95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831684, "uuid": "66162faf-56fe-4026-9649-fe4c8ceb72f8", "comment": "Malware payload (RemcosRAT)", "value": "e44341ad4eb24453bba5bad2939a969f69e9a6e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831684, "uuid": "cc02e9e2-c399-4f5e-b461-34409992583f", "comment": "Malware payload (RemcosRAT)", "value": "c5ba9cc6902f4d86a2a9a27530e5d167ebc5144eee121ec2f51cfb2f53aeda9b55ddb6577c2e6fb9c3c132d895847ffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831684, "uuid": "aa3813da-ec48-4014-9f6f-e9879260b79e", "value": "T17A842252BEA8C07AC45383351936663B9FBFE83982325E5303127F59AE973A3060D757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831684, "uuid": "0317c5f5-442a-41c6-8024-bb2615d15cc3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831684, "uuid": "940cb04e-cceb-43be-9188-9676b8884d81", "value": "12288:BbYUy3gy//yN/ULQVjnWKxper7ds2OSn2GUmX:BbYbvSVULoWKxp4O9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831684, "uuid": "6f7768c4-2e95-4d43-9f2a-a0bcef64482a", "value": 406000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831684, "uuid": "6cf02bae-dea6-4d8d-bfb7-b52170807cf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831684, "uuid": "c11860e9-9451-4f82-aee9-baeb5e6304f4", "value": "3110237820-xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b98137-d134-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868240, "uuid": "ecdc6132-3d2d-4c91-a5a4-926e8d9fe1aa", "comment": "Malware payload (Mirai)", "value": "b2cc22319a0cc5b591d6a5b429edc618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868240, "uuid": "f0d7646c-274c-4592-b497-c13f1f9820a9", "comment": "Malware payload (Mirai)", "value": "53ae494a5c8c87e2fbf7d28640180744c57bc6c13be03bb81c2f54a89afef938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868240, "uuid": "d7c80a89-3c44-4362-b1b1-3d0c5814cfa2", "comment": "Malware payload (Mirai)", "value": "1beb77f1b8cb623f0ae64efb687f99cb3f3cca8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868240, "uuid": "522c0fb6-c116-4334-994f-0b912c2927c1", "comment": "Malware payload (Mirai)", "value": "fa5e036c28c2c7638d57134367c49f50eb52906e6d4f036e8b46b08f20b7872766bf9c4fb071be0d6512cfc55bd5824f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868240, "uuid": "40605e37-24af-4928-b39e-33290c069535", "value": "T1AEC33C8AF4018E7DF85FD9B641274D09F920939166930F6A22ABFD93BC331A4BD13D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868240, "uuid": "a17f25d3-e082-4b1d-8cbd-5079d208bf21", "value": "3072:UL09p7QKwxvJdqPOFF57NhfiZRhUAuloTxEvahKJ3owyYbfMUnV1wCjXZZmVAJmV:Wk7QKwxvJdqPOFF57NhfiZRhUAuloTxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868240, "uuid": "48966fb2-7c15-4ea8-831b-4338ae783ca2", "value": 120296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868240, "uuid": "a3002f1c-4c0e-4723-817e-9cdf18b78ff4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868240, "uuid": "ba664063-2d55-4563-8010-5907ce769984", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deecf70a-d152-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764881430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881430, "uuid": "936ea588-8cc4-4e7e-81e7-dc8610b8af22", "comment": "Malware payload", "value": "a3f73e1b9ef746b59643603fb711e93a", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881430, "uuid": "f5817ac0-5621-4e79-8a18-f53c13ec7c22", "comment": "Malware payload", "value": "53da615c1019b82ccab22d69dac0cd531729f9b0e2720922a0bac832098a161a", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881430, "uuid": "4ae96618-0856-4b9e-8fb8-771772adad23", "comment": "Malware payload", "value": "7bfa935adcd5a0c4f55c71c7945081bd2cdda151", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881430, "uuid": "b9aeaa70-11b7-48e9-aae3-71efdbe0b679", "comment": "Malware payload", "value": "6fe8ed2c55f7bb8854fe23245ef073c384bada95c7dc699a955572f7c4dd6fad61d7d5fa1d5e776ced17368a1fb80fca", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881430, "uuid": "ca208547-e2e5-4ddb-a1b6-85c8b9ef7a9a", "value": "T1C8B423BFD60060DFD54EFE325DCF912A5739B1ECD45B5BAD648221ED2228E831F211A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881430, "uuid": "df3b63e7-c17c-4b3e-be13-3bed7d1cd4bd", "value": "12288:wDW35uxdg9t5dYOGuh4+2JT7/NWUP9LF7j94dCxV+T7jS:sWJF9WORO+o7/NWA9L3Cv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764881430, "uuid": "29af0ae7-c39a-42ae-a23c-1f3f4b03f943", "value": 509833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764881430, "uuid": "6655e6a6-b82f-41a0-8440-a7e7356a2bc5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881430, "uuid": "9e34a789-41ac-4cb6-bb69-24bb635636c6", "value": "Supplier Details 1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44678c7-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829067, "uuid": "d9a030b5-9569-4d4c-8538-eed51753e204", "comment": "Malware payload (Mirai)", "value": "7f6e6975088ace6c6a923b026152e761", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829067, "uuid": "3de968e0-782e-47bc-8369-223ccc0fdc88", "comment": "Malware payload (Mirai)", "value": "543d3a3bd7d7b1f7a03151b7e9f27d85d513f0c417299ce9ef64919bfa8efe42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829067, "uuid": "a4f46b67-f709-423b-8205-f5202bdcd579", "comment": "Malware payload (Mirai)", "value": "342901d1e2c08cfe56dc45b610cc8f668ecdb999", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829067, "uuid": "bbdee211-0818-4ff3-b9ec-f936535974bb", "comment": "Malware payload (Mirai)", "value": "90604fcbdacc7edc4da026ffb5baed80416218c551c781dde96c167eb29f885780418ac5e643b77e015fb780bc0cd633", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829067, "uuid": "8c6a6904-3b8a-4fcf-9403-348361d4fc96", "value": "T12CB2D1F8760B3671C8B0093A6A2C4045678752F5D5E75B3F2421462DDDAE607AABC7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829067, "uuid": "726725ac-b207-46f6-8acf-7d58daa7be06", "value": "768:fG4rcUl3p9byh2Uy+2XpOhD4HQs3UozMg0:NrPj3o8HFz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829067, "uuid": "1e56ba07-7287-47dc-adeb-0af3bf16e790", "value": 25104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829067, "uuid": "25060671-0b2e-4aa4-a0e8-79284174a73b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829067, "uuid": "7b2ed2b8-a6ec-46e6-b019-8a7e27729202", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f28123-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834147, "uuid": "fa812c41-fea1-4504-8ff2-ba07cd80949f", "comment": "Malware payload (Stealc)", "value": "32cd57494f72ecb06cfb46c973a9e4cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834147, "uuid": "e014765b-c9bb-490b-bf81-29d49585f92f", "comment": "Malware payload (Stealc)", "value": "545ff273c8a204550a800918af050f149a2c4f8fb3bd83dcd6fee872fca5e292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834147, "uuid": "4d6847b9-3438-498a-8fbd-f3377d578780", "comment": "Malware payload (Stealc)", "value": "ecad92233b1b73854a922f227c12d104672c442a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834147, "uuid": "fe57f38d-d3d9-431c-b5b9-34bf34379d7f", "comment": "Malware payload (Stealc)", "value": "ee9b394fb0e819bcace84c937cf304d081bbe993aea6d8e8a14e46fde712a3ed4253955e84191f882df58dee73402126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834147, "uuid": "b7207333-b766-496b-899c-d8c22c5288a0", "value": "T1402618126943CB95D06BE239A59161817E707E140F707BD30AB4E67E2C3A6FA0DF7B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834147, "uuid": "d026d24e-a5d9-4a37-9882-eb5d222358d8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834147, "uuid": "abbb11db-82f4-4ad6-bef7-dbc4aa2dcc8f", "value": "49152:IUfz8MTAVItaW4q5HeRHmPth1eszW0rdY+bbuF7F+Q9LYW326J4RyV3iAJ2e5ogy:ISEsaRWTo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834147, "uuid": "883f5eb6-7b17-486c-8987-635a1156a946", "value": 4433560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834147, "uuid": "43c3ca31-281f-47d0-8208-97699c8225b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834147, "uuid": "0a9bd2f4-05cd-453b-88c9-94d3a880e9ed", "value": "68s6Svck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f34af2-d11f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764859323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764859323, "uuid": "65056f9c-8922-4800-93dd-73482aa95d97", "comment": "Malware payload (AsyncRAT)", "value": "55a1c7a07d123f29275e011baced671a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764859323, "uuid": "2f162ac5-613f-4ccb-855d-4bc3635502de", "comment": "Malware payload (AsyncRAT)", "value": "54821b9c38dd95f636dd8ad15f29ea9227c63bbb9246600725bdcea0f8747210", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764859323, "uuid": "a9d1bd72-f627-4382-8011-288333f23cbc", "comment": "Malware payload (AsyncRAT)", "value": "41ec7db7b33ec085faf998c6a2bb5fab33501fe2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764859323, "uuid": "9d93efbb-5a0d-4340-8258-a04f69bec21b", "comment": "Malware payload (AsyncRAT)", "value": "95509ed0a74dc12788cee2c36d3c47a857a34e2c4f9ed8b1878a151693ade42f3a229d9925c955e4f0b4a49640b43fee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764859323, "uuid": "51f065c4-7500-439b-862e-ab2f27ddae7d", "value": "T19A535B002798C966E1AD4AF8BCF2950046B5C5772102DB5E7CC814DBABAEFC646137FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764859323, "uuid": "f86b05ab-316e-49af-b08c-369b8fb531c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764859323, "uuid": "9a182b9d-c915-45a5-b1ba-0a452fa1a4ed", "value": "1536:xhmhBLTRQUhZ4DcVV9HSA+ngGbb+wR2N6bGVUVclN:xhmhBLTRQUhZ4iVNSA+gGbb+M2N6yGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764859323, "uuid": "275c0c66-7b85-4f3f-b774-58a608e0ebf9", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764859323, "uuid": "b1d19943-96e8-4e8b-bdce-5d1652ff517e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764859323, "uuid": "97f2774b-0e4e-4556-9d6e-93655a004be6", "value": "RuntimeBroker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a2b7a0-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1764834269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834269, "uuid": "feac81ab-456f-4576-a3fc-954f89e93858", "comment": "Malware payload (Gh0stRAT)", "value": "fc619fb7f206f15d837ea9424906f8bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834269, "uuid": "89930b6c-30c0-4aaa-bdcd-5dd4052359f0", "comment": "Malware payload (Gh0stRAT)", "value": "548e564a861f61d217340adf12c3801d9ab1f6619dfe445d44c48444aa0ff77c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834269, "uuid": "4d2a2eae-5bc4-4516-89da-021a4adcead3", "comment": "Malware payload (Gh0stRAT)", "value": "b288b3f691cef0658df52d4ec24843ad5392c96b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834269, "uuid": "f333f4fe-fe8c-43f0-9e7d-3ba47145778a", "comment": "Malware payload (Gh0stRAT)", "value": "6bb0acd5118548edd7d99b01cdd55ea267735f01870733189ed373a6bb1b74ec9552104cacfe297a1d031c94c80e8c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834269, "uuid": "35638498-a72d-4091-ada9-bf4734f59988", "value": "T1DA173323A6C7613FF0BE4A3A4977D226443B7B2035128CA7ABE4486CCF5A4D51D3F652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834269, "uuid": "e5d00cce-b77d-4bd3-8a03-8a46cf887b33", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834269, "uuid": "aac4c72c-f4af-4ab1-98a7-de39e708f005", "value": "393216:UrlZyROKfApyOJLu5QQ7n87YBVjqCqgqMEVxBZyJMasO//Uz5X49KYfBX:OZuOKIpyCLQb874qDMEVhyJb0G9KAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834269, "uuid": "883ff0cf-e77e-4aa8-93e9-733ee688caec", "value": 20285688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834269, "uuid": "88829b51-327a-4f07-97f2-cafa2d432e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834269, "uuid": "7ed4c9a8-21b3-4d35-86fb-1432b31412dc", "value": "kotovpn_setup114.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3af05cf-d15f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764886995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764886995, "uuid": "a0232fc8-0525-403d-8888-cb8b1d559155", "comment": "Malware payload", "value": "4f666443345b29e5000287b5ae479d4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764886995, "uuid": "e970fbc6-1596-4e75-9595-9239bc22c6b0", "comment": "Malware payload", "value": "558f31f2d1f3ac35db0019802a7238696eb274e48b2fbfa123651bc672176928", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764886995, "uuid": "d97d1c1e-ef18-4abf-ab54-e3bac1a30dff", "comment": "Malware payload", "value": "e4ec319f83bac0b5e3f94e2be0fd0b5cfee960d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764886995, "uuid": "4e83da08-e07b-451c-8cab-a30a32dabdfd", "comment": "Malware payload", "value": "ff424e168e94a80ae6483a35b9c81c8f9204da4f010ee2e0439aff31f7c7d197828144f2c7fb2e7f493c9a0b7bbebd09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764886995, "uuid": "16e760e2-8a75-4e71-af28-04ec48226d0b", "value": "T184535B2179792E17C4C0B47E21F34634B6F6170A36B8CA2E7D720E4EFF24A5421176B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764886995, "uuid": "8d8f3ce0-a83e-4c06-9401-c6322d3d307b", "value": "1536:PgueSjA8FaIn54qK8jZes+SrJR5P8K72nUHt9RaVe+g:PX/vv5Vr1/P88DaVe+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764886995, "uuid": "e27c21d7-f448-4bb2-8dfc-1e41b6e6f3f2", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764886995, "uuid": "eae0e2ae-7983-4b10-8452-b5a84db84819", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764886995, "uuid": "c7ec5fe7-5889-41f8-99c2-eddde8988900", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba2413e-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834609, "uuid": "8204e8d1-0b4a-46a2-aa6b-57654d3a4769", "comment": "Malware payload (Stealc)", "value": "52e0ca5fbd61935d6b43bcf6ad56fe82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834609, "uuid": "3bfcddb2-4709-490e-bf7f-7c846e978095", "comment": "Malware payload (Stealc)", "value": "559651777aff8ae48d30e6e5dfcb966b3651a7dd18e50d395d4b79b675dee23d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834609, "uuid": "2106930e-0927-40a6-babf-208cc47ab8fa", "comment": "Malware payload (Stealc)", "value": "1ad04fc5a6e8f821bf93903ad06751372831b11f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834609, "uuid": "e90cbee5-59f3-4d57-9f05-8ab41b913964", "comment": "Malware payload (Stealc)", "value": "fa8786d3057385f1ae9112da1588929117a432723c5c4b7c77956d3e610a97de6596d16629314220abe709f06f1ce0be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834609, "uuid": "20c429ce-6159-4b87-9194-03ba470edd67", "value": "T170058C1AA7A503F8D0ABC2B4CE42A482F7B27C455770975F03E196B61F37AA0593FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834609, "uuid": "8d866362-8917-4d22-b129-81610c340b32", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834609, "uuid": "d641ae8a-4157-48ba-be9d-9a11665aea30", "value": "12288:eGLVpIo/cBJ9InRPehbyv8plnEGtv3YZtF15kjHBY:ekkBJinRP6bw8TEGF3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834609, "uuid": "e83ccded-4c94-427d-aa7f-158dc711ce88", "value": 797952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834609, "uuid": "5394bdc5-359e-4805-a4ab-5615d563d674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834609, "uuid": "74b3d205-f293-4515-878f-db2ca37b83e9", "value": "yjlhur18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f87dec-d0c4-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764820219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820219, "uuid": "fa45f1b2-157a-4a5a-a64a-6c9b0cbbcfe1", "comment": "Malware payload (ValleyRAT)", "value": "6c9f38e10959afd28b70442e9ebbe11f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820219, "uuid": "eb6ec798-ff8d-4820-8f52-03e305655a45", "comment": "Malware payload (ValleyRAT)", "value": "55a4436e8be3d485059a70de9453c3c3160bf0bc9bdacd332e003a1cee4d2821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820219, "uuid": "c200e862-fcfb-43a8-a870-492a4d81ecbd", "comment": "Malware payload (ValleyRAT)", "value": "8b4f32635f4c3edec8532d4ddb1bd7141000baef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820219, "uuid": "b5da9fcd-96f6-44eb-928c-b4fbc50a07f9", "comment": "Malware payload (ValleyRAT)", "value": "1cad89e23c58cd8487f3620ad3d709842e158fb6d06738058917278af16083d54646a06e14e2805473b9f05c89a3573f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764820219, "uuid": "9fcdaef6-cb5e-4407-bd2d-fbc3fcd7c796", "value": "T15134A5E639515D76C4CCC530B69161A7AE36BC0836E3B286D2D0F97937FA2846D3E270", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764820219, "uuid": "36f9baa8-f5eb-440f-ac5d-6f856c4add98", "value": "900998ffb3f12157e44eef1bede5e79c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764820219, "uuid": "81bd8f51-55d9-4bbf-9b74-a3133abba247", "value": "1536:RYgJN2meKApN6EgLAsucaZR8S2YSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSX:RBNLejf6EgsNrIrc/fcLvFUg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764820219, "uuid": "a1775083-285c-412b-b9b9-d2458875b822", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764820219, "uuid": "a624a117-6409-4459-a228-3c78f7715edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764820219, "uuid": "a4dea518-464d-4648-b317-d0861a359967", "value": "55a4436e8be3d485059a70de9453c3c3160bf0bc9bdac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f37fa9-d148-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764876766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764876766, "uuid": "425205df-c036-488e-a39a-815365e819b8", "comment": "Malware payload (GuLoader)", "value": "02fe4aa01201545c1dcbd05a6df85813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "makoob", "colour": "#08179B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764876766, "uuid": "a3468ddb-1055-485b-b4e0-c5fca226ea6c", "comment": "Malware payload (GuLoader)", "value": "55a5544e47bde8e55701d7debcc178d4c65f7794c2fcc3bd2a7a4cce8f19f5ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "makoob", "colour": "#08179B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764876766, "uuid": "ae79dfed-224b-4360-b9f0-6f0cb95f61fb", "comment": "Malware payload (GuLoader)", "value": "f22348736b3f8a9758af9e5fd7d7abc53efabd32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "makoob", "colour": "#08179B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764876766, "uuid": "2f084d83-2b35-4b8b-961f-1863ad9fc1b6", "comment": "Malware payload (GuLoader)", "value": "fd7cd6d804e79750fa0464d8dede803497ad1590d03e54c4fcf211c6d1505a5f2e3a7845285981a40244c59a97d79891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "makoob", "colour": "#08179B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764876766, "uuid": "2a04a857-9c57-4a1e-a7ef-42180046c096", "value": "T199B4F1023628589BF28A25344D21E77A5A307D7D29A0041736ED7F6F7ABC343990F5AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764876766, "uuid": "fe62c6af-9249-4c6b-983c-65e4b96986a9", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764876766, "uuid": "4c2dbabc-4fc9-4f08-ae5d-8b0d6c24c7fc", "value": "12288:kgtTe4oUnVsT/Az1w2etryQFGloFfz6nec4X1:kKX5nk/Cw/tWQFNFfz6iX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764876766, "uuid": "8051ada5-0617-4f04-a98d-785b16ff4770", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764876766, "uuid": "9bcc362c-0c80-41c7-a669-daa6424a6507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764876766, "uuid": "8358a6eb-915e-4a82-a459-1e453ad5c32a", "value": "pseudepiscopacy.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce80c3f7-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888275, "uuid": "cf9ec63e-ab57-48c9-8898-ed0d96fe4fa0", "comment": "Malware payload", "value": "bc5f98d141252cccbb8f747eee59f6c7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888275, "uuid": "baa363a2-13af-4e35-a4f6-46bbbb19d21e", "comment": "Malware payload", "value": "55c2157762af1ce6ca50df7c441236fdc657cc51e5f22aa708b52afaa29307ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888275, "uuid": "f4baad9f-b363-4246-b8c1-2b4f64ea55a5", "comment": "Malware payload", "value": "8a291ab7329fdf16dbcd9473caa73faeaa38b9a6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888275, "uuid": "61fa3132-3bce-4fbc-89e5-8f526dba2343", "comment": "Malware payload", "value": "9a3848a1c6e004438df896936025e81c0ba6859de614ff8efeb1b8702d81c1f94927f2bce4234b6a9b396cb5dc093ccb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888275, "uuid": "80e9d855-c694-4cda-aaca-fe262dfbfd42", "value": "T1C5115E6F66512CE5C228DF00B8BEB342A326E24260F03FA6F7DE9B75809B4103602E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888275, "uuid": "ecbd82c9-c90b-40f0-a6b3-82ffab0f99aa", "value": "24:eS800j8008800pg800N800e8007U800380048W:eS8Vj8V88Vpg8VN8Ve8V7U8V38V48W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888275, "uuid": "5eb783d3-54ec-4282-a5bf-4efa3888c068", "value": 1010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888275, "uuid": "79c89098-29b1-4db9-96a9-aa28eaf01d55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888275, "uuid": "9f247c62-2b65-456d-bf0d-9b979f86e08d", "value": "router.totolink2-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aef6673-d13c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764871760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871760, "uuid": "a2f2c9c4-79d8-4361-be0d-bf9498c9bfdc", "comment": "Malware payload (Mirai)", "value": "8011242e9030c50d0ae86f16a9c1ff11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871760, "uuid": "0f719fd9-f17d-4ad5-8b43-655d2f704c77", "comment": "Malware payload (Mirai)", "value": "56fd5d4333fa13c78a6f807e299e3ebcba051be0d74208f80e9f5e0d2d008162", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871760, "uuid": "229c5ed6-473f-4c0f-bee5-80b2dff4f245", "comment": "Malware payload (Mirai)", "value": "4290bb74b67f91bac4886db31057a93c6d9a6e6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871760, "uuid": "933669f6-4661-45de-bdcd-9189ce9c48ca", "comment": "Malware payload (Mirai)", "value": "fc3a8e8cdfbf27fffbeb63092b58487ccb3bb2be2a4b4f4e44f51cac0274f6f80bde6e2820d9aa4714e8f5715534f44e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871760, "uuid": "c4191d4d-62e9-46eb-b78e-6fa630e301a0", "value": "T1FDB35BC4F287D0FBE85601303176FB375E72E9BE2229D983D3B49A767C12A41D41669C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871760, "uuid": "3eced10f-c745-4fc0-b5a1-c91749b923c8", "value": "1536:miWFwaS4Y4/VbJKZ1KZK4rTCXMde2AvVUE/FHXiHtbEzx03S0QZsw:tP4dbgZ1KZK4voMKV9/VXwJE8QZsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871760, "uuid": "52a388cd-9499-4c3d-9829-e1705c23426c", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871760, "uuid": "acca1d83-7ac9-4baa-9b75-f92716e3b207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871760, "uuid": "61b61c9f-0e2a-485b-acc3-6b59d1d9ee00", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e568ea4-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764831017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831017, "uuid": "9ccc736a-a8c7-42f8-a82c-9fe92f0736ee", "comment": "Malware payload (Mirai)", "value": "ed13a196a4acf647ca31691cabd6ac3a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831017, "uuid": "b4325918-753f-4c27-a41f-e5cba7201b61", "comment": "Malware payload (Mirai)", "value": "5713186c5549f7aea5d71848626b9292a509d390efe8bfd7d4cc41ef9b73cb25", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831017, "uuid": "e38c9c86-6628-4a0e-8297-330fc13b0984", "comment": "Malware payload (Mirai)", "value": "86fd1c4d29cccbcd9ff87bb1dee37f1701c33021", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831017, "uuid": "59b5d661-54f8-4ae7-895b-06f8a4ab8b52", "comment": "Malware payload (Mirai)", "value": "934991c7ff34f2a85fa628e24dd96c9d0546b459ed24edbb46bf8917a29ddf5ab66425fd23bf906d079f205bb686f34e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831017, "uuid": "47a43b26-c608-4bd5-8a00-a3580cefc485", "value": "T1831182BA02E4EB43191E4F48B89D804CB6D6BDF4F4B54D68E8C6C83474F63092395BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831017, "uuid": "bf93f0b7-7653-41f5-b4f0-f4436636a14c", "value": "24:3J3jN9KjwNIBN8bK455kPWQPdcNdlNw2ls6ofT9Ril0UstLGQUNtoMHR:JN9KjPN8br55kPWQVydT5ls6ofTjNUsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831017, "uuid": "91598e92-0ff9-421e-a778-7fe43a23eadd", "value": 1078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831017, "uuid": "082c1f88-ceaf-4e68-a877-e3414f9fd210", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831017, "uuid": "1937571a-b444-41fa-8dfd-cda8ac565d84", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442a10e8-d134-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868286, "uuid": "10c070ab-2e4d-4888-b4b8-be8648a2569e", "comment": "Malware payload (Mirai)", "value": "b0827defcec04261cdc6a2379d0e4c25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868286, "uuid": "e73233ef-b8f6-4006-ac4a-ae66e3189863", "comment": "Malware payload (Mirai)", "value": "5719932ef5336b327031fa78a3dd5faedd0ba67b4421d4c5b7fe4ad1ddb50229", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868286, "uuid": "c97f4d67-a849-49bd-ac81-645249033200", "comment": "Malware payload (Mirai)", "value": "b81902cc9988453b4b4a6b52aac3909c7bc64221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868286, "uuid": "481a0049-8e73-40c9-b2c3-4e220b226255", "comment": "Malware payload (Mirai)", "value": "1902468286d805d9e6f2162bd4f4d474ee76e63a7e415c7fd7e4ad48ed9031ce8b726b0fa79f36f3359a94b917df9527", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868286, "uuid": "e4c0f96a-0715-43af-a081-612a1dbb734c", "value": "T1DB737CC6F643D0F4FC570470207BE7375A32E1FA1129EA43D7A89A72EC56602E616B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868286, "uuid": "d5048817-fb6d-448f-998e-8a24f6d3584c", "value": "1536:wp6kfm+q4sX4YFAO+PxV9T8x/ReOSpwPH5oyhg35f9kfzM4NSNTQ1SPN:wAkfm+q4S4YFl+5V18pPyye3h9uIv7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868286, "uuid": "b8169377-9709-4595-873b-c66ece3ce905", "value": 79280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868286, "uuid": "71509518-d99e-4677-a60d-16cc52b3a694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868286, "uuid": "bda4aa3b-b9cd-4d47-9284-b7df543ef05f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb51c208-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875384, "uuid": "f043da14-1c64-4a15-a64b-369f8ae5056d", "comment": "Malware payload (BlihanStealer)", "value": "41f201eb1884a2ef999fd7287d2122b3", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875384, "uuid": "1dcc4b0d-0dcf-49e0-8523-ae5fcb6699eb", "comment": "Malware payload (BlihanStealer)", "value": "57d0005b26ab777f4b7f50e10cb816f480623f574cfd36fca08285bedfda8a7f", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875384, "uuid": "57b83d8d-41bc-4189-a5ff-0483306b4816", "comment": "Malware payload (BlihanStealer)", "value": "0d2de16199c182ec1ea19ec1e6436ef4fc2f822d", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875384, "uuid": "06c78471-f18b-42f7-9fc0-2f28fd6e4d97", "comment": "Malware payload (BlihanStealer)", "value": "af68205ef09e8f6022c0030bf8df364ddc27c2ffbe94b22f70791b4e3989b22578bc2071bb1ac4bc37caece6cf186da1", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875384, "uuid": "f1f7a4d8-7182-433a-84b2-0ee49dd4ed1f", "value": "T17BC3E70B5EB1CCDBD840043A57FAA22D86EBBC440DECE35697DDCC4634D2918C8AEA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875384, "uuid": "6aaa65b4-2872-4946-9f15-6ac55c0300c1", "value": "ed42d4abceb2444958dc2f2ce7063809", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875384, "uuid": "04e50ac5-feb6-4172-b662-64c66b67c910", "value": "3072:lAo1lOwvlKlXBP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKZ:W9nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875384, "uuid": "71c26b6d-6d75-4528-bf11-a1313ee46566", "value": 127986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875384, "uuid": "58091d7c-b200-4af2-9551-954310060e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875384, "uuid": "acc288c6-e47e-4695-b2ae-4e5e438c1cd5", "value": "c87kb1r7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bf3218-d13b-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764871246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871246, "uuid": "8d8a9e45-2eeb-4380-bc2c-fe4d10d57c0b", "comment": "Malware payload (Socks5Systemz)", "value": "8ef96dbd15784f8e481e275da8c2dec3", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871246, "uuid": "ab20857d-718a-4a64-a9dd-2182ee4c22ac", "comment": "Malware payload (Socks5Systemz)", "value": "5945f42f5d92adfa37b376f3639ff2862beacf4718ba9b38ccf9148089c3c577", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871246, "uuid": "8bec4e2a-56a0-40a9-9ea5-5b6a1407f454", "comment": "Malware payload (Socks5Systemz)", "value": "3b7bffc9eebc57fc6d93e88461f111fd3959a5f4", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871246, "uuid": "93b21faf-3d80-467b-82fe-c195e2f3c5fe", "comment": "Malware payload (Socks5Systemz)", "value": "56018c9ef966442ffe615824d4e0d69352970bc5a81bc20c338ab0b6325785cf20897d39c358db8b53188c6b1291cb53", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871246, "uuid": "79173140-d126-41ed-b1b7-03f7c4c68df1", "value": "T1AF16338BDCC41CB3C402FB7A4E455412FC7E59B28BE5688261DDDE6D0F6D4A368036EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871246, "uuid": "2c2dfdb4-9369-48d1-bb3b-4d68c5998fb3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871246, "uuid": "02bcd6f1-de83-40a4-ba8d-b12b5fad4071", "value": "98304:M+PSbcTyvoy8cGQA1vjRocF25FigmkCMadIRIy7c4uX:nP5TSoDcGQilot5Hmk5dq6uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871246, "uuid": "624f4de7-3921-4c4d-8d18-772e7864e953", "value": 4084631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871246, "uuid": "99b2355f-a5e9-489d-b0f4-ab7da8b46679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871246, "uuid": "66f2ab69-bd94-4436-9e92-6f2579e12b13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa5493a-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764834661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834661, "uuid": "f9461778-1e78-4e48-bd5a-e954650cdec3", "comment": "Malware payload (DonutLoader)", "value": "ef6aa05844e6a96aade460371135e959", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834661, "uuid": "a4edea6d-99ca-429d-b973-2aa9606ce009", "comment": "Malware payload (DonutLoader)", "value": "598ffd82d04b569216f966118d2674619d220d5240b491180f0b883f352c3519", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834661, "uuid": "e0c981d2-7e27-4c75-b2d9-aa7237d02fe8", "comment": "Malware payload (DonutLoader)", "value": "f513d7fea4efa00cd7cab9290a85a95a1a83bc06", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834661, "uuid": "542d10a5-f6de-4506-b194-c2edfe8c029c", "comment": "Malware payload (DonutLoader)", "value": "047e56a08c8edadba62639142301be69ac15ab993b80481939264ab75ce42c690e094e3be114edd2c0104a71e6b1f2bf", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834661, "uuid": "bd3f1ade-bc93-4439-868b-16bcad00fbef", "value": "T1B1548D15BAA810FEE977C17CC9428906EB72BC464761E7CF13904AA62F277D09D3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834661, "uuid": "793ee8ef-1abb-4785-be45-aa96da79ab7c", "value": "53e19d5243b4f25d48df742c8d94ac9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834661, "uuid": "96fdbf05-f35e-4a4e-9f4e-4f05ff4251b9", "value": "3072:mfRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OlVCxFUM:mfRbGY6EDNNAuHe28Pl2ncxlYvR2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834661, "uuid": "b8169526-5a52-40d8-95eb-f9386a3fe013", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834661, "uuid": "5dbd3498-3adf-430c-8b1e-b43bbbf81097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834661, "uuid": "3fcbbc7a-a043-4b2f-b043-5434930f3f19", "value": "BrightVista.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d670074d-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764873255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873255, "uuid": "ef1ce97c-ac3a-4c09-ace7-67f7829e4625", "comment": "Malware payload (Mirai)", "value": "5e5fc332a7bfb1be9e3245ec10a1c6c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873255, "uuid": "6098f07f-db97-4637-b299-2163296969bc", "comment": "Malware payload (Mirai)", "value": "5ab2b42019024fbb50d64ef764f4b28e097df99cf4261b47b02048fb0ef8537e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873255, "uuid": "610b68e8-b5e9-412e-ab3b-3d5047aad02f", "comment": "Malware payload (Mirai)", "value": "7bb0cd1cdeb8ff39b7250d890aab1ee593a1033f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873255, "uuid": "206be964-7efe-4a40-a862-0f19e7f55471", "comment": "Malware payload (Mirai)", "value": "175f3c57b4cd9a38478281d6f2c120e9eaffc276709d4b070f5207e86e1582580e8646fe2877337ba313f03710c69578", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873255, "uuid": "956d7bd0-815a-4004-88e0-16c1e62361f4", "value": "T1BA13F106D5854143EE7D63B670FF146B18BCE2087E48C123FB805836AD46FA97A54F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873255, "uuid": "dddc97cd-4600-4de8-bf4a-788b6401ee6e", "value": "768:Z3Us0SfzWpt2M+XxrBFHkNX0y6d0HeNDhmbUHJyTNTs0fanWiVWAV5JIGse0nbcw:S2rWptIhr4NIdo8hmQHcTFs1xV5JI+0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764873255, "uuid": "e728a37a-14de-4027-b81e-69ac93509ea0", "value": 45424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764873255, "uuid": "6c520aa7-c9d7-4f63-b486-9a0e90b79ec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873255, "uuid": "bcbbb2df-a9a8-4b89-a9ed-be33b91aad06", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eef3e39-d10b-11f0-a129-42010a9c0007", "comment": "Malware payload (PythonStealer)", "timestamp": 1764850587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850587, "uuid": "6c4bfb9b-50db-49b4-8a01-301b072c10a7", "comment": "Malware payload (PythonStealer)", "value": "e595e2df7b009ea7112cba69a29587ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850587, "uuid": "49801e8a-ec82-4e9e-9066-e4f35149f8b7", "comment": "Malware payload (PythonStealer)", "value": "5b23ffde14ded47db2da71ee63d68ef275b9479e89b1f79c194b55234889218c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850587, "uuid": "e81fa882-930f-436d-a38a-7d6cb293e50c", "comment": "Malware payload (PythonStealer)", "value": "678dc9d2ba7ec3a81a036d58178d9e3aac6af22d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850587, "uuid": "5de3b0f7-71db-48c4-bf00-3cd96edfd628", "comment": "Malware payload (PythonStealer)", "value": "30761f4db91e2222cdb31b1a9c555e6916bc65e5d985493391327440121a48cec62f11c6c01c9c4c0fb4d951a351927a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850587, "uuid": "d9c7b795-0f5d-4f3e-bdd4-c3d9d2e8b034", "value": "T12F763392E2E3615CC54AF1F15AA784E2F135BCF95E31A47F439AE3346663D90CB242C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850587, "uuid": "bd5e8a65-3699-480f-ab24-99c17ddea781", "value": "fc3b0de2e7f988c46ed9c8e46a804071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850587, "uuid": "3f03f858-c2c1-48a8-9900-7fbe5de4c1c5", "value": "98304:rTED+LxOqGhJ6O32sEZD10UfAn0WJpX35WFlXA3ChYO7CZSQUNT8ROls7q0MQ7d4:8v6iUtfmDjXUFySDWBgT2OIxFeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850587, "uuid": "fbea6d2b-3882-449a-833e-c502b2141e42", "value": 7158272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850587, "uuid": "b101aae3-6e94-43ff-99b8-55c4eff2b1db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850587, "uuid": "79cc8a18-0ee0-4d5d-8b0e-5f76bf2570e3", "value": "5b23ffde14ded47db2da71ee63d68ef275b9479e89b1f79c194b55234889218c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c5039f-d0f7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mettle)", "timestamp": 1764842065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842065, "uuid": "59e7f1e1-cb0a-4575-a0e9-cff2fe70efd0", "comment": "Malware payload (Mettle)", "value": "22a22386717eb5df0f1f4c7aeed70d75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842065, "uuid": "877f9ad7-b660-4319-8692-bf0630fda99f", "comment": "Malware payload (Mettle)", "value": "5b901a2cd967fff9d5f3effcb09983609a224caf08b12d218febbf488074e55b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842065, "uuid": "8901199a-f8a6-4787-88b5-681dcd10ec2a", "comment": "Malware payload (Mettle)", "value": "a7e5aea1fb003ebff71391e7841db6c0045d6c08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842065, "uuid": "f57d2e65-ffa6-4b25-99dc-b96b761c2e8e", "comment": "Malware payload (Mettle)", "value": "faa9348f5adfd39f9c11cd868376dabf94f152d0a8173f75defc4215e6f790c29011a64e883f4b2ae6ae6cd13e92c121", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842065, "uuid": "91fabf11-23aa-46ef-9700-50989e8ae3e8", "value": "T157357E0BAA9504BEC5F5C470875FC233AF71B4896212367B2694EA303E67E346F1F691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842065, "uuid": "fd0ead33-584a-4359-ba8d-fa018c441557", "value": "24576:kxW5r2UZu6+QO7UAlBKsBWrTPlE0hi/djV:75r2UZd6UAlB70TxiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764842065, "uuid": "9ad2fbe1-98e8-41dd-a3a5-e3d45bae6d81", "value": 1121480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764842065, "uuid": "7f06aa3f-e627-47a9-95fe-802f22ebc669", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842065, "uuid": "7a808af3-b5ae-414f-809d-71ea1746021f", "value": "googlebot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf710b1-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829084, "uuid": "365f93c7-e519-4727-813d-6f163c20e557", "comment": "Malware payload (Mirai)", "value": "39711290e77ba7f4eebf2a0456c61b62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829084, "uuid": "025871ad-95e9-485f-9a05-49380117b600", "comment": "Malware payload (Mirai)", "value": "5b92a13f64c3568635c603ac6898a9ebda67c15dbba29e422473a0d166c59669", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829084, "uuid": "5285b8f4-316b-4cd0-a177-118919a011c9", "comment": "Malware payload (Mirai)", "value": "d7b6c7d288e3c0a71c830ed35a4d1175548b68c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829084, "uuid": "f904dc2f-12f7-4a6a-80c8-54be27eb2d87", "comment": "Malware payload (Mirai)", "value": "4f629bd0ef3551241e3841fe0d8f4a0c867bede60764a927efdb823628c2230de8f4f80c3d0328fb90311f01cc03ee75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829084, "uuid": "e8d6a340-6d65-4878-bc78-381419bb08bd", "value": "T19DC3AE97F78B24A1C86146F007C76B8D3EA362019E6BE9E76C1E753B193A1DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829084, "uuid": "a8ed1fb6-d821-49bf-a3f8-66a500bee414", "value": "1536:nq189r2mIHgqH8INi8TNB4ZPLaLWq0IijTQEE8+FCUxZJ3eg9w/LWg:q1ur2nj7BZqZPLetETQC+FCkeg9wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829084, "uuid": "b6c3ae49-709e-4257-a17f-f4057a6c7979", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829084, "uuid": "4ca4a270-c9fa-4064-8765-2c4afcc5044f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829084, "uuid": "20caa4b1-f3ba-4798-918c-da8389c2fce8", "value": "windy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf85e21-d13c-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764871871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871871, "uuid": "9ef85340-a0d2-41ec-926d-1afc51f729c3", "comment": "Malware payload (BlihanStealer)", "value": "c0706481610e79463300156224d829d0", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871871, "uuid": "edee1f6b-2bea-4511-8371-d35c635d350a", "comment": "Malware payload (BlihanStealer)", "value": "5bd2439bd43dc4aa9d534a533d50b881e13d647cf5409f4e0c5521560f8d7dbe", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871871, "uuid": "ab1619e2-1d68-45d4-b71c-87d102a270d6", "comment": "Malware payload (BlihanStealer)", "value": "35d244e238e0c2ada91e8dfbdb0ede0da33c6e2a", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871871, "uuid": "efb2acd4-9355-48b4-b9a8-8eac082b5ff4", "comment": "Malware payload (BlihanStealer)", "value": "100fac0937eb8d0030d74b393eaf5246f12dba4183d63502ae8d7c76db79b79468938b25e760d53aaadcfee482e3674f", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871871, "uuid": "01be39bb-04e6-4771-8234-31777dd25716", "value": "T19CC3E70B6FB18CEBD841043A57FAA22D86E7BC440DDCE35697DDCC4634D2918C8AEA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871871, "uuid": "9ba89972-7d25-438e-b4bf-2b4c6b636855", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871871, "uuid": "1842ef34-8655-4f38-82d0-a56b9c99f1df", "value": "3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKp:eene", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871871, "uuid": "d44366e5-6ee9-4dcd-9c43-3de896dbc8d3", "value": 126686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871871, "uuid": "3e85db59-9cc5-45ee-adfa-6647f630bc9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871871, "uuid": "4ec2eb00-c1ca-4f41-9710-3867ae50d221", "value": "microsofthelp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cdcff3-d0a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807271, "uuid": "b3d6e97c-aa63-4251-aac3-a005d54527e3", "comment": "Malware payload (Mirai)", "value": "4167f7e7c12ac59e55abe371bd2140e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807271, "uuid": "8d3e8494-ce0a-4406-97b9-cba40f4d926b", "comment": "Malware payload (Mirai)", "value": "5bf6b8692db0a766e585d94494de000e3d3a8d96ffe836b59e99c95171ed2ba9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807271, "uuid": "f4a32aa9-2932-448f-aad3-8802e6bbfc71", "comment": "Malware payload (Mirai)", "value": "fc7f2bbd57abc84a3a7cd4da90a316974391d739", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807271, "uuid": "38541599-a222-4e0e-b336-298ea21a2ab9", "comment": "Malware payload (Mirai)", "value": "1fee202556fa3114c7a83a9692e3f6136836688b7b4caba4f6ed0931199145794d96adfa5b461514b9b9614dedef3706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807271, "uuid": "15101e2e-c66c-4e7c-8d79-fccf9b4f12e2", "value": "T1BF13F182073B8E74C03A9B711A06FBA4EB567D4B5536541F1C7CF7ADC87AAE03626302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807271, "uuid": "0ff7bea6-fe34-4b38-8496-c699ae1ecd90", "value": "768:iUde21ehSg+qDoyKc4vwgY8Sz7AOdHhEihaCmIox7BlRWBNVAuQx07t:iAe2yDRKrVY8EhHhEjWiBlRfzKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807271, "uuid": "1702f38b-6d72-4784-a00e-e750e80bcb1d", "value": 44708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807271, "uuid": "caac4e52-bfa7-4fe1-8cf6-e9fb7d63bdf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807271, "uuid": "ac952eef-fd3f-4689-b04b-d5e544b51b26", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44498f9a-d0a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764808156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808156, "uuid": "91b9aa81-af95-4ccf-a3e5-a7d0a9c61eae", "comment": "Malware payload (Mirai)", "value": "c064b3c060f2afed0b8b95470b2536e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808156, "uuid": "8b5e3135-2e9b-4493-b222-41924440f500", "comment": "Malware payload (Mirai)", "value": "5c16a921896aa31ef14ff936522fbef6fc7391409b027504b42ad862708c985e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808156, "uuid": "8759ad83-fbfd-41a7-8bc9-4f8ed8a568d9", "comment": "Malware payload (Mirai)", "value": "99f8a43af061d17bc62aa7fa5a140e6afc506e83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808156, "uuid": "78c37512-9ff7-4abd-b9ff-5fcfbedb4738", "comment": "Malware payload (Mirai)", "value": "486cc993601a3d3c90374964d9527dc404643a25fc00eebb7f426029bba8713409b42e8849f00bb48c0eeb9ed8dd6ab1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808156, "uuid": "fafc9677-8d1c-4d51-84d3-4668fd1080fd", "value": "T1BD040A56FC81DB12C5C1117AFE0E524E33131B78E2DEB2129E24AF357B8A96F0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808156, "uuid": "a90abd0b-451c-4de1-8452-1833b7ff06cd", "value": "3072:MjbOlutDeGVzsxe0tBDm+WURvnetoX1bLZyWa4xWiDdZnIZ3lH2+tT:MXtDBMtByPevQoXtLIWa4fDdUH2YT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764808156, "uuid": "be6c5730-0e87-4964-b4ee-8541cd469b86", "value": 187596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764808156, "uuid": "a842cf01-cf62-4f16-b552-998b8c0ebd26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808156, "uuid": "9a19d628-aaf5-4d18-a86b-8e05fd09e5ae", "value": "sync.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd572c2-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880863, "uuid": "8326c81d-4bef-401a-9af9-1cd75b541cbb", "comment": "Malware payload (Mirai)", "value": "bf394239d9cc60e6981a859326eb58b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880863, "uuid": "c5d73f83-8abe-4cd6-b3cf-0a5283391da8", "comment": "Malware payload (Mirai)", "value": "5cbb5a492b911278645048727e1dc3abe59c8b566073cfea66ba58055d8a547c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880863, "uuid": "888b8f06-8b60-4ad8-8436-1b45dd38e59d", "comment": "Malware payload (Mirai)", "value": "e3e06ab83c8b6c8c7b848ef3435958554fdeb64e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880863, "uuid": "f95f2b37-29eb-4267-ab27-ffa438841cdf", "comment": "Malware payload (Mirai)", "value": "47a16a100c2fcd34455467d4f3a54c6d9a58a3beefe5d52703e314d84b037c9a8116d6b234167c62ab37fe791431a2b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880863, "uuid": "798571b8-d6a8-4de5-91ed-4c00b66dd9e6", "value": "T173231855BC929B66C2E0277BFA6E418C7310A3ECD2DB3253CC291BE4768552F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880863, "uuid": "ec0695c3-9af4-458d-b98b-88e118e78a3c", "value": "768:wD6dZmaoGjgzGaywdZuMfHnD1NC8saEDoCerCFg+JcNbm4jNAPzI329uGpEX3TJy:wkmaFEGarS8sxg+JcNS4jNIc329usy3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880863, "uuid": "107d46d9-c101-4029-b8b4-7b51df9fc27a", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880863, "uuid": "82312924-cc58-42ed-9819-4e2380e082c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880863, "uuid": "afd35494-d64b-487b-ac7b-342fd2cf0a0f", "value": "DEMONS.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456eba47-d0ea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764836505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836505, "uuid": "a8c85cce-cc90-436c-ba15-4e2ce14714a0", "comment": "Malware payload", "value": "2370d2e6035345274526a97470c281e0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836505, "uuid": "f76203cc-126e-488d-a541-cff2cdc137f6", "comment": "Malware payload", "value": "5cea07b88779ebc3c61b75f5e2b932b88b6e91bbcc9491de8747d82a22c6ad53", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836505, "uuid": "820fe866-251b-48a6-ad67-72628c67dfbe", "comment": "Malware payload", "value": "acf9eb804e895c15b9ce78e3a4f217a4716bc2b4", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836505, "uuid": "a4ca8072-79fa-4ad4-8998-ab9ffe6fd4e8", "comment": "Malware payload", "value": "9cb5fe1fb2f2b7932ebff797a12f1c0a198f4976d345e192eedc1830e723f86ae4ae204950da28b24a91fa1cded45bdc", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836505, "uuid": "75244cbd-a474-4023-b298-eb18aba55e88", "value": "T13673324809CF88EC963B7858CBDF9E45FFE58813A61CC795FA4DA9A02F1052CB1E45E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836505, "uuid": "5e4eddc0-84db-4055-9f46-e98e5575cc62", "value": "768:yT0R5ruKdXbbkmPGu5nFnAAewI55j/FeP/TOJ0oGLiCWQsRQALSN7OVDhvGrY5h9:jo5pFeu0oGOCD4rdfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764836505, "uuid": "e6d7bdbe-3fd2-484a-bfc7-2abc775d85b7", "value": 76939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764836505, "uuid": "dd4e9d0b-2de3-4017-abd2-092c2b4593f8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836505, "uuid": "0bc68ccd-6561-4810-94bb-2fa3693e5d19", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2f0d0b-d0a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807341, "uuid": "7e555f78-c6d4-4407-9619-d813df694d28", "comment": "Malware payload (Mirai)", "value": "32a68fa1f700a2863958a9abcc1790f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807341, "uuid": "d29d1a91-08de-4c30-84b8-ef94df50ea68", "comment": "Malware payload (Mirai)", "value": "5d6062ed141140bd4ff90ec719ff451309bad24df58ba10169599ce8556f9605", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807341, "uuid": "9bafdcb9-4764-4078-9baa-b8574dae1447", "comment": "Malware payload (Mirai)", "value": "257889afc3844e70375644caf85d494121651627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807341, "uuid": "4a95fe8f-1ac1-4f3a-b88b-f3bd69acb064", "comment": "Malware payload (Mirai)", "value": "47d83bea0c4c2fca24007c98df716bc2611f6b57e7cd582b73ba2f052b9ce29b661a36accec2ca43a4563f98c816e783", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807341, "uuid": "6bf78f53-6135-417a-9f5b-d0aab3ed79a7", "value": "T104A34A07B9C084FEC5A9D13847BE7137C431F4AE0239729B17C8FE266D8EE601B69596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807341, "uuid": "cca8fe84-1eab-4e06-8e6a-1d078d664371", "value": "1536:OKscF+lQ1STTxCifFc1xt80uHDBMpNNqgWRVLhU9uVCh0ZwP9hJ:LXz1STTxCGKzq8qtVLDVCh0KPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807341, "uuid": "48ea90c5-f783-448b-87db-0edffff3e0cb", "value": 100560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807341, "uuid": "3437c648-9f10-4ea4-b446-2d5eb4bf6e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807341, "uuid": "5b4ac2b9-6f62-4132-99c1-6d5b75578f9b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee769a20-d131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764867283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867283, "uuid": "017cc61c-aee5-4d90-aeef-b49d3d4871aa", "comment": "Malware payload (Mirai)", "value": "b153e5ddb2d02173707dd904b245abbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867283, "uuid": "e3e60ac0-40fe-4ef4-a17b-fb37cad3d627", "comment": "Malware payload (Mirai)", "value": "5e3a7be0a55cd89e7c52b3d931f82beba847184d02a09bd7f3fd3d1ddf516de6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867283, "uuid": "d92e1f23-34f2-4a6b-bde8-bc854c25775f", "comment": "Malware payload (Mirai)", "value": "2ade1356e59352ed2f27ef79603fdee08d30eeb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867283, "uuid": "9f6f10fc-8d98-444d-8d67-19f93db6d201", "comment": "Malware payload (Mirai)", "value": "8586aa834721a18b81c1921772b15f5abab994c1e170b04bb0a6b0846de81571a694eb14dfef3c643882e5c85ae797f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867283, "uuid": "097b5dc0-318f-48b2-b3f1-15c281e93a1e", "value": "T10123F13294FCC600CC77167951FFBA5F8902E12D89041A5AE8C842BA57C3A766F7CAD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867283, "uuid": "68753272-7ccf-421b-be81-5413d909851c", "value": "768:BVBV2mJB7+0d8IGUS72l6X3i9aZKbsgBQN/2WG9YYSnDmPcijbozIJqnbcuyD7UH:BV6mJB7+k8Ie2l6XLZKYWL2YqmPlXozJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764867283, "uuid": "92b3641d-2e0b-4c5a-9367-82641ca9c6cf", "value": 46728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764867283, "uuid": "9dc0301b-1ec4-431b-b456-92dcc1a4ace0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867283, "uuid": "96eb6401-3816-4b1a-8850-63c6925fe89c", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcc2e16-d135-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868812, "uuid": "5e56a191-643c-4ad8-a207-f7d906d58a3f", "comment": "Malware payload (Mirai)", "value": "e61b674e5d586843b08ade5399ae5a07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868812, "uuid": "9a1532b5-03b3-41d6-8f8f-cab16498774d", "comment": "Malware payload (Mirai)", "value": "5eb126021b56aca27047ae2bd07b9f0eed7a0497806d96c484d8d91fe253d484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868812, "uuid": "41b06c10-9b12-44ec-9b34-d8a9a370d846", "comment": "Malware payload (Mirai)", "value": "26b3fd8e4ba9f2493e0f9dcb61bb3c997a261c09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868812, "uuid": "23c9f88d-d630-43a6-aadd-76042a41a75d", "comment": "Malware payload (Mirai)", "value": "efa4c0b17b78b7217c93d099b65af2a1c0c3eec0eb2f59fcf9859fd67a047cb48094749b9580567896e7b5edf409bb5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868812, "uuid": "fa947a10-4a76-4c84-91cb-7c73a4699a6a", "value": "T162D39D8BF78B04A0C86306F007CB0B9E6EA321D15E5BD9E37D29A63B5E754DB0905BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868812, "uuid": "db77c98e-b4f6-464b-a2d2-95c57007fa33", "value": "1536:cNPl84Yxdno7UIc/dfzGm4GPOhaHwoVc56cNlO1ZFAx6RRgsKA+/LWB:wl8HW73Ifam4IWaQ6c56goZF9gsB+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868812, "uuid": "8d69292d-c5ca-4e74-bd12-cae42698306e", "value": 132688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868812, "uuid": "a7f14921-6261-4431-878e-323c932bb5ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868812, "uuid": "de9fbe1c-523c-4cb2-a0e3-0e029eefd6e3", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fc277c-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834514, "uuid": "454383b9-7452-4350-b34f-38e19a67c698", "comment": "Malware payload (Mirai)", "value": "2eff8e02b21f5a858e32e48bc9998fca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834514, "uuid": "107d106b-a361-4224-894f-45af070f0049", "comment": "Malware payload (Mirai)", "value": "5ebad3c86772c9171e79ab9ea43205f2ecbe113176cd1f9324564d08ca34b441", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834514, "uuid": "1e0a4047-02ff-4384-ba61-f4f348d89d2c", "comment": "Malware payload (Mirai)", "value": "661350357191ad4db44c26adcbdf6945dc84e54f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834514, "uuid": "b06ecf30-c91c-49b2-abc3-c43a6418228f", "comment": "Malware payload (Mirai)", "value": "b215dea7cf22b1b32ad64d7d0987308b6a93356b864757ac18a680603bfbd95bd77abff9e75d9f5c447891ca88b28cc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834514, "uuid": "fde030cb-365e-48a0-9e9b-8ec72c51af4f", "value": "T1FA231855BC929B66C2E0277BFA6E418C7310A3ECD2DB3253CC291BE4768552F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834514, "uuid": "47859ca7-4f94-48b6-953a-2a356faa7477", "value": "768:wD6dZmaoGjgzGaywdZuMfHnD1NC8saEDoCerCFg+JcNbm4jNAPzI329uGpEX3TJQ:wkmaFEGarS8sxg+JcNS4jNIc329usy3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834514, "uuid": "5adb3e9b-e982-47cc-84df-d148fd3beab0", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834514, "uuid": "d422a854-4794-4143-aa4e-b022a0697a38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834514, "uuid": "8a2cbc32-3229-482b-a38d-94cb63fbc1ba", "value": "DEMONS.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce5396e-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834585, "uuid": "ca021685-713b-4d3e-857f-cc8008b5ae10", "comment": "Malware payload (Stealc)", "value": "75b5bdcefda1508570b632f297d9bed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834585, "uuid": "ff0b3051-0afd-4684-8812-fb9db3836f8b", "comment": "Malware payload (Stealc)", "value": "5f14beaba244bd8335e26210102783ffc5d7d49cae2a870342e9e911c26d0da8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834585, "uuid": "fbe122a8-7bdd-4352-8b23-6faaafc5bd43", "comment": "Malware payload (Stealc)", "value": "43472ad0b6cf4db8fb3ab3e8f6e9d7bfda6af136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834585, "uuid": "e4110b47-c120-4b6b-b456-d4b55336bcf9", "comment": "Malware payload (Stealc)", "value": "6dab4d5f9c577e42b16bc13671f600c40631fcefa9dcca2e4691c8201ab1ca933330b49f20db222ca2d45da3928f371a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834585, "uuid": "97c04c52-5756-417a-89bb-da00a8eaab25", "value": "T1ED058D1AA7A503F9F0ABC2B5CA424442E7B278065770975F03F1DAA61F376A05D3FB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834585, "uuid": "22266091-8a69-46cc-813c-da825e96846c", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834585, "uuid": "03d4d265-c0d8-43f2-a257-8b5d25db3cfb", "value": "12288:eGLVpIo/cBJ9InRPehbyv8plnErFmmRJqv3YZtF15kjHb:ekkBJinRP6bw8TE7RJ+3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834585, "uuid": "48e2513f-920b-4751-b7da-9c13610e81b2", "value": 797952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834585, "uuid": "00da4329-be41-4720-b1d4-db0941584eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834585, "uuid": "dec9efaa-d823-4e87-ac77-cde7d734c1bf", "value": "5az5d!z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb9d744-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829080, "uuid": "618f2d3e-7b10-4b38-abef-19c5a07a255b", "comment": "Malware payload (Mirai)", "value": "451308b97aec7a70059a999048189a76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829080, "uuid": "4edae6bc-37f9-40c0-92c1-e4e679dc49fe", "comment": "Malware payload (Mirai)", "value": "604f5a4771fd3954298097546dac94dcb3c08032b37cd66e4252f43de14b81cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829080, "uuid": "b4b7f7bc-20ad-49f8-bc98-e7aa03da1977", "comment": "Malware payload (Mirai)", "value": "4f492dff4ff0d6551c7bbe9317deef0dc901d1ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829080, "uuid": "35ed84fd-19c0-46fa-9f70-3c5d50572520", "comment": "Malware payload (Mirai)", "value": "4560563551ccc7890f977ce4d55edabde7bf6f6a913781b72b5231f1332719847c83db92cab9120a3e9b911ef8ce751c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829080, "uuid": "c265197f-c7b4-4752-8cfb-0e43a9ae297b", "value": "T164935B22B539193BC4E4953722F35326F1F6438A14A88B1E7E720E8EBF256D036477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829080, "uuid": "56da3c72-2748-4f29-88e0-57a51b116d07", "value": "1536:0sRsLVu48xrIz6YqPog6N8HGdtAQkYm5V4A1Ywt15x:0kqLMPmdi1YOyW5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829080, "uuid": "c57e6910-ae06-4f04-b787-37f727a27292", "value": 91960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829080, "uuid": "66b457c9-2388-430d-b98f-d164ab42f728", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829080, "uuid": "e11801bc-a26f-4475-ada1-a9cee9d3069a", "value": "windy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f4dd46-d0e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834677, "uuid": "99e79102-0db9-43b3-b558-58181f2170f1", "comment": "Malware payload (Stealc)", "value": "32277833bdd2d066aa887376a6d0794d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834677, "uuid": "62c9edd9-cccb-4bea-8f6e-29d9c4d87091", "comment": "Malware payload (Stealc)", "value": "60802dee0eb2c897f90b59c6157dbd91a0228f8defb7fda5c8e6d805ab252da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834677, "uuid": "7cef2c47-b459-4298-8da5-839c117e9946", "comment": "Malware payload (Stealc)", "value": "bd84a491a6bf5465439c261ee10a7e9c2554a112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834677, "uuid": "8efdb83b-d165-4cb8-b2eb-9074e6d86feb", "comment": "Malware payload (Stealc)", "value": "e69dd67e4c1a38372d7b5c794f23a5960752f1ec5dab921222ecfaf067b78ec22ea42322dba238ed34d58dd2a736cda1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834677, "uuid": "db40a1e5-0196-4fc9-9d28-e0e65b8b8375", "value": "T14E058C1AB7A603F8F0ABC276CA624442E7B278055372974F03E186B61F776A45D3FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834677, "uuid": "edc24d34-f309-46f0-988b-0c2939791ea9", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834677, "uuid": "d9598c38-b34c-41cd-9202-edf5bac70061", "value": "12288:jGLVpIo/cBJ9InRPehbyv8plnEfZyT7TVv3YZtF15kjHj:jkkBJinRP6bw8TEx+35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834677, "uuid": "63aed3f7-92a4-4e78-98fb-7da3b9a723f6", "value": 797952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834677, "uuid": "5ddca58f-69ef-41a5-b4a6-11df68204bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834677, "uuid": "f4b6dbeb-fafc-406d-8435-887948154809", "value": "neintrcr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14cf244-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829894, "uuid": "c59ca4be-d765-422f-9aad-b26a37fb95a4", "comment": "Malware payload (Mirai)", "value": "55a344a6fd01175fb9429ce63c701cbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829894, "uuid": "8a8dc5d2-4b17-42fa-a84b-3e0fd954468f", "comment": "Malware payload (Mirai)", "value": "60a5fe543c74174f8b121fa0542a1bc362b9e1f238002afca436eb8283a1da1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829894, "uuid": "b4fcd0b7-949d-4e93-acfa-9a60c77c9a76", "comment": "Malware payload (Mirai)", "value": "c2d02b90bd391fe1826220a16c156a90626d0a56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829894, "uuid": "da9331b6-9d65-4942-b11e-015871e1ed99", "comment": "Malware payload (Mirai)", "value": "7f9a3599c6ef9f9e75dbaf30656b49342d6f6dc70215f898e77ad79bb617f1f460f54f769bad2625178073171deb28b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829894, "uuid": "15cac880-13c8-43f2-9cc4-d9001ee8e5fe", "value": "T18DF2E174D1984FD2ED9A8FF425D553DABFF80E4B1721CC527101CF96CA019128D8BAD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829894, "uuid": "7d6c6bdf-cea1-4369-b28c-90d293790b9e", "value": "768:reDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu2VDw3p4uVcqgw09t:rCRocD0Lu/PWUWr/iu6Dw54u+qgw09t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829894, "uuid": "9aa4c9b3-0ab3-4c01-9dee-da58bc6ef4c6", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829894, "uuid": "19a98ca8-a4b0-4a52-857a-3a043fc17354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829894, "uuid": "c4cefc45-39b2-4b52-8aa4-6c6ebab8e8a3", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43016d3-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883050, "uuid": "d8835a0e-6a58-4bdf-930f-909ccbad6e58", "comment": "Malware payload (Mirai)", "value": "4112a2d2754d48fe9a6bf2d958c98bcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883050, "uuid": "538d66bb-98f9-44c4-9c2d-fa1e2b0c0782", "comment": "Malware payload (Mirai)", "value": "60c643a6927053c8368e167e430db86f88995ad718d98277776662ff7082c123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883050, "uuid": "0590eee2-595e-43a2-949e-fc4feb14de05", "comment": "Malware payload (Mirai)", "value": "d5dd95af8e510770036199e59396cbae5608891e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883050, "uuid": "4e19059c-251c-43bf-b822-47e987fa8113", "comment": "Malware payload (Mirai)", "value": "3316bcd1c9fec6ef40a29fdb6e54ce818902f96d007185828abd2f0655e4de30529401a8f88e495ffeb057ab6ed57ac1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883050, "uuid": "34ce278a-f62b-4959-8179-a14a5b81dc30", "value": "T1F283021D7A1366C1C22211FBC04DC9E3132EA9FC11FCA876AE046FD5905915F6F2B9AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883050, "uuid": "d4819e14-f9ca-44cb-8c98-c577b7d130ba", "value": "1536:3Wdm34fiycU0Ax2OUQiss95IQE+/RmMjkHlNg3+pYLZnPqa4bPuFlJEyEULM:3Z4fiy/jAOZo9jkg3uYLmbWAULM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883050, "uuid": "6247fbed-aeb1-4e44-a608-0fd000061494", "value": 87684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883050, "uuid": "33794cb3-7c95-4742-907d-4aa1588deaa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883050, "uuid": "98ef9bd8-015d-400e-be37-c0eda88b0e7a", "value": "ecco.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a64eaf9-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829131, "uuid": "7f91f152-7f38-4fc4-97db-e27a5e40edf0", "comment": "Malware payload (Mirai)", "value": "0455ec8f8bbd4b7e9e3e9dc4bc98275e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829131, "uuid": "0a7853f9-d25a-4e4e-8b4b-164b0ec1f2a7", "comment": "Malware payload (Mirai)", "value": "60e018ed5a9b48c24b959249443d6263744b2b7080f2b05ef1bda8d7a52d08ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829131, "uuid": "6711fb58-750b-439c-bca4-14c63bf71dfa", "comment": "Malware payload (Mirai)", "value": "ea2b5f51bb54cbf4925541871a407168b9020d19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829131, "uuid": "b8bb93a7-435c-4a71-926e-833f2b66ce6b", "comment": "Malware payload (Mirai)", "value": "8b755c5121cdaf3395c624bc3dd3ac7559797b83cc5a61020124dfd3f9ec55f3a23fb135eed3a9f790bcaa9d4c97ebdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829131, "uuid": "37978fda-fb01-44dd-bf8a-8f9c358f42b9", "value": "T1A5B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829131, "uuid": "124b59bf-704a-44e2-986f-e66cf20e8b98", "value": "3072:bdub7djS5HECh6Qb1ShRhFczcmVRh865xe:bdo7djS5ECJSozcmVRbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829131, "uuid": "ba590982-7061-4d09-aca5-5054b25c9ce6", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829131, "uuid": "3486c04b-b7ae-4a23-a16b-8cef937c9c80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829131, "uuid": "708a339a-f0c9-4184-9b13-d783de35e3aa", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961aa7ca-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879160, "uuid": "e9adb56e-54c9-4b06-8724-a0a17546e38e", "comment": "Malware payload (Mirai)", "value": "1d4875e139f93bbaa8782a539f4557bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879160, "uuid": "91c06b49-b1c7-4b69-ae04-511b26f483e9", "comment": "Malware payload (Mirai)", "value": "61131f9c6b278b49e481be72cc6407f0aa6d610b85528a6e2531a2a511099d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879160, "uuid": "34c15f68-3e47-4d6c-8254-78fc78150357", "comment": "Malware payload (Mirai)", "value": "cb24a58d470c1fab545ec639c5471b260be1503f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879160, "uuid": "142c7b05-a27d-4b22-af39-b2a88720d5e1", "comment": "Malware payload (Mirai)", "value": "38971aa98741a2284a1ac189f556746e9e236b75d6c67e366e950b3118bf10c5064396bbbadacb10c3a00273e2c5428f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879160, "uuid": "b3611c72-3365-4c19-9304-c6306c24d542", "value": "T1C2238EA7C43C7DD4D14992B8AD248A3C5B23E016A6933EF67A4785628047EECF60D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879160, "uuid": "14716dfa-e654-47c6-89fa-4a3eeaefeb2f", "value": "768:Da1/jptstaT85n1OMwtg54UFbq5rKSvHGkQpqV5G0KzR7QCGotpe1CtOE:Da1/3s+YjwtgFWKHa5aNMKXe1Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879160, "uuid": "66f9ce3c-0369-4847-b1fc-d752f43aee4f", "value": 47576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879160, "uuid": "6d2daa32-4219-4bff-84cf-d278838df089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879160, "uuid": "71c06c16-2e3e-479c-8f19-3b6c27b5e4bf", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4106c6-d117-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1764855876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855876, "uuid": "aa598087-c20f-4a02-8000-d7afbcc27a54", "comment": "Malware payload (LummaStealer)", "value": "c76830656480516c31a2ffa6f1c57f8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855876, "uuid": "5bce7d44-0ecc-4b80-ae0b-0dbf2e7e2897", "comment": "Malware payload (LummaStealer)", "value": "613bcc83f843d129943420d4ff144ed211ba1c98b0d152cd6bbad9821f3e357b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855876, "uuid": "8edb6b07-f260-4c18-a93b-5f89953d313e", "comment": "Malware payload (LummaStealer)", "value": "4b1f3f77b522c990bf64da8eb80d516b6f742bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855876, "uuid": "318f2de3-6fab-4a0a-892f-205ca2ba9e4e", "comment": "Malware payload (LummaStealer)", "value": "ddeddd4f0866284a4c5525aa1b87a5ccf2a33426ecef5401891be836ec831c14ddfe5dc9440b289c32bd97d2b03beb56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855876, "uuid": "8e7b60ec-d04b-4e6a-a86a-5d9a0bc96df5", "value": "T1E5E49E22F99311FDF4B31034989DF33ADB3A3A158E159F8BD7C09B74E9702416A2661B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855876, "uuid": "2badac9f-20d7-4e37-9abc-ba57c917b18e", "value": "1cb7010fa29c1205e95faaaf21e5a21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855876, "uuid": "232eb761-58fc-46cb-af46-b5f08cc0bb46", "value": "12288:UWCXhe4mhLKlRUQGJNTXar3lSn65wQLtk:UW2mhOoQUTXars65wQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764855876, "uuid": "7d58f792-0e3f-4114-8b4a-061152978468", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764855876, "uuid": "5aa1e316-a2e5-4fb9-bef9-3b728c8b49d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855876, "uuid": "49ca8b55-15e3-4c81-9648-c2cd75625c56", "value": "hopea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279e97f4-d0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764839461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839461, "uuid": "c53198d5-fbe5-4fda-aa4e-ff7ac22f45c7", "comment": "Malware payload (Mirai)", "value": "95f2c4784fb20028a22394e96482247f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839461, "uuid": "d2a84a55-7040-4b16-8be4-18680300450a", "comment": "Malware payload (Mirai)", "value": "61c7a74eab43a2376d70a007b88104da5dba6088d0abaa37b96e62bc363b93e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839461, "uuid": "09abfb5a-0b1b-476f-a421-0c11a42bb7a7", "comment": "Malware payload (Mirai)", "value": "cce2f2ba41d8a9eb3385b5f481d11c083d2cdbb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839461, "uuid": "a11f06b1-b8f7-4f69-9155-c801f39c3512", "comment": "Malware payload (Mirai)", "value": "b081520e54f81f6e876671b8dae9a05a9136ed395b1b8940d07274585ec06aaa1c74580585dbebb20a30f907e3de44d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839461, "uuid": "002572c1-ce58-4e4e-89fb-94ba99eb8bcd", "value": "T12924A71E6E228F7DF7A8C73447B39E74976823D627E1D644D1ACD2105E2028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839461, "uuid": "e2c85353-913b-4fa0-9b40-6fbd22dc426b", "value": "3072:NKUHFltPMZdr0kPnoQEFAFgxxCF9se4TvqBEDQ2vVf+qna3IUAY:VlltPMZB0kPnmFJxxC+zAz21+H3IA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764839461, "uuid": "af74d620-c506-4110-be4c-37e505762bcd", "value": 211172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764839461, "uuid": "a0856645-f5ab-43d9-a48c-bddaa9712fb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839461, "uuid": "215c313c-a269-414e-a96e-93c02133d66b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef40d581-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829918, "uuid": "6f097fc7-1887-4bc1-9aa4-358b8ea0fdd7", "comment": "Malware payload (Mirai)", "value": "f7a49866d3f6c1a314d87d25c64eae3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829918, "uuid": "da022464-7c8f-46ab-99a7-f0b79b52b05a", "comment": "Malware payload (Mirai)", "value": "61ca745008c8f309c964c58de8279db2fde24e3b123c86c57c34838765cc651b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829918, "uuid": "8f3ed4e4-34c9-4f87-ad53-475e3d69c202", "comment": "Malware payload (Mirai)", "value": "705346fd867aaca74c01c7905ff5fc386b514f5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829918, "uuid": "0a870623-d62f-4aaf-853b-eb1c45b580ee", "comment": "Malware payload (Mirai)", "value": "f83c0bf9d08fec3bc5b1c70fdd7df5431cbd739bd8f50d1a2f934c99c16b536381511b4d26eb06bb7fee9ba915e03306", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829918, "uuid": "fbf56a6a-aa6c-4f30-9e61-2b29f4632912", "value": "T12B92CF305126B8F2C3616833E63FC602895503FEC5F6317B275455A8EB8954F2EA958E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829918, "uuid": "9b6d0263-1b4f-4492-a63a-8c9b916f3730", "value": "384:k93CFDMsFGg7EMUTmli2KvZw93KmQxPitrsnIns0t2dfNH8BH64RIJ3hymdGUopd:QCyEPgoKRwZGx04nIns0t2GH1RINs3UQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829918, "uuid": "faf7382a-114b-4992-9a74-559e63b60b35", "value": 20540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829918, "uuid": "c9baace3-18d8-4510-a62e-1afef2e52f4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829918, "uuid": "3f58ef72-460e-4737-8002-e0c03fcb9de0", "value": "ub8ehJSePAfc9FYqZIT6.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf381ff-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883118, "uuid": "fe62976e-9030-40a0-8d53-16884df7fda2", "comment": "Malware payload (Mirai)", "value": "e153bf71ba51ee57ab2827354b17b130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883118, "uuid": "3b9e4d42-7097-4f7f-b61d-09208d5a9028", "comment": "Malware payload (Mirai)", "value": "62012171be467500f2d7259e4a75f347878f096f0ae9c52d475215727ca9ef0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883118, "uuid": "af902302-108d-4b43-8e96-eb1b85e856bd", "comment": "Malware payload (Mirai)", "value": "906cf4b46275592d37bf0bf2b6987623810c01eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883118, "uuid": "f16f1122-ad74-4da7-97e9-ea200ddf482c", "comment": "Malware payload (Mirai)", "value": "a5721b5d93b360a2ba38563c080f43bead9f98aac80fae7135f414e32b836bac48abd9a240a2050bed747a029c1a519d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883118, "uuid": "2c60f8c9-2689-49aa-94d9-2bd7d2bed734", "value": "T107342985FC919E26C6C512B7FA6F028D371A13F9E2EA3102DD251F60378A95F0D3B685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883118, "uuid": "f294e946-99da-41ba-b03e-ac684cba5067", "value": "6144:u6HfT1nH3bvccszsHdARsk1n4HhQueBwQ7D:uEThNMsi4HGhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883118, "uuid": "8bb43695-1677-4c9d-8625-2e3804eea51e", "value": 248864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883118, "uuid": "bfb0526a-d5f0-45f4-b278-39213ef97d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883118, "uuid": "b575cad2-44ef-4dec-a55a-d8c21f0ed6e0", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e57d67-d116-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764855643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855643, "uuid": "e59d4988-a53c-4de4-b2cc-b4035ac8fd56", "comment": "Malware payload (Vidar)", "value": "e70209895398f1053c5fea7067b11629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855643, "uuid": "4c4b5583-d613-4efc-906d-1baf668fbd40", "comment": "Malware payload (Vidar)", "value": "6248de14cbe30bd1726077099e59422f6f3da1ace7eab5157585a8b861435afa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855643, "uuid": "19801506-b10f-4c3c-91d0-b16fd65dd0e2", "comment": "Malware payload (Vidar)", "value": "d5fb5d3f4895af27cd165790a5de932886f7e23c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855643, "uuid": "145924cb-a090-4274-ae57-1fb8aa5ac9b6", "comment": "Malware payload (Vidar)", "value": "e85cc94ee256eabb8cec3ac303446d195652255cfec23110d5e91f0a19f5d3d8597ce0c3ab5917771bf0ea13b68432d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855643, "uuid": "c5e80bff-bd0f-4d95-9740-8c1325699cd6", "value": "T125862941BA91096AD96BE23C5DB162147731BC0843322BD76FE716650DFABC0273FB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855643, "uuid": "7ca86e33-cf9b-4e2a-b8ed-56ee8850b181", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855643, "uuid": "91d11fbf-cf6d-4fe4-bac8-b3c4f627fc0f", "value": "49152:AW3G83RAwNPKpyK1q/NVQfGf8I0GgSWyKRZLc0q9tmDFhMTSwPa:U83KiPKyT50BhRZI0JoTSwPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764855643, "uuid": "8095a02a-e5b7-44da-a113-33e34d188bc5", "value": 7944904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764855643, "uuid": "ae3bc78e-0773-4fcd-9ad6-319d0e0d6f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855643, "uuid": "cb0b5bfc-7ee8-49e4-929b-ba454615b765", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f94078-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806738, "uuid": "3f544517-8ef7-4673-9223-c0be243a1bbd", "comment": "Malware payload (Mirai)", "value": "721530f7446de413b53ab27af0683c0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806738, "uuid": "aef12b7a-9cbc-453e-b450-c93886dd6adf", "comment": "Malware payload (Mirai)", "value": "62db1324eaff1d7ce3c9a955af1c590a6c7af3c83f8e89efdff03df9f5b17eb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806738, "uuid": "4ed003ce-2d7e-4efc-8275-13b5df10903f", "comment": "Malware payload (Mirai)", "value": "b19e09ca1b2b53588885aaef2486685cbaa58b35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806738, "uuid": "cc147a76-f324-480d-81de-559f46a4ae86", "comment": "Malware payload (Mirai)", "value": "bb229779dc3ddb8ed5462fff0c9d74eec61c00e52ab6a762614130fe7c916f24d759df8a2a8d06333024b451f57bc3af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806738, "uuid": "401c6c8b-5619-49e2-808e-fda37fc06e8a", "value": "T1FB533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F413BCA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806738, "uuid": "d4eda7a4-b327-4458-91eb-dd741c6edb2e", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONyEgGhd2G4NMiplImpcvwJZY10UPZvBqJ:0aHuAzgjjfUKU0NONyEgG+7XtJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806738, "uuid": "43bd135d-0f3a-4e2a-a9eb-afb8504da0ef", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806738, "uuid": "4c12faa9-a3ea-486e-a176-f8f5248ddac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806738, "uuid": "ee85e292-95af-4b58-a524-220212f939f9", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0998635-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764829061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829061, "uuid": "bd9a89c8-6929-48b1-9d55-cb41cc39b258", "comment": "Malware payload (Gafgyt)", "value": "972259643ea927fc199ef6f30785b318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829061, "uuid": "1f7114da-380c-406a-ae43-7f90013582b8", "comment": "Malware payload (Gafgyt)", "value": "63177c0f2ddd69a693f9be65f2ce60cbf4283034c0b155b2d2b2743feae1c999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829061, "uuid": "7426e9c0-2862-4fe7-a2a0-f7623fcb1d2f", "comment": "Malware payload (Gafgyt)", "value": "6980eba18a568d0b9dd94243d8fb71fa48632116", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829061, "uuid": "08aec2d0-4718-4552-9c40-0a67d5e3ce34", "comment": "Malware payload (Gafgyt)", "value": "defbad47176ea391707c9aa6c7095e456c969e747203c04452915e908e31ac4fac8106add06a7778a7a7386b3415dfce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829061, "uuid": "73987081-189c-469b-9d26-4247e6c6456c", "value": "T162633A4399629FB7C0866EB565F70A304753FC215F4B1B89722DAAF8070B9CDB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829061, "uuid": "d60edfc7-04a6-46d0-ad8a-c9fd9ccb4a1d", "value": "1536:F1BOKQIQO6TaxQQ7Krt071p6CWG2WrXDJLi+wmk02q5vc6fBnj:FnOKbQO6wt+ra6BmrXDpi+wmk02q506h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829061, "uuid": "9cf1f4ca-34a0-432a-a2aa-9034fc0d8b06", "value": 72101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829061, "uuid": "e5236be2-7091-4f5c-be68-e2cbd225ea76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829061, "uuid": "563730f8-ea0f-448c-adf2-1a5513e16764", "value": "bootingworld.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984f1fbc-d0d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764828484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828484, "uuid": "4229cf89-b33f-4fb2-9539-9db19421b609", "comment": "Malware payload (Mirai)", "value": "ae4cf85562a12ae9c076a9c2bf87812b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828484, "uuid": "9f44094e-7b13-436d-903d-fd1760c212a0", "comment": "Malware payload (Mirai)", "value": "63279f3f99f233979cfda8145e472a523275454c91c7b805f06c23c3879ff939", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828484, "uuid": "55ae526c-3a36-4014-a852-3fc094d5f685", "comment": "Malware payload (Mirai)", "value": "444b322bf765cf1ef42b273290f2208aa3500244", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828484, "uuid": "949bb879-55b9-4d9a-8d3b-420f229ca4fb", "comment": "Malware payload (Mirai)", "value": "b0111907596f44f311f205cf644c57a1cdeb69d1720fb5effd15b4716694aeba3e34486007dccb73eb43a0c7f7b5d425", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828484, "uuid": "0fb7981e-185b-4b67-a6f1-3f175fb283ac", "value": "T18161A2A6218A0AF06D758F63A36C89353193E9EA18DF7F21C5CC37E884BCD56F040792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828484, "uuid": "bdd6861c-95db-494c-8fbf-429666f9726d", "value": "24:ItpAqspJ5p+HpxdTpzQspbFp5Y5nJp8HLpT71LpXYXNIAkspNxpJV3p6rLpuD3p0:i+VU9D3riJ6rLcJ9t3wLERY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764828484, "uuid": "fcfa8381-9b54-4ad3-82f3-954667d14ec6", "value": 3284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764828484, "uuid": "d7e5b9d0-8158-4066-9d1d-c98bd720b5cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828484, "uuid": "9792155a-c395-4031-b428-8f9cc976fa25", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3333bf-d16a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764891790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764891790, "uuid": "d4935b58-7698-4775-b10c-7454e8d6b799", "comment": "Malware payload (Mirai)", "value": "083ff70fbdda95eb33d78119a46c4aae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764891790, "uuid": "d39b428e-408f-407d-a4af-15fe3b0c3bdf", "comment": "Malware payload (Mirai)", "value": "6347cd099ced88e8d1d23815c7ced3e66b5560ba7265c62f9798566ce2caf77e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764891790, "uuid": "dcdea6d1-446f-4bed-b7a3-d8d372e14c36", "comment": "Malware payload (Mirai)", "value": "78fc1597842eeaa5ee62fbf9bfbaae5075db7895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764891790, "uuid": "70fd6923-b94d-4886-b4fa-a8447712fe39", "comment": "Malware payload (Mirai)", "value": "888f88c2976c6b64404f85020ea902cbc744bd34487f942df808987d7661b572877b59beb538bf9b7fae41f9f93aa89d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764891790, "uuid": "2ae59556-ab9f-479a-8c02-c08749177d33", "value": "T11C73D609BB610FB7DC5BCD3B09B91B0529CC950B22A97B393D34D818F25B25F59E3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764891790, "uuid": "f1d17efd-6c8a-4826-961c-8bf412ad60ff", "value": "1536:Z8ncEHzy3OzwYmc8vik2UYxUzwqUeTT9RNIwzh+yuywH:Z8cEHEOzrmKkwxj53yuywH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764891790, "uuid": "1b85de41-83b1-41d4-b2ff-3035da774ff5", "value": 80452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764891790, "uuid": "363ccaa1-845b-4f39-a9af-2668121fdb8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764891790, "uuid": "6cef802b-e734-49e1-aedf-99a5b831908c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59fa0ec-d0a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807568, "uuid": "091cce0b-6a8b-4006-bb72-14ee6c0e6668", "comment": "Malware payload (Mirai)", "value": "eec167d1d2f3cf4283d591405c90d1b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807568, "uuid": "6fab5e81-9651-4571-90ab-af30c678ab72", "comment": "Malware payload (Mirai)", "value": "643804b7f5a8b60bd623ae0b80be926400304cb778af8ce4ad811ad84b9cb545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807568, "uuid": "616d914f-bb40-4150-90be-8f44f5bd2f10", "comment": "Malware payload (Mirai)", "value": "da6577320b1ad2078ff7f22d0369867f57afbc51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807568, "uuid": "aeb204b3-a36e-4434-9f97-5a88f6217248", "comment": "Malware payload (Mirai)", "value": "8d987a0ee5d43e5eef790bb6a7f36f4bed24877cf45062cca23c056331b548a2b0e7306e40ecf10cb739da4f2c5c72c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807568, "uuid": "9c9184b6-65aa-4a7b-b4d7-4c7edf8b6c0b", "value": "T173B35CD5F643E4F9DC5211342172FB375EB2E1BE2318DA87D7F89A32AC21582C509A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807568, "uuid": "8bd982b0-2134-44fa-af98-bef47041757e", "value": "3072:CIIV/zigV7fnQLAMiCJp9r5ThAUBrVcsvhzPmBL:CRV/ziE7vEiCf9jMGzPmBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807568, "uuid": "3be334f8-e57b-49b3-94af-c9893ceb8ba7", "value": 108016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807568, "uuid": "b3adfba8-ce6d-43b0-9f8b-6d077b783473", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807568, "uuid": "49ac6b5a-0b5d-4e6d-84f9-8c55e97ded90", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bfd90d-d0f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764842914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842914, "uuid": "3486339e-9e3a-42b9-a3e8-1b7f5d8a5dbb", "comment": "Malware payload", "value": "7a5cc9f0ac4d31a8c099c76aa803357e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842914, "uuid": "1d790ccc-08f3-4459-a4c7-69a92cf53793", "comment": "Malware payload", "value": "64893e981701025ac092f95ddf56462934be496d1b90534b0ab342dd14768c9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842914, "uuid": "e1d797f5-8a79-4ee0-b39f-211359ab2615", "comment": "Malware payload", "value": "30d9ede0def2fbf545182612eafa684f0ec88e72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842914, "uuid": "fc15ad95-48e0-41eb-9247-5fd2f442f05b", "comment": "Malware payload", "value": "afa4d3b823aef3ee7aa56b67b72ef85d6eb36ee4f6b7032707bdbcd7e85fac3d5403a6a014f71c179ed0d835d449f476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842914, "uuid": "8b8a94fa-1a70-43ff-a1fc-eff43a7c89af", "value": "T144C5DEA985402821FCDEF9B15020BCFCDBAFFD6056006889E205B1F372F766747A6963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842914, "uuid": "bb227177-a0a5-4c8c-884d-a9c437d23782", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842914, "uuid": "2dafdb3e-f5bb-4458-b08f-a49c37fc678c", "value": "49152:SoC25Dr2NfOhIXDPrgpoHQqAZmW/xH3Gz7e:SoC25Dr2NfOhIXbcyH5WJWz7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764842914, "uuid": "2b34c1c0-65eb-4dbf-8470-c0deccfb7eac", "value": 2732036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764842914, "uuid": "2c6a351d-35ef-47d9-8708-2646f9e91659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842914, "uuid": "0076f47a-98b7-4de7-bba6-c86545785b04", "value": "7a5cc9f0ac4d31a8c099c76aa803357e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c756659c-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883109, "uuid": "932bbc83-807f-4a09-8d16-d58288eb15bd", "comment": "Malware payload (Mirai)", "value": "2fcc47c83f649f0cace14a60318ea2e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883109, "uuid": "91bbf96b-cb5d-459a-a500-626b9688dbe8", "comment": "Malware payload (Mirai)", "value": "649714037134e8f0e80cadc271aec7f9fbf8384351ccb4fb08d04acf7266bcb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883109, "uuid": "def47ca5-61e9-499c-ba99-ad9d68eba026", "comment": "Malware payload (Mirai)", "value": "9a83fa36df8d2e63ecfaead0635fb4405aa666f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883109, "uuid": "e5e14f57-8a5d-4c45-9ed6-8bcb3bfd641a", "comment": "Malware payload (Mirai)", "value": "2af946120e7bf90b2d1ba64b280b960abd3153242d6d3364af22918d9cb7287c1b899e73dbfc29672e4b50c563142bb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883109, "uuid": "b7f0d89d-73f2-48e7-818a-36504bbfbafe", "value": "T193446B02B68080FFC595C0781BFFB636EC31B0AD5279765A27C4AF562D4DE601F2EA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883109, "uuid": "46a4b064-981c-4814-9dc1-d6067445ed26", "value": "6144:dMlgf1IFKtyULJEh+EwGXjsRTGsj4ntvlM21:d/0QJEh+EwGX4RTGrH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883109, "uuid": "c95ec788-6bad-4e98-8235-89e8b8388635", "value": 262568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883109, "uuid": "a8b0d92f-9ddd-484a-97b0-29526e2363d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883109, "uuid": "e3e019fe-e2fb-4a2a-abd7-d9f56289c42f", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b367ec6-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829347, "uuid": "7194902e-4dd8-484c-ba63-6363ad91329a", "comment": "Malware payload (Mirai)", "value": "8d18e55de97ab2d81990c243eb928559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829347, "uuid": "ee42a658-cc33-403a-bdf5-607a52e6332d", "comment": "Malware payload (Mirai)", "value": "64a904a5f708da17807b7348db0761a4096d9c998a642cd3e52a1799037f7d73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829347, "uuid": "05345159-ee2e-454e-b12f-f6f2463157e0", "comment": "Malware payload (Mirai)", "value": "9f1695ab838420e3f8bded0c6d1cf7ef23449441", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829347, "uuid": "f8bb759d-ad32-4729-8ede-de3ceaa4a6ff", "comment": "Malware payload (Mirai)", "value": "086ef3218b317e2b230982c6e4910157ed9fadfd4d2da89a3c92a057251bfff2fb1930acca13c3f0afd73e67ff21feec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829347, "uuid": "0be34c8c-dc06-4102-856d-47a8f06aa5b6", "value": "T16313F1E805114EF9C919E63316F20B225E51DFE3CC07FC0F895AA286D8EA85D1C637DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829347, "uuid": "766d9c6f-f434-4169-9973-69139f1289f7", "value": "768:MVKH+MeiZH7vnvd68KHyM5Fg1/WKbJjCn7SVhRXSgVJgGlzDpbuR1Js:MV+1eObvnvd65HyMjiW4+7SVh8gVJu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829347, "uuid": "448d981e-10fd-4a79-9d4b-6345697927cf", "value": 43272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829347, "uuid": "fcea683c-44b5-401a-8e55-40f59ee9072d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829347, "uuid": "7a02d51c-8bc2-4857-a23c-29976c0db04d", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658955cd-d123-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764861040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861040, "uuid": "37e21d6e-0ed1-45d6-9f3d-73b7a65dfc8d", "comment": "Malware payload (Mirai)", "value": "d93f77decc1177ba1c244bc67b735f07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861040, "uuid": "883c4e59-082c-4251-82b7-2d143163a5c4", "comment": "Malware payload (Mirai)", "value": "657de15a852f5c0e19920bf2523f75d7608aabf41dd1a49f42cabacf2ab1d7b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861040, "uuid": "fa186541-1350-40cf-9b01-d4b2b607b2a6", "comment": "Malware payload (Mirai)", "value": "d20caff351664808df40d768ec226d22c74c2bfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861040, "uuid": "f25075c3-8ed9-46a5-80f6-bed766c47adb", "comment": "Malware payload (Mirai)", "value": "3d2985ef85bac723b97e390cb2edab91db0861bf0e4fbc1d0ef248b47368ff8fdf47ae9c4070bc524aeeeca7cfcb0d15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861040, "uuid": "ed971cfa-c856-469a-90b7-532e32de5f54", "value": "T142932892BC828A2AC6C113B9F66E258D3361B3E1D2CF3217CD264B1277D524F0DA7E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861040, "uuid": "bcffa05e-ba85-479e-bc38-84f9b67deeee", "value": "1536:0ZNtcUPP/wpzNBQn2KRYkV4pXXlrPvW45SB7iWNqo:0ZNtcMJQlrGQSBuIqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764861040, "uuid": "f68bbf99-a65b-427c-a131-a1fa11d509cb", "value": 92832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764861040, "uuid": "703862e3-da55-420d-b58a-82111ac9e68f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861040, "uuid": "64bedb4f-8615-4fb3-b57a-891d743c4f18", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0322f72b-d140-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764873330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873330, "uuid": "d3d225a7-0d1f-4aca-912d-33281b6adedf", "comment": "Malware payload (Mirai)", "value": "39350f40e06b6325bb351717062a6315", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873330, "uuid": "d608dc54-9dd0-48ef-8c32-d754557f56f3", "comment": "Malware payload (Mirai)", "value": "65b0ec1ea421e2959b9754d78bf1eaf424d4581512cd5b96de6775b3887fae64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873330, "uuid": "e29307a8-92e9-452e-aa78-f0dc47e41f16", "comment": "Malware payload (Mirai)", "value": "fefbde9489851df793676ec10ccf01e42be3ef6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873330, "uuid": "6ea6a791-7126-4995-a3b2-9e178dcb2eb4", "comment": "Malware payload (Mirai)", "value": "df0efb7874de6d8fd8889c97e66ff7a7840168cd85e548ec749121d7d38de770e338842c69f8b26bf142e139af8efe45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873330, "uuid": "867b0fb6-5cb4-4232-8da2-b4a14229e867", "value": "T1F3B34CD5F643E4F9DC1211342172FB375E72E1BE2318DA87D7F89A32AC21582C509A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873330, "uuid": "4e05e8db-f54b-4a7f-a2b4-b9325a8529b4", "value": "3072:SIIV/zigV7fnQLAMyCGpiEjxAUhr0csPhzPeBr:SRV/ziE7vEyCWX3mzPeBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764873330, "uuid": "e14ea734-e48d-42c5-8b78-930136c02818", "value": 108016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764873330, "uuid": "c50d1ec6-7d48-458b-a2d4-b8c383d0a50c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873330, "uuid": "0b0b0fc0-daa0-404d-a747-03aa67f63062", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f375b360-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834220, "uuid": "5beaf911-a27d-4135-9591-a7b2b4a27aa0", "comment": "Malware payload", "value": "906387c4e806671e0fdb32463de3e970", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834220, "uuid": "3f36227a-c75c-416b-a351-a0be5a8fc389", "comment": "Malware payload", "value": "662bb00e9a82d43be45413fce12def326a1863f9cd3e63aa45b60d36ef7e0443", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834220, "uuid": "f2be8b4e-fd5c-46d8-b4b9-5a4029f66b57", "comment": "Malware payload", "value": "480fc480a383dde63ee74d957d72813bb747d697", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834220, "uuid": "38ff59b9-4b25-434b-9fe0-23b561ced6b9", "comment": "Malware payload", "value": "1a1d6d3a5a71ffb18dff1e26613ce6b412b2e173f67c3a4863289ed606625b514173924255f6a45d001c65051bc6bc26", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834220, "uuid": "81917bd7-ce82-4864-824a-518b04b35df5", "value": "T1E3761203F78E4D2ECDE2B9784D9713716A166CEC1510928B4D02F218BEB72E96F25BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834220, "uuid": "b9018771-f364-4c26-b61b-e63733fb7f89", "value": "98304:LDfU4bRLnAV0ZI9/P2hnWAjVOA3I/0fg1cPxhmc4aTc2s0NCs1eOAkuj1H7+/7R9:3znAIlhWY7y0fg1UV4+1QF+/1n6exDFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834220, "uuid": "fb979e7f-42c3-44c8-ad27-0551c4881f20", "value": 7369993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834220, "uuid": "0b08d240-091f-4cd9-af5f-8bc83e6fc277", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834220, "uuid": "66eae1e0-8e18-4ac6-a842-bd6893f7c8c0", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27345f32-d109-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764849769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849769, "uuid": "be71690d-a6db-4aa3-b70d-99f67873db44", "comment": "Malware payload (AsyncRAT)", "value": "9a6a8901d157ba984a3efcd4036890a2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "testdrain-ddns-net", "colour": "#9DF76F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849769, "uuid": "700da5df-2222-4a11-8ba9-5f104ddac063", "comment": "Malware payload (AsyncRAT)", "value": "664cbcddb7da6c63b8f6948fb8e8b7dc5e5b309edd002c06df4edddec5a9dd56", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "testdrain-ddns-net", "colour": "#9DF76F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849769, "uuid": "d83d60c8-9626-4c24-b7c4-3985e21cd686", "comment": "Malware payload (AsyncRAT)", "value": "240b8cde3084ec980bb1d178b8053f575d8593a6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "testdrain-ddns-net", "colour": "#9DF76F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849769, "uuid": "abc79446-dc76-4f7d-8a04-ab584425e0be", "comment": "Malware payload (AsyncRAT)", "value": "170a5a0d2d946be24e6b84bb0a5c5944cfbee67c16497a0eaa9f357d85871e52597a1e148c2cdaaabbc30502ff6f522a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "testdrain-ddns-net", "colour": "#9DF76F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849769, "uuid": "6e752fb8-3ecc-4d5b-9782-6e216381fa61", "value": "T194232C003BE9812BF27E4F78A8F222458676F2677607D54D2CC451DB5A13FC29A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849769, "uuid": "8c75ad9e-f9ea-4998-9424-5cbf613033e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849769, "uuid": "e322e256-2d9a-49b1-b144-b28e3cb9e232", "value": "768:MuSNAskTAYvTJWUhC+zmo2qLO0ZZiy2ihkc7jPIwAT7Q0bW/oLV+l8nWwkv2BDZ2:MuSNAskTAEp2Bty2iVgwI7bW/amYd0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849769, "uuid": "b310c187-8801-4c25-a280-4f16259cfeb1", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849769, "uuid": "9bcd1ad1-08ce-4cae-b573-82fad2008b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849769, "uuid": "7c18eb5b-74d7-4202-9ce4-da7a48c76206", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0c7e1b-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834667, "uuid": "f5b76e1c-1aa0-45b3-af7c-d0eff724469a", "comment": "Malware payload", "value": "69e6502dbaa3fa6cb2e56208cda27aa0", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834667, "uuid": "56079033-2cd2-4e3d-87c7-5903a82370b6", "comment": "Malware payload", "value": "66ec656587359754ddfa77c7e94315ce7c9ea7e91defd26ff40aea6dd2e1d33a", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834667, "uuid": "14d70598-f4a2-4a2a-9b3e-62b01b34bd70", "comment": "Malware payload", "value": "5b7c72258ddb43b23cabcbeece7930c768b11204", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834667, "uuid": "93f10c2e-0b35-4d86-9e3b-e0862aa9021d", "comment": "Malware payload", "value": "150f3474bfea3c13ae1049f64ebfd146c65965181ef17cd22b702664cf45a9fba99188d71bd856c409dbe92a679c2fcd", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834667, "uuid": "9c787fa5-e8ef-4c0c-8a86-8cd5768a4f81", "value": "T13AF423AA0676EF16CE4C1CBEC183F2C383BD9835156BE51F766CD6882B593E5DB08841", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834667, "uuid": "6f1134ed-8b2a-4d5c-af90-40156a4f79c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834667, "uuid": "ec1999fa-33e8-4231-a698-8f3fec5e7170", "value": "12288:FiwOGl8MEDRJbhrPox3+MSI34sxC8XTQZepe0oWkrp2qu:4XMavNMOhIbI8Dqe9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834667, "uuid": "476fb663-e8f6-45b3-91d1-b766d8344f12", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834667, "uuid": "7e60f60d-78b3-4917-8dd1-9a96b8f83d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834667, "uuid": "61a1cd1c-a7d2-4f5c-8aad-19a8245e0c9e", "value": "66ec656587359754ddfa77c7e94315ce7c9ea7e91defd26ff40aea6dd2e1d33a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6faea4-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834126, "uuid": "18150dfc-85c0-4c16-98d2-7e1e0be6604b", "comment": "Malware payload", "value": "ae200f6285fc939594eaf0fc9b33d086", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834126, "uuid": "9c46bda7-f5c8-4f23-b072-91d4aa381eac", "comment": "Malware payload", "value": "66fd385e10187ef903744c2ad40d016d47753b4544f961d847b4a2b1c48b9527", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834126, "uuid": "350bcb4e-4150-461e-8bd7-ec27d86d2fba", "comment": "Malware payload", "value": "556255f5e203fef4d055312c320043adc9f8e12e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834126, "uuid": "9a0e2c22-047b-4f54-8f92-35f7a8572d77", "comment": "Malware payload", "value": "0ff13181e3d565d486ac62607dd27131d443b83ad05ff5db7f20ae854f8f18c5c5df8024e029467cddb4a041fcb4ef6b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834126, "uuid": "dbee1a0c-c969-429d-b2e4-936b45b8bcd6", "value": "T19E33021B486050D9FF626AE346500944E63C5B7CAFB875C18252E2AED9688F1FB3DB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834126, "uuid": "002fc8bb-3f98-4346-8407-49141e6e32a8", "value": "1536:qWUzRiAuUBp0Yu1CBabDyrpbZTmV6RNXVd:/U4Ea5CkidZTmqdVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834126, "uuid": "78a8893e-750f-4b74-a0ad-fc02bddb6ef7", "value": 54728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834126, "uuid": "48ced313-87d7-4f7c-9382-1bbd80ab36d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834126, "uuid": "556f3d7c-43c5-4fdc-9e8b-895f54e498a8", "value": "Agent_Uninstaller.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a383beed-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883048, "uuid": "1ce6d46e-ac5f-4536-af63-e600f1e4f82c", "comment": "Malware payload (Mirai)", "value": "7ec0ca5790bc8871da89c3b70dc6a9a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883048, "uuid": "fc604d22-7b8b-4366-b3d8-b438f7dcbfac", "comment": "Malware payload (Mirai)", "value": "678d90b6c65f18580804cba120626bd0c88885102e07855ab8d8598888ce60dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883048, "uuid": "fe0e6191-adc1-4af9-bbdd-dcb8300f38b1", "comment": "Malware payload (Mirai)", "value": "7d0b592de7e1baff59a2d8d6cc803def0fc243b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883048, "uuid": "a4c78c18-c9d6-4226-a3d4-f816f8d887d0", "comment": "Malware payload (Mirai)", "value": "d8daec124c5b0f78e78a590b8eb1fcaed1bb415a9a07d7b712890e8d9c544d54282a0007ee502c5e57ef3e6cf7c7b956", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883048, "uuid": "db81dff1-a73d-4493-a179-e9d0a7c63fa7", "value": "T1137302812267EA9DF1BCB37108AA3E4B2992974C058C52CEDCC969B5DC75D247E483E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883048, "uuid": "e746f5e9-1350-4bc1-8731-d47d727208c2", "value": "1536:IzOJkueEowQZcYR4vqHg7VLRb05hFTGqGo2OTzhk1o58YwGzlDly55rh6HQLy1k0:fJkuTowQZcYGUgLbmhFTGqf2mdWFGRlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883048, "uuid": "3ff9d1f8-29b0-4c2f-bb79-f1e73494b883", "value": 79744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883048, "uuid": "05451640-c6db-4e38-96c4-55f43f77e7ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883048, "uuid": "5aa8935a-f893-4030-995f-420ef3f4ebbe", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6fbe3c-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807039, "uuid": "3eb2f96f-6135-4b54-a227-70640ee9ff7a", "comment": "Malware payload (Mirai)", "value": "0795ea2a5213cc197031097192a4348b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807039, "uuid": "1229209a-0af7-422f-aa4f-d1233329ede6", "comment": "Malware payload (Mirai)", "value": "6828dc143869057dc7065d54828169eb26d839556723c46c4bbba536cc3aca17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807039, "uuid": "aa5fc50b-cd48-40d7-93fb-8f5ed94eed58", "comment": "Malware payload (Mirai)", "value": "dd159deb6c177ef534d568fd41354e81b605b084", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807039, "uuid": "112bdfcf-16b5-487d-8c1b-fbcf439d0fff", "comment": "Malware payload (Mirai)", "value": "5e65384831cc8416748a78052b3bc716eca43b23611e107c64c4cca9174732d6dd042e95b062f6153cbb1fe30d3d66bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807039, "uuid": "d309747e-5851-4591-a2f4-c54267d30e47", "value": "T174B339C7B801ED7DF80FD6B64563090AB931A7515A834F277367BEA3AC360E4481AE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807039, "uuid": "7be6874e-40a2-4de1-833b-ff26c170b47b", "value": "3072:6PyMWu5lC+h9aYSrt0fuVA374dXMJTu8jIvd/JGa3:FMWErhUYVuW3741MJy8S/JGa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807039, "uuid": "91dc2f03-dab4-409a-a62c-25cf61b9e341", "value": 107916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807039, "uuid": "ffb4b1c6-b170-42b2-8c67-1975ba0e55ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807039, "uuid": "8a705a68-bf30-4400-ac25-355e9584b607", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c7d08d-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880856, "uuid": "37d1cdfc-89fd-4059-a290-bef8cb6793e4", "comment": "Malware payload (Mirai)", "value": "e1dd50bc6e862df279738f1be8b6d0a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880856, "uuid": "3cd8d232-3f00-474b-9114-409a05fc321d", "comment": "Malware payload (Mirai)", "value": "695c5be2cfc87c11d99ebf1fa0b0808d38b778039a684cd49d3b5f75e9a67094", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880856, "uuid": "eb297525-0a1a-429b-9f38-edcaba2957f2", "comment": "Malware payload (Mirai)", "value": "0098a55eb7e127574e03518663def58620587da9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880856, "uuid": "fc38895c-d683-4c52-92ec-4f6b039525b5", "comment": "Malware payload (Mirai)", "value": "99e01ffe040a406a9e3f9f0cef7c82487bc70161cead553eb68bd1916203a6d425259cea9011a402c0329fae4d268a17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880856, "uuid": "7f9564bc-1468-4a35-acd4-0029aae445dc", "value": "T165637116BF601FF7E8ABCC3785A95B4A25CC541A31A93B796D34D428B24B25F05E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880856, "uuid": "5d9ff19b-d8b0-4c2a-9b27-7e45c9694f5c", "value": "1536:FJs9gGYlZma+9KRJisXkBg0rruxyDJ1Z:FJs+9mLiJMruu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880856, "uuid": "3d4bfe62-a2f5-4fa3-b0d3-0192b22723ad", "value": 73324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880856, "uuid": "a1eecd89-cdcf-4211-9c70-0d7ff43a9853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880856, "uuid": "0c056b70-4941-4c23-a51a-30f58af394f6", "value": "DEMONS.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc6d66b-d0c8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764822027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764822027, "uuid": "362afae2-f117-4596-a9da-98e583f3222a", "comment": "Malware payload (Mirai)", "value": "ae46de46e7417783fa6b12224b7487cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764822027, "uuid": "213c75a2-6149-4b59-a23b-7f14ec9c8048", "comment": "Malware payload (Mirai)", "value": "69ee6ed953344bdf86d306cca10ce70e2cc2081242e7fbb993a226c6101105ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764822027, "uuid": "0f60f8f5-cef9-4ea7-9934-e0c8d0f96b70", "comment": "Malware payload (Mirai)", "value": "b09b5d7f96a3aee2d080702738029b43e75d2e60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764822027, "uuid": "e5797ce4-7bfc-4e79-a73d-74df93dcd590", "comment": "Malware payload (Mirai)", "value": "825b8bcf5269d1dd6101f2c4434154eb234e35ea4ce0228176eaaeff3aad398bc23759b88f7b637b1737d57fb3c79afb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764822027, "uuid": "75d0503e-1e20-415f-a9e2-ee65779acc08", "value": "T135C30945FC509F13C6C622BBFB5E428D7B2A1768D2EE32039D256F25379A85B0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764822027, "uuid": "89cfd9b0-79c1-43b4-a89d-d0e1897dab2d", "value": "1536:tPJvU3Yj73GC/XIhf2fjE4VSaEb1W4PqHiX4qPi55n6TslO5awywzPeYC1zh3hns:tqCbG2Ihfx4xEBdyHiW5Zojcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764822027, "uuid": "a056a998-ebc6-4e71-9e05-cca17782a9f0", "value": 125568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764822027, "uuid": "4ff5284b-e7dc-4612-9dcf-2cd05f2a878f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764822027, "uuid": "70161fdb-2f88-4999-9960-98e9eaf7e4ed", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1f42ce-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880858, "uuid": "fd93e167-7678-4cdb-8c7e-1c66cb50a093", "comment": "Malware payload (Mirai)", "value": "b15313f59147f96113ca077bb8e5ba71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880858, "uuid": "218982e3-8199-4f3d-b8ab-8fcfb7c7bc15", "comment": "Malware payload (Mirai)", "value": "6a5dc203104030f81e63436fb9792946b43bb295b37b9775883c71e6806974e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880858, "uuid": "3d872333-7198-46a7-81ff-c55b1b83f874", "comment": "Malware payload (Mirai)", "value": "a46bbb9dbdc8ecf4e33dbf919d641581d486883a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880858, "uuid": "da7c1820-753e-46c1-8407-deea58aad36a", "comment": "Malware payload (Mirai)", "value": "d64994ffe8eeefe866770594e7453b74c26d6014a3746437aee26de682106c4a8d57f1dd4cc930395c2d225ac0413735", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880858, "uuid": "fa578b72-84cf-47a4-8cb3-3847d7352333", "value": "T19743382579BA3E13C0D4A4BE16B34F15B2E0377E30A4C62EBC721F9DEB50950664B6B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880858, "uuid": "96517594-0672-45cc-ac4c-88860a34d314", "value": "768:BZoDGT9zOq9yaf7luDysHqf4zB+g2J+7vlGvpO+PpBLA2y:BZ8GT9zOSyaf7luDBKf4H9gp/Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880858, "uuid": "77aa8f89-064d-4104-9db1-d6e949b0b34e", "value": 58604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880858, "uuid": "19047731-3136-4b2e-b81e-7e8664832896", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880858, "uuid": "58f375e4-ab1c-4aae-b2dc-12c11a1671ed", "value": "DEMONS.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482763f9-d0f8-11f0-a129-42010a9c0007", "comment": "Malware payload (AntiDot)", "timestamp": 1764842522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842522, "uuid": "86899ea6-0519-4bec-8182-bd78007715a4", "comment": "Malware payload (AntiDot)", "value": "91e73745a691bff936702d2af49ac629", "object_relation": "md5", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842522, "uuid": "a12746c0-037b-47c9-979f-53de83bbe456", "comment": "Malware payload (AntiDot)", "value": "6a99e6d4abc66f09a490443786432d90c675cb6282c791fae996136cbb69b7e9", "object_relation": "sha256", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842522, "uuid": "f3f29e44-5632-43ee-a921-99fd48a028e2", "comment": "Malware payload (AntiDot)", "value": "afa52fd48dc202f959a9e90e090d076773173c67", "object_relation": "sha1", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764842522, "uuid": "bb226858-97f7-4f03-92a1-0dc305e44aed", "comment": "Malware payload (AntiDot)", "value": "5cd5f4a8099d58de7437ebd1d9cc2363a50fbf32ec5a9ea5e40b3216ce122c654fb8958cd1f3980767ad7496359a6a22", "object_relation": "sha3-384", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842522, "uuid": "9885f5f5-8c91-471f-ab8f-e4c28b926ccc", "value": "T14E37E105F20C662AD9C6F07DAD8605E1B536BC8A6350C5463533B32DFAB3BD48B663E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842522, "uuid": "928e2c11-d7db-42b4-a99a-729acb0fa282", "value": "196608:XCRfUKL9LZOl5hd21ms1sgAXFNgI7a701Y3Zu9yzhLrZ5F9pA0FqFDlJetQTu/hR:XCR8Kx4d6s3FNgIuZ9zhL9+8Q+8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764842522, "uuid": "963bf8bb-aff8-453d-ac01-8bf144840bc8", "value": 24436406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764842522, "uuid": "936248a5-cfdf-4f84-989f-d9e6b0aa7bb8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764842522, "uuid": "969baf9a-496a-411d-ab5d-eea5152026ee", "value": "EVN.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef9c013-d161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764887899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887899, "uuid": "d74f29c5-26c7-43e5-b22d-59258e68cd69", "comment": "Malware payload (Mirai)", "value": "00c960a31d5f7132521ea8da0e689aab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887899, "uuid": "352593cf-4d56-40ad-8468-d3ac24a531c6", "comment": "Malware payload (Mirai)", "value": "6aec0b1719f05151fd630f7c8f4d5d5ff08c389b2d2738fe27341cd0fbb413af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887899, "uuid": "78e102a5-a38e-444e-a6e8-5206be68df21", "comment": "Malware payload (Mirai)", "value": "cb112935934a8b32459adccab119391df480c75e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887899, "uuid": "f5cc9cca-5905-4146-bf3d-1ec292f1157d", "comment": "Malware payload (Mirai)", "value": "38947cb91498a9893e6eb90f2116290f031009b427bc62fa99dd5891522bbde11e15f17ca04a6cb98357a317f6ff6a7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887899, "uuid": "624cead0-fd9a-4e3c-8415-2df13682d52a", "value": "T143932955F891DA26C2D9167AF65D528C37231BB4C2CE7202DD10AB362BFF91B0F66C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887899, "uuid": "151d5ceb-7eb8-4378-9458-ece09c6eddf1", "value": "1536:idTWLGUBOAVu2K5G5udXNUMX8O2bzqJPV6OxVulGcj8dOr9ubm1Ir:KTWLGUBOAVuzG5udF2b+iOgSquz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887899, "uuid": "edf4508b-c195-4826-ba1f-6babf9adbe6f", "value": 95660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887899, "uuid": "5625317d-739e-4a36-abe0-253c8a60e368", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887899, "uuid": "8bbf3eab-67dc-48b7-a562-574a4e35430e", "value": "frost.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb255d1b-d0f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764840675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764840675, "uuid": "b9318124-b34e-4a2e-84f5-b33398b8668d", "comment": "Malware payload", "value": "222f860e0aaac368aa424d12885a0e80", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764840675, "uuid": "84de2651-4828-41a8-b42e-449242775f73", "comment": "Malware payload", "value": "6af3c5418424d70902e8f3aa21a35c1c96eeb2ce66d3b93c9e74b3d6d349c767", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764840675, "uuid": "3c856c44-bc9e-43e0-b835-0b97808d75a8", "comment": "Malware payload", "value": "2c65bc571526f803df9b6cc2d932dadac5aabec8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764840675, "uuid": "116e118a-bcec-4d5a-8b78-689511143ea4", "comment": "Malware payload", "value": "d9fe98c3d17ed051cbd806000f58e2b1f4b4793597ae32e4d4d1260d47d083c5579e3667ff0825de9c767fa204285d70", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764840675, "uuid": "4f392202-9f22-44b0-8ee2-5594b685db52", "value": "T1BA18338895FE1EBBDF1A7A93110A946C4CB8CB5D8713E493C76116EDCFAC4A3685CE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764840675, "uuid": "419b3568-597d-45b8-b6e7-9255e7ae327a", "value": "1572864:H2Y0IGHUR7qM03GI2mKDe6PbhTktu4e5ALjmokHiOmzb65oarV0D009IbrctNtSd:H2d0R03gmuRdgk4e+mok4z25X2+brWt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764840675, "uuid": "39898bab-8222-4ff5-8e41-64fabb723832", "value": 85990448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764840675, "uuid": "232abae5-a945-4852-8cfb-2c242a9b2e59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764840675, "uuid": "67926983-21cd-4027-b2b3-744206650ad1", "value": "GameSetupV5.2.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa9e765-d126-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1764862211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862211, "uuid": "1bb60516-5378-4d50-9746-470083cd8ff1", "comment": "Malware payload (SnakeKeylogger)", "value": "527b08215ee2c4022d2ad0eecef44aba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862211, "uuid": "97cf4419-c2f9-4aff-88d8-7aa9dfd9ca99", "comment": "Malware payload (SnakeKeylogger)", "value": "6b36a1195cc6a6290c94d9afd1b879476cd92084c7133c8c96459bf8e0e15aeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862211, "uuid": "1ccc52be-fe1e-4a6a-b08d-60826d7bf6f9", "comment": "Malware payload (SnakeKeylogger)", "value": "7b35ce991c38122628c5773615e9a2844c81c4d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862211, "uuid": "37c697ca-dc84-4341-be3b-a2ae6ef47c43", "comment": "Malware payload (SnakeKeylogger)", "value": "f835e6dae4a9504ce1f4a84755e1a80fa2bee69849178327776fe046ae8709091abf98fa95b1df0467e76a415a75a2e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862211, "uuid": "7f5352d3-5368-4944-bee2-6e192469098f", "value": "T1D525AE027391C062FFAB92734B5AF6115BBC79260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862211, "uuid": "d6cd2265-753d-4475-bf13-b91b2c195b1f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862211, "uuid": "fd66e787-2a08-448b-8fff-d56da6ccc46b", "value": "24576:c5EmXFtKaL4/oFe5T9yyXYfP1ijXda6+n6KJ:cPVt/LZeJbInQRa6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764862211, "uuid": "97c93fb1-0848-43c8-a5f4-444461f68050", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764862211, "uuid": "f7122871-eb83-4615-9006-7d5d9b929ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862211, "uuid": "487399a9-a9b5-45db-99a2-40494f8974d3", "value": "z81file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77c7f8d-d13d-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764872425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872425, "uuid": "ed79dfc1-a903-47cf-91de-5793c036477b", "comment": "Malware payload (BlihanStealer)", "value": "5ed5bcffd7235744ba6d8ebde1a5d8b2", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872425, "uuid": "fff9cc61-4943-4ead-a4e8-5e8f556ba44c", "comment": "Malware payload (BlihanStealer)", "value": "6b5dfa61e04937a6b02058e76ea845305c7491039458c4e6187445d933413f5f", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872425, "uuid": "208586c7-42df-4f63-97db-c3001a5e9d1d", "comment": "Malware payload (BlihanStealer)", "value": "36f3db98d1acb86b613a26472f75e5dd535e25f7", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872425, "uuid": "63bdcda3-c9bf-4582-b19d-ce46b604d362", "comment": "Malware payload (BlihanStealer)", "value": "93d1bf95689804cf75b0a3521795014c6f7cd18834fcc448790eca85524fb87e3652ab0a77691f5de966189de19ed460", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872425, "uuid": "c47ea2c2-02f4-4bee-aa57-4b2b5b2d23de", "value": "T1B9836C1399C3C9B6C892153346B9927D92BBBD091EFDA3438B9DDC1D2352144EE1E743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872425, "uuid": "d95ed0bc-abb6-4730-977a-eab8142784ec", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872425, "uuid": "61de3c3a-7c05-40b9-b6bd-5c22114429a9", "value": "1536:YAowfUJFgjT284U+w2EwRz6OlvaeEpIaCtwUaSvcmGCCCCCHCChCHCCCdg1WCiNx:YAowyFgjTiUkEwt6OlvaeEpIaCtwUaS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872425, "uuid": "e5e53111-0029-4d49-87dc-950c1de8b4dc", "value": 81656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872425, "uuid": "288302e4-02b2-4cee-a6a5-7797ca6a6e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872425, "uuid": "390614f4-285c-4921-89db-4df4adcfc713", "value": "microsofthelp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18eabedc-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829129, "uuid": "d21dcb04-8798-4e82-a168-a97545f7a69e", "comment": "Malware payload (Mirai)", "value": "4def94c07d0e76ee6b808c5c555a07fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829129, "uuid": "5c2cac2d-55f4-4f72-8de8-8a77f8587a00", "comment": "Malware payload (Mirai)", "value": "6bcd930db56177f9978ccb518ac2df20b47d6308d5a9944756a8bd1360abff0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829129, "uuid": "a7afc15b-6df3-4957-a3bc-ff054a247f04", "comment": "Malware payload (Mirai)", "value": "41ad9353740f4c3afe369c888f3c3141501f210e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829129, "uuid": "b883e924-7c82-411c-acf4-7543a7ce1106", "comment": "Malware payload (Mirai)", "value": "ae408faf36f6cfa872b9c1848e9e5ab32703c7813b979a59e01285aadeb1e984bc71b750103878615864370c9e6dc92c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829129, "uuid": "dec81ea5-545c-4fe3-b424-b4d481aa420e", "value": "T1B1736CC4FA83D4F6EC130A350136BB379AB3E13E2169DB83D3A9A525DC125C2DA1635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829129, "uuid": "ff150fae-8f6a-4d5c-87e8-6c57c269c09d", "value": "1536:IbMP6X3uwvlzydgREdwHE2N5Xekch3K68cSwM:IbMC3ZludgR0wDN4kM39M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829129, "uuid": "8993e441-0aab-48ef-8dcd-723a5b99a3e5", "value": 79412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829129, "uuid": "12b3500a-835f-43f2-b704-44c53aaa559d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829129, "uuid": "9a8b9bfc-1d65-4888-a364-b1a6bbe07140", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dcbfc5-d0ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764836502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836502, "uuid": "4ab36321-f10e-4dec-9d61-b6999395921b", "comment": "Malware payload (Mirai)", "value": "3abcc92062a93e63e8dc00ddd8d8bbeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836502, "uuid": "c2ae547a-5ec7-4ee4-84f2-dd4d53993244", "comment": "Malware payload (Mirai)", "value": "6ca34f6121097b51a179cdd7aab59daf5cae1b817819eddea8775a9d7825f399", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836502, "uuid": "50bd6cc0-7022-4d9d-88df-66b336bb66f2", "comment": "Malware payload (Mirai)", "value": "77fc9ad66f96eb9b22f8f64426532e7fa47b3b0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836502, "uuid": "feddae17-def9-46ab-b63e-0b7be658358f", "comment": "Malware payload (Mirai)", "value": "8e5f226402b21778b413495a9da11b415c0ef37e85f5b76b62f3b256c7d1ab807d49bbeb6ad36d0e4c9ff009edef63fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836502, "uuid": "3e9e7c5c-68f4-47ca-bbe4-b28fa9c31ea0", "value": "T12F53F905F950871FC6D277BBF75E039D373A5A58A79B33116A382EB03BC5BA42939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836502, "uuid": "d6fc237d-b233-4591-8e5d-a6d33041dd9a", "value": "768:0WxHNAAbh60EofRDJFgSOhXFWUec2iRxElK0cEN9peiBmS1/cd+MaaSwKrAgDd:7HN/3P3FgSOh1MhiRx1ZUe4GADj35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764836502, "uuid": "67783507-c4f3-444c-93fa-2400de2ac58b", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764836502, "uuid": "328e650d-58fb-4d66-8407-7a1048af0da3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836502, "uuid": "e88d1f0d-ad69-42b0-8347-7d4552254e06", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3c76e5-d152-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764881427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881427, "uuid": "8c897d4c-bc26-4fd5-835c-fcae82f71d93", "comment": "Malware payload", "value": "9c0be142f474306ccaf570f665a4cee4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881427, "uuid": "9e27cd93-935b-44f1-bb94-a43cf91e34ed", "comment": "Malware payload", "value": "6d2e71a91fa2492ef090957a717ba53650da22024850232d3c26e323deaab62c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881427, "uuid": "357db7ee-46d9-4aba-9f9f-d2fcb5a791b4", "comment": "Malware payload", "value": "68019882e756b8a59e0957615e67f7589da6e6b7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881427, "uuid": "80be03c6-d728-45ee-8bd4-f34f1b9a7a15", "comment": "Malware payload", "value": "5b8a9a1454b5bffc6fd67996e5c40de26499868acacbb99404396021aa98422bde176c66ec5f6df9baf881b6bedba670", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881427, "uuid": "2a73a689-aa6e-40dd-bfea-1666e065d095", "value": "T181D502BB48B2A943ABA04663EB0F2C1A335B19D13B54D345E941919C7F3B1D39E92733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881427, "uuid": "96119ef3-3a88-4bf6-b2fd-f55c16134f7e", "value": "49152:5Oc2yD4lTPG7ysnNnYRTJtDlANUo2cEne9+yMFqONkUS:5oyEFPSy8tiJtDlAmoHEnO+yMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764881427, "uuid": "5352cd0a-aa55-423b-9f08-958afd7a72b4", "value": 2944281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764881427, "uuid": "7212d375-287b-4c8d-8d06-7f1f6685f0dd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881427, "uuid": "1330741d-4313-4279-975b-9dfe3dc706d0", "value": "RFQ 202518327.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd698bff-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834156, "uuid": "56b5e02d-2e4d-4a5e-8761-c200e58ccfc7", "comment": "Malware payload", "value": "c5e4f80e15c386b7900903ff5fc99704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834156, "uuid": "d259bbbd-ea0c-487d-bd71-3ffbd8f3f49a", "comment": "Malware payload", "value": "6d751ddf6200dfb6961ebc2983af0d264489469715bc81dde7bdf29650937b6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834156, "uuid": "c8da1aa9-cf34-43db-aed7-892ef6d266c2", "comment": "Malware payload", "value": "5bf23bbf9976bc2177da4af7c94cb45ccac2c71a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834156, "uuid": "8197e87c-3a2b-4bf6-9a74-68ecb5f2b6f7", "comment": "Malware payload", "value": "8d48b42d6c21edaec8ffa6354e3c55df4d78f184a4ed524d4ad851180c70514d1f427cf2e98f0cf81b196eba2ee9bc40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834156, "uuid": "9ecc42d3-43f4-4879-a1b7-af101da7dc99", "value": "T163A66B436D62CBD6D08AC33ABDA221C276B5BC408B752BD30A5066752D3B7CC5C76F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834156, "uuid": "4646fc32-f037-4d84-a543-8426426bb5a3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834156, "uuid": "ebeb5fa9-0595-447d-ae71-d5d9bdb5ec06", "value": "49152:W5KXrOsFVqjEOmTpMCAkOeUtV7hpkIVFuYqYhHBPPYRmwlQo97QZkqHi6+I1MMPy:W2DkQMboKDJckAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834156, "uuid": "af9082fb-0b1b-41aa-8897-a645e72271c6", "value": 9597600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834156, "uuid": "23ac28db-6e3f-423e-af89-1c0b5966a136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834156, "uuid": "5390cd9a-46b7-44f3-93be-910e004f1971", "value": "pmc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d94b550-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816735, "uuid": "99fc3f6e-b40a-4172-b55f-971b971e7937", "comment": "Malware payload (Mirai)", "value": "c48fe73bc0bbe2e75e8bd9689c7d31da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816735, "uuid": "6f91f1b9-e8ed-4571-a7f5-17084101f5f2", "comment": "Malware payload (Mirai)", "value": "6d77685ffbdaeabff850d3653ff1e279c791bbd42f2a956bb689df29e206b9bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816735, "uuid": "8b75d029-3ac9-43ac-9d05-8ac3bde05e12", "comment": "Malware payload (Mirai)", "value": "ffc5048355b5d6042b6f1a705d67174a52342472", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816735, "uuid": "ccd5a8a7-2ab7-4daf-ba94-ea98af5ee55f", "comment": "Malware payload (Mirai)", "value": "055aa9c645968d893b702dbaeb7caed0beea8ef6ab80d653aa1549620cf31ced4e8b2d5b076b9845d62e4ce13291c0fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816735, "uuid": "cb74360e-2dc8-45d6-b9f8-ff04de2ad110", "value": "T112935D02B22C0A47E4A35DB4293F17D193BFE95020F4BA89695FDB1A8635E335486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816735, "uuid": "2493f91a-4106-4b90-bf7e-6d6b68cccfae", "value": "1536:07f3Kt1Th0c0sJbVLDVt5MYoJz3DBJj9QUiOT2bboO1CQiWFNfUpuRBXG:07f3Kt1Th0c0sJbVLDVt5M3tsOybRWWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816735, "uuid": "11baeb17-c0ea-4142-961c-d4a95d967730", "value": 95852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816735, "uuid": "06aeb7e2-ac84-4140-ac7a-988c20cf876d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816735, "uuid": "6c2bab76-e6df-4deb-b39d-0ad15f99deb1", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddc6083-d168-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764890663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890663, "uuid": "b84909a7-09a2-42a1-ac33-9356085cc067", "comment": "Malware payload", "value": "b4e5ebdf7b718c8eb9c1a253c7091db6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890663, "uuid": "199cfe7d-0ca2-4ffe-b13b-93911667ed41", "comment": "Malware payload", "value": "6daa8193deb504ce4d305d41de870a0874039c77624f2da9bf3ff2c359a88780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890663, "uuid": "2dd62e96-a65f-4d74-a655-750c992f5143", "comment": "Malware payload", "value": "b9c1648b11c7b50f41cb32c36835a0fad4251cda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890663, "uuid": "59192395-f913-4da8-b538-cf7f777634f7", "comment": "Malware payload", "value": "5f8c22f1e517f28ac46ca49e29d207d0048ffaf4348fbbfc07774c6f45e6bd937e7e9ccbd586758b6cb4dbeabd9a940d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890663, "uuid": "e3087b8b-9a9f-4dcf-a810-687cfaf5c2c6", "value": "T141436D42732C0613E5625AB0293F17F083BEADE021F4F689A91F5B5A8675E336442FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890663, "uuid": "8e19bf32-3c3e-42ce-b936-cd48cc63a2af", "value": "768:k40ioB9NvaDdXORh44OQxAstYGoI8rZXvlFbB92hNgeiWfZAefug3:HoZMIRA4oI8RL6h1TfmIug3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764890663, "uuid": "626479f1-7fd2-4b84-b29e-42baf6991f57", "value": 59424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764890663, "uuid": "10fb3d57-4368-4390-99e4-c3579736e6dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890663, "uuid": "afa38193-4248-4e44-b2c9-437ac7313241", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2a7d4a-d118-11f0-a129-42010a9c0007", "comment": "Malware payload (FleetDeck)", "timestamp": 1764856162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856162, "uuid": "97682f0f-ae96-4414-8b02-e4b39ba1389f", "comment": "Malware payload (FleetDeck)", "value": "82266c12cc488a2a93dcbe3e24990cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856162, "uuid": "c3b02806-4d4a-4913-bca0-ce0c11a02cce", "comment": "Malware payload (FleetDeck)", "value": "6e276b7154f4bd423fb82d019768d97d298dc922f4cb90f137024f3c38ee649b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856162, "uuid": "ff5f2fc9-0867-4c57-a617-a85dac0daf7f", "comment": "Malware payload (FleetDeck)", "value": "9b355d78ad313bc1f18dc4bb302fa3b4f73bc202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856162, "uuid": "cc44e9e3-e3aa-45a6-92a6-7532078cc2a4", "comment": "Malware payload (FleetDeck)", "value": "1ed3396331a919f2b8d3d6b18a288c94b6c317bc0bea1cdbf8b618bda2b8c24a3b9d22a0bf55dec119ef00629e1c775b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856162, "uuid": "68530b46-2336-40df-b3d8-fb5c7044c5fe", "value": "T19516CE50FCDB14B5E603193158AB62BF2735AD094F35CAC7D6407BAEEC73AE10936229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856162, "uuid": "fe476847-5b97-44e7-bbb0-4e4c4555143c", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856162, "uuid": "e6929817-b11d-4220-8e5e-625976376a94", "value": "49152:AP0dfmVfyr+CU8D1cuwaH6ylh1XzKxGD2sC/d3aUVJiuX7c+PzbMDpIJLKo7snU1:APtZAl3XzKnaIcDgRjOl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856162, "uuid": "f57f93b4-6443-4f5a-99d3-6bf1645bc669", "value": 4398512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856162, "uuid": "38f8db9b-f494-46be-8cc4-23816d90ae52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856162, "uuid": "533a208f-91b0-4018-b419-dac4bfbad86e", "value": "Project2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e900b44-d0b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764815529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815529, "uuid": "748678f9-f546-48f9-999b-d972130023f4", "comment": "Malware payload (Formbook)", "value": "68bce52b17a0cc61f33030350cc0a136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815529, "uuid": "e44af34e-a709-4c09-8186-7ebd6db30f4e", "comment": "Malware payload (Formbook)", "value": "6e2b1a9ba0fb924774b35d3fe97e5ee232de78f7292fd7a79c678d6de974751a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815529, "uuid": "9e02f5a7-7fe8-4411-940e-bac507032df7", "comment": "Malware payload (Formbook)", "value": "1268303f591ac89f6b524d12caadac5096546fe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815529, "uuid": "e7eb9d9f-cb18-4cbb-86bc-6939a9303038", "comment": "Malware payload (Formbook)", "value": "8239af5249902b3cf3147c9ffdb7da14a993ec35f0d6c6e8a04b8836bece909ec3673d66e4daa1ad370ee90ceace5001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764815529, "uuid": "fd84543d-ff35-4831-961d-7b36bd24bdc1", "value": "T1CCE41250756AC827DEFA42F91831F27083B6AE6EB422C3C69DDD9D9F71D6F006004A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764815529, "uuid": "4c7056e2-5fbb-4f4e-b831-45d88e8ba3ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764815529, "uuid": "985136db-3c69-4b50-8040-bd70e74d464f", "value": "12288:dPdi108xzHu94dzCFpEtzouwudJDNo60VJQou0X4x2FcM413rZzGoYZPaCxzH:dPdi1nYmGFp2woPKfu0IYz417QoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764815529, "uuid": "4f451da4-c062-4180-9052-9eff86972112", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764815529, "uuid": "0fe136aa-ce0e-4004-8512-b9b84dfd7dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764815529, "uuid": "3a2c190e-5295-451e-a84f-a341f26aeb70", "value": "SecuriteInfo.com.Win32.MalwareX-gen.4392.4243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a0fe48-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816742, "uuid": "3283c9ce-a050-4024-bae4-2209715f0bf3", "comment": "Malware payload (Mirai)", "value": "de6585a6591fc944cffed857d82750e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816742, "uuid": "422890b1-01ec-4925-8633-5cffc867551e", "comment": "Malware payload (Mirai)", "value": "6e4bc25e9556a66d754744a764beef5db6b9721f1490b088ee175d9a6568a1b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816742, "uuid": "b35c393b-fe74-4de0-a610-22cd956f88dd", "comment": "Malware payload (Mirai)", "value": "34489e7b45a5dd457ff1643f01222bfc1c1b217f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816742, "uuid": "d98fc73a-130c-4584-8d81-21d33ef3699c", "comment": "Malware payload (Mirai)", "value": "cbb05a34a2d5705d60e3a8763b46446772176b16388772195980b6bb1d95f77097cd1efac0057fb1ecae91dd1f0e4f7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816742, "uuid": "cfe2b119-8318-4710-a724-a23581b62917", "value": "T119B32B81AC818A25C9D516BFF92E018E3323577CE3DF72229D246F2537CA92B0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816742, "uuid": "0c8be052-91fb-4fa1-b489-5613c44282c8", "value": "1536:mknkMryucvLmIymcdTao0LTTCs16r1KeMaE5CW95hXTXaQ6SjoMcMFiPvwyYNpnt:OV1rnTjQr81ddfTXawKBYNpn3O3O9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816742, "uuid": "9b00082b-7c83-4448-b260-97a867a7e400", "value": 109096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816742, "uuid": "fc8868e5-107c-410b-be8b-9aefd2166720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816742, "uuid": "e92662bb-331e-49a9-8bdf-df9c46cab76f", "value": "UnHAnaAW.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b71481c-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764834287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834287, "uuid": "d239e5ed-3c1d-4963-8bbe-95cf8e8f1424", "comment": "Malware payload (CoinMiner)", "value": "8a6504abfc2ec14dd4cc5bd073187fa2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834287, "uuid": "39a8f8ba-0dfc-4267-bf03-d2cde368b493", "comment": "Malware payload (CoinMiner)", "value": "6e8de67985ce6ce7f999c24ee68db35cf301e2bdd13f5c7aeac85e519e1a43d6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834287, "uuid": "d181a534-acc4-47dd-9f9f-05e5422d8cb3", "comment": "Malware payload (CoinMiner)", "value": "13fe1bea5c1e878922f28c29a3603ca538578a2d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834287, "uuid": "6a64383a-d850-4060-b724-06d587b0ae27", "comment": "Malware payload (CoinMiner)", "value": "4893521d4d36ed3800c7ef9395fd782843fcf39fa68b3de09d6c010f7e96005629d78302c002edd64f4b59d63e1a350b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834287, "uuid": "1a86787b-2b5f-4d8b-9340-5686969931b5", "value": "T1B60633B1DA3B4EAF6BC9D4747CC20192992D9DD13DABF42F4A1AD4F66288711017C38D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834287, "uuid": "45ed37cb-e5fa-4ec5-8be1-b9ddb37de22e", "value": "98304:6M7NIjt9r+AQK5eRlVeKuy/HVoELblDEXJTJwJ4Qe7:VmjviF+eRmyPVoOloBJwJ4Qe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834287, "uuid": "63ac12e2-5cb9-49b8-8c6e-b030ad36aea7", "value": 3964905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834287, "uuid": "69b8a0be-6b64-4cdf-b8bd-a13d6a65a633", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834287, "uuid": "b8e37844-52d7-4b32-9cc4-b5044f1999fa", "value": "miner.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a04bdd-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (HeliBot)", "timestamp": 1764829065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829065, "uuid": "31dc1085-1453-46d0-affd-aada63b00b9c", "comment": "Malware payload (HeliBot)", "value": "8d22c93d12ffca9c7e0454a0849de4a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829065, "uuid": "a9a8152f-05bd-495d-ac7b-6c24cfdac03f", "comment": "Malware payload (HeliBot)", "value": "6ece2b3ca3002b6ed255647b9ce906b5fc54d297aa7bf2e34cc992e28b3ab2c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829065, "uuid": "8aaec76a-45ca-4886-83cd-422fa772bce9", "comment": "Malware payload (HeliBot)", "value": "ed41e6737094962e051042b04fd5a9ca5560e0bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829065, "uuid": "33ef73d3-7610-4531-9b00-0fac19854232", "comment": "Malware payload (HeliBot)", "value": "36b0a684f0c30d2e5adcf33c5dfea2fe37f4c437ad0b9330bd79f6dfa7016005ba086bd4d6e0be3d0bce3269e593d885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829065, "uuid": "bdb2523b-8a64-45e3-88c5-e14e47a8578c", "value": "T1F0A3842A3E21EFFFE568863107F35E7097D5629226A19386F25CEB181F6128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829065, "uuid": "1e2787fd-aea6-4a7f-b4fd-cd71c88c3975", "value": "1536:27j+1TjCq+LzIfm2rKsnmCYy6rfV2D3ne92bS1jxlrimW+zWBSirHzai:BNHQymd2D3Q2bS19pimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829065, "uuid": "a0a48885-6544-4b1a-a754-013e3afd5a81", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829065, "uuid": "fada1582-6d9a-4b69-8595-2918592af2fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829065, "uuid": "4fe8d56c-f7d7-4448-934d-ce45702c26df", "value": "bootingworld.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacaefc7-d14e-11f0-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1764879705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879705, "uuid": "ccb47e53-dba3-444f-8b35-c0284577971a", "comment": "Malware payload (Meterpreter)", "value": "0f1e8ba4fe0b3b454a71b14c9b0f3ce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879705, "uuid": "137ac9f4-ec1f-4fc9-b4f9-478dc66b1d0f", "comment": "Malware payload (Meterpreter)", "value": "6f878f0b067f485c8f64cac684591f5ad5b157cf5f96eab894c25476df5f8a0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879705, "uuid": "388b2fea-5b79-4155-9d53-d54338780905", "comment": "Malware payload (Meterpreter)", "value": "79bdfc58022246d2379ddc1b9d987e11fdd517ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879705, "uuid": "01012d8f-2cbd-4e54-9529-1af0adbc47e0", "comment": "Malware payload (Meterpreter)", "value": "0679115473c4d3a13904d39ba02cc0e9ddf9f8ae843fa0bde5effbac4d3c597ba97114207b5a8594b42cbe458522877d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879705, "uuid": "017db1db-c899-4e18-8296-b4407d6d28c7", "value": "T109E1840377565CF8C8580A7707A7E96BB48AAB367F4BD3B68E28430F38B1004657598A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879705, "uuid": "9de1c0e5-4b38-45e7-9c3a-b54326806de6", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879705, "uuid": "8ecf988b-0cb5-48fa-9a5c-a6ca0a80ff3d", "value": "24:eFGStrJ9u0/6NJRYWnZdfgBQAVR1c+mq9KfFxYlrep110GapXbuqiksvc7xpmB:is0wRYu4BQi++B9kKGapXqqilkqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879705, "uuid": "314ffaf8-1b3c-4a1d-8a3b-c8256b5bf580", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879705, "uuid": "ac51c4ff-067c-40ae-ab45-feae961fe9d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879705, "uuid": "a8d9510a-2ac4-4658-89e3-8be0ae4e1820", "value": "rev.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba788bc9-d11a-11f0-a129-42010a9c0007", "comment": "Malware payload (Kongtuke)", "timestamp": 1764857317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857317, "uuid": "95cd8a3f-4f3f-4060-aead-aa2241194711", "comment": "Malware payload (Kongtuke)", "value": "8ef49a2a0ba96b7ec3d37df858816f32", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857317, "uuid": "281fa95c-ba0e-4d37-8b82-135aaa269385", "comment": "Malware payload (Kongtuke)", "value": "6f91f1ce98708688c77598a25ca37d3d854a732d482dfbcf4c193fc041d117dc", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857317, "uuid": "38e2c53f-7fe3-4b76-9641-05a8b9571214", "comment": "Malware payload (Kongtuke)", "value": "ffd0487bb3359abc368ff524fd929ff596610595", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857317, "uuid": "7e5cad3a-55bb-4e1f-9fd2-a7d54fa4f989", "comment": "Malware payload (Kongtuke)", "value": "8f2053abec99639d1555ea305d3a34993eae19562ffd67a5e5691aa99dab24122a64a5c080dd771484115a0f83980dda", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857317, "uuid": "5e598ebc-32ae-4d64-91c9-61cb5f7850d6", "value": "T1C6B1A5E7F2E8DA4F606401E8952A311B64E1C3BB5C9F8344A5C2151FA66F850BF2B7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857317, "uuid": "b80c73a1-3a2a-4c42-9db5-40c8879376cf", "value": "96:0eagnW6yuE2jfR/uU/Q3qaNuxPoColLhchDUwQYeKvOQuxPoCoKYCI2U7+x90L0X:05gW6yuE2jZrYqaNKolLh2rQY5OQKoKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764857317, "uuid": "8d5b3587-59d7-4821-9dcf-89723d6052c0", "value": 5300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764857317, "uuid": "efca5ec8-50b2-4d1a-a139-e202e732d081", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857317, "uuid": "c5e27303-7aaf-4629-a2f7-c7a444b1829c", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948512fb-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879158, "uuid": "9849d9e7-e5f5-4bee-a45b-d3242c82c6a9", "comment": "Malware payload (Mirai)", "value": "844edf097769a79fdb0d48dc09e3c148", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879158, "uuid": "4f23ac38-048c-4f6f-af2e-464e51b68477", "comment": "Malware payload (Mirai)", "value": "6fc3f3579e132e4e707ec029ea63cc8fd0308e7d0f3ff948988aaf9ff5b73973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879158, "uuid": "01ef9fa1-3d9b-431c-b9e5-10034e52759d", "comment": "Malware payload (Mirai)", "value": "4bd2fe75c4b6f2d638cc6f6d417cd43a21d7cace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879158, "uuid": "6207d3d8-25bd-43be-ad66-cfc516c5cabf", "comment": "Malware payload (Mirai)", "value": "998476afddc2f13f367220ace13006340d36072132a5638c96d6a39989d05f6ea385573bfb92a2b7bfc8897def86b936", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879158, "uuid": "77e79ac5-50a2-4e33-a067-16f2f94f39ca", "value": "T151234B42365C0E47D1A65BF4293F27E083FEE9A020F4F588260F8A868575E77518AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879158, "uuid": "f905435d-a0b2-4a3f-866f-c0686339a1de", "value": "768:EK4YZ3fcca/hndrOMRoZkV4EUPCx2n+Sam4CBqO0PzttABU0sRW7qEZ:WcIdrrf4EUPCxY7ahQMmvs87T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879158, "uuid": "b4656b87-65e6-475e-b7eb-f78edba95376", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879158, "uuid": "d93dfa6a-601d-4da3-bd07-dd9f6ea7fc32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879158, "uuid": "71e350c6-7467-4ecf-afde-57abad74d55e", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041fe972-d10a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764850139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850139, "uuid": "e1d34314-c2b1-4012-9ee0-89dfb36a2d44", "comment": "Malware payload", "value": "9f83e10f503feb276908a22dc06f3536", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850139, "uuid": "e70a05b7-c8f9-4a7a-b10a-4c2a201a1b7b", "comment": "Malware payload", "value": "702df60cc69ab4727157116c6ee9539d2b68235b3650296e7c95ff7ad2146126", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850139, "uuid": "90175c72-0bca-4285-a007-22dfca883325", "comment": "Malware payload", "value": "374e4e24d943fc878ba969044e2586deaebfb79b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850139, "uuid": "10001179-9745-4ffc-8829-823daf484211", "comment": "Malware payload", "value": "c6745809ea6dacb88aa3e3731e874952f8562c861c895c9088d400717ac9bba4e32fd96e8156ffa550bce9d06c8eb4af", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850139, "uuid": "3273a45f-dc31-46ff-a071-5b07e0ecc343", "value": "T1D7662242FF06D82FC0F682378A7A16792A015C1A8693C78769D9B13C1CBF9D44BD6ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850139, "uuid": "abdd0267-aa2e-4ce9-bb73-c03a985ce19e", "value": "196608:+Ps+WVRP7Dvx7ouGywu8QggZkPB0qPT6/bYn0:+PjmRDl7jGywnIKT6jYn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850139, "uuid": "ac93b387-31e2-4bea-9167-cdafe36b33c9", "value": 6764716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850139, "uuid": "93f02727-ec86-4a8e-82bc-7bf81b1da17a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850139, "uuid": "df6ef4cc-57f0-44b5-88b1-00c8846e12ce", "value": "rd.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea32d26-d131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764866961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866961, "uuid": "cefc4193-97ac-4bf5-b4d5-68bee5977e41", "comment": "Malware payload (Mirai)", "value": "bdd5a429f1c2b00cbaf23b539f8696ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866961, "uuid": "571b6f55-e92d-41f6-8af5-5222544bdcc0", "comment": "Malware payload (Mirai)", "value": "7051723d74a444ba980d42e08b88fe3685bc5bd3957e88367786457c23fe29cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866961, "uuid": "14c1c3e0-bebb-4fd3-afd3-7ad0f788d7f9", "comment": "Malware payload (Mirai)", "value": "11c9be9e22039a1438afe07df021e7686072d2e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866961, "uuid": "f988f73c-bd99-4517-b7b1-bd333d303600", "comment": "Malware payload (Mirai)", "value": "faccc60f920fa1932b14162edf0ff472dadc8492067c98dd40df9d3d5292fe80cf442fe7d578521559f0185b30f5efb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866961, "uuid": "a6ed7024-79bb-4f05-8221-94e7d0fa9d6f", "value": "T175042906B5CCC0FDC896D1745BEFB136D971BC6D123C715B2788AE222E8BE602B6D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866961, "uuid": "8b9cd5d3-c74b-4f82-948a-bf0972d1439c", "value": "3072:oxXl0etuFYHIcW27uwDIfE2zh87/uGnrZ6WMxfyIaD6xpUg91sIkq:8XuIIcTqwDWQ/zDI5OHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764866961, "uuid": "326891f9-b151-4484-84e9-79787586c3c8", "value": 182472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764866961, "uuid": "5ec35470-dc33-437d-8139-3502b5da1a12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866961, "uuid": "25b9d708-6834-4cdb-94ae-797a91ec2821", "value": "Polar.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5b6e62-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834183, "uuid": "f286ddcc-ba23-44f4-9022-2f8a57aa6fd4", "comment": "Malware payload (Stealc)", "value": "ebce30192e212844359cf0941951b5e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834183, "uuid": "3bb0b286-5c7e-48ec-9348-cbfdc62b65b1", "comment": "Malware payload (Stealc)", "value": "70dfe5d54ffa3a00287da91d36a9d1a3a19520276816505fa08875c14d8759c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834183, "uuid": "eef962cd-74a2-4f9c-ae49-a5dc0fb8963f", "comment": "Malware payload (Stealc)", "value": "35e684e1793e4d3fdea43847442e803c4c6fa3cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834183, "uuid": "6db194a5-4fa6-47e2-bee0-5715dcfc94ca", "comment": "Malware payload (Stealc)", "value": "f488509c69b46f2af68f6ec4a053b576a1eeab68a053c7ce58b40693a4a729dfd5f4f9059c278c3503cbf592e46f00a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834183, "uuid": "46e2b770-534b-402e-bf7d-2eaff7802f4a", "value": "T1F3251223FF53B9EAD9E545B19C2600F326126C175B401F77A2B4B23A0CD562E3A37936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834183, "uuid": "99c9f17a-d99e-4816-b2e7-589f5c285631", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834183, "uuid": "ef057e7e-c642-4362-8fa2-d4ad34d2913f", "value": "24576:09OeNlf/DoUrJ2aAcrx6LRpIa/VuOoEro8xwW:09OSlf/DoUrwXn/IrOoEro8xwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834183, "uuid": "92fffb96-3578-4592-8d1d-6e7dae544b16", "value": 1040548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834183, "uuid": "86f659aa-0cf1-4d39-87ad-a5cc99738575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834183, "uuid": "a56b89df-e4da-4c2f-8931-0a79b421ccbb", "value": "runtime_modern_edge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9ad84f-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829078, "uuid": "a9381d80-5636-4b3f-b821-4ef3b779cf33", "comment": "Malware payload (Mirai)", "value": "ad48d3c70c119ee82c97ca3153b16592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829078, "uuid": "046327a6-db86-4d8a-a733-54097342bafe", "comment": "Malware payload (Mirai)", "value": "71d015fa07e326cb013166622ab798a646c17168469110746fd21309b0d5bd34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829078, "uuid": "528f3931-fdd9-45c9-ba26-2a68dbd0bebf", "comment": "Malware payload (Mirai)", "value": "048c5fe49f662646a974e06c2de086dafb970dd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829078, "uuid": "3e4e8dde-6c4a-456a-8029-11e9323b5341", "comment": "Malware payload (Mirai)", "value": "d44a663b17f2bca3c182e603c5a7ab3bcfd5c91b6304e71ce3b0315372b2347da1ccfd94e0d07d1e3de1391b3a01610a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829078, "uuid": "b6a248f4-c201-4f49-989d-b22816c886b1", "value": "T1F813E19DE2C8695BCC6E3C77C49E073069DD808363CB2ADE1349CD95DA66A4726D10FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829078, "uuid": "1db6b9ef-d7f6-417c-bb55-4aeb7257250f", "value": "768:Ax4mYFaluq7c2hrjYJO5AhCA7ks2Q4kUx8vdgBxTgO5qJ5a4RvSxmtyCm0+FbWHu:AxhYYuqYZJOFE20d+xTfzSSxVCmBFYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829078, "uuid": "d431e494-ce74-433e-a2ab-446e382ee2dc", "value": 44524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829078, "uuid": "0eeed834-8741-4c8b-b471-d003254b1d63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829078, "uuid": "075e91a6-d3fc-4775-8d54-f5f54d7fb35c", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1c40c3-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875412, "uuid": "db5330ea-9d1e-4fb9-ac26-d47df5e5a3b9", "comment": "Malware payload (BlihanStealer)", "value": "18bd06a74da91d46f600703d36e67bf3", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875412, "uuid": "4ba0d282-f6e4-4b11-a1dc-8893a3489197", "comment": "Malware payload (BlihanStealer)", "value": "71fe42aabed15669509f6d049d639e1496a11127c16f3d0fe070985d9d620b0b", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875412, "uuid": "02ec0b47-90e7-4a78-a029-1b220a36a3ad", "comment": "Malware payload (BlihanStealer)", "value": "13be0dd37ffbf499136c53b61e5afe21c6a0aecb", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875412, "uuid": "657fff28-dc57-46a2-a919-ea4839105c77", "comment": "Malware payload (BlihanStealer)", "value": "fe0ce3f3f27b2b803dd184a91d31e4aa62643d927bb7c696a4efceac1e10357318f3ece06bc37a2796dd3489b9d229c6", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875412, "uuid": "74b097ca-cd32-4c7f-b5c7-c84aa10e9e09", "value": "T190839E6779CA1136D2D20372256C4E37AA2F79610FB652D7E9C8EB1B3A277C08D39341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875412, "uuid": "74cc3c8d-c0d5-4614-8500-ab0ee97cd02c", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875412, "uuid": "a12ac140-0a05-4de6-bcfb-be9ebb05124b", "value": "768:fqYcQgANPVfRW1J5AgM/6Q3284UKFw2C5wR3l5ljWSC91e5+sAy4OXMM32:GARVfYJFg64284U+w2EwRzJu7e8rNOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875412, "uuid": "74d58804-b8ba-4d8a-9304-7ea95b73eb4f", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875412, "uuid": "1e88ae19-a355-4b8e-87f0-0382011374f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875412, "uuid": "128ebd69-46f5-4d97-bad8-e09422f27682", "value": "90vkaz7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eca9f5e-d0aa-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764809113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764809113, "uuid": "1d94ce45-cb63-4ce3-811a-34aed81d83cf", "comment": "Malware payload (AsyncRAT)", "value": "c085153cdb28125ac94777bf3248a79e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764809113, "uuid": "32787a34-f98a-4283-8d9d-27ef527d030c", "comment": "Malware payload (AsyncRAT)", "value": "72303dc0e874c30864de3a18978aeb36fd175c6d9f071abcb309ea5774cd58f9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764809113, "uuid": "03af021a-602d-43dc-81c0-32e51c072b98", "comment": "Malware payload (AsyncRAT)", "value": "0933e574b6bfb17853647055cbb1ddc6c531a352", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764809113, "uuid": "06794dc3-0aa5-4912-8f85-e470a144e931", "comment": "Malware payload (AsyncRAT)", "value": "ce9dbc2a996cacad5538ac22d37b4e7f7af677ec7ccf2b8b6b493133b15b6efc953ce27a4493422e6d441905b57391f8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764809113, "uuid": "1dc0c692-fb9a-4d6f-b256-d966fb670531", "value": "T1FB234A087BD08621E6FEABB11972B6060671E6078D13E75E08E483DF1F67681CE907A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764809113, "uuid": "61e833d9-d38d-448f-a4d5-f6247ec928bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764809113, "uuid": "ccf26a83-1edf-4aa8-a635-a23018ae5f23", "value": "768:C/rxgvGl29Jv5JiTGGo1TcMc1ElYztQiVZl9wbFEPr9pKkmq6iOChLzjug0:CziC2OqIpalYzFtGFM9oLq6iOCdf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764809113, "uuid": "962d53f1-fd52-401c-8278-5dfecc7f60b2", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764809113, "uuid": "31bb0094-bf7e-4e99-a0b5-c7a67e17d5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764809113, "uuid": "85c381ce-6168-41a5-8701-c5183f4417df", "value": "system32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a09a9a-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834195, "uuid": "eb98bb92-2e1f-4d7c-8b6b-e9f2ee4e520b", "comment": "Malware payload (Stealc)", "value": "548ed3299e0eceddd1344e1c5c76618d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834195, "uuid": "82fccad2-a80e-44b6-a681-e4d719fb0d78", "comment": "Malware payload (Stealc)", "value": "73420694fb8c75bed7825d4074c596e681f36aa287efaddd60d7370e98abd740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834195, "uuid": "e5fe4929-fefb-4418-b479-75588990f900", "comment": "Malware payload (Stealc)", "value": "0e7ed8a86e86647ebac73290416751b448909b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834195, "uuid": "c1a39c25-5160-42ec-b077-ba2aae05bfb6", "comment": "Malware payload (Stealc)", "value": "498be0213485b4ebbf52a19caa3681d02cf16aca59d8959d8d3bb44ae5e9e7b956cb5c0bf7ab6f156aa18f6f385924c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834195, "uuid": "f17a8d1f-d719-49ad-8a9f-2d4672066b69", "value": "T1CCE48D5EE7A503F8D0ABC278CA428542E7B2B8555770978F03E146B62F376A05D3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834195, "uuid": "90238c4b-6962-472d-a1b2-6513f32fd1c4", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834195, "uuid": "34d8cd2f-8ecf-45b6-8caa-30ae5a74627c", "value": "12288:1GLVpIo/cBJ9InRPehbyv8plnEhCv3YZtF15kjH:1kkBJinRP6bw8TEhW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834195, "uuid": "699f8ec9-b5f0-4eaa-9bb7-bfa92dba9f3c", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834195, "uuid": "06cedc00-0da7-420b-b90d-9ea179f6510d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834195, "uuid": "546fbaca-7e35-44f5-8b80-f67da3732f94", "value": "87qo1yp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61c0ed1-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883106, "uuid": "b14c84b6-e37f-45fa-a867-63412f13e6f2", "comment": "Malware payload (Mirai)", "value": "1261a57a736b177a28d588539d4bfccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883106, "uuid": "ba80ddda-eb22-497a-87f7-75a88affd7f9", "comment": "Malware payload (Mirai)", "value": "734268f4dcc9056944e9ab2360698fc695f21c724ab8ca7eafaaa66fd0681928", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883106, "uuid": "98845ab7-d904-4a69-8c4b-6232445b40b2", "comment": "Malware payload (Mirai)", "value": "c4ec617679cb7721e56a1af1b80b7eba269a8b8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883106, "uuid": "6606d543-5fad-4a6a-9799-106d3a64991a", "comment": "Malware payload (Mirai)", "value": "2a7881fcb5e1d8e724a19610a0513247879c7af05c254d32d1f43b0b81a88b2caa2846fe9cd80da2f2afdd5ef7c090ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883106, "uuid": "1e714d24-6232-4aa3-bea7-47fc7bea916d", "value": "T13A64F60AAB210EFBE8ABDD3702E91B4129CC540B21A82B797574D958F54F54F1AF3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883106, "uuid": "960efc50-bbcd-4ad5-bb33-73f90b53f981", "value": "6144:ma6qdNOQu4uDdBV4eX9kJ+P5rkNUdEuOuY9BXr8Y5RMu322Hd:ma6qzz+P5rkNUnGBZ5RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883106, "uuid": "f77e0f26-2b08-4281-a51a-eb84bbb1fdae", "value": 333920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883106, "uuid": "7600d2be-f671-4939-9f61-4570ae7224fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883106, "uuid": "a56a94fc-5ee3-4505-a919-a124661b4452", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09552be5-d0db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829962, "uuid": "89755cb8-49fa-4bef-9baf-06e5d7d1cb3b", "comment": "Malware payload (Mirai)", "value": "67766df84ea86ee84ce9c96b8f96f19a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829962, "uuid": "8df23554-1bbc-433a-a7fb-e256eadc2e0c", "comment": "Malware payload (Mirai)", "value": "750250672fc9ed5b56558908269341e6d610fb21af35b49912b20b7e700ea06a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829962, "uuid": "bf76489c-ae90-4106-ae2c-e83e30fbbbe3", "comment": "Malware payload (Mirai)", "value": "b38ec19d688e9ad3576d3561cedca2af829f0839", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829962, "uuid": "572a4451-28b3-4d93-b946-f9daec25883e", "comment": "Malware payload (Mirai)", "value": "6c62d4cfbc9f834fb39cec52b22329f0ca48e09522f4269632f74b8a7a638c03a92407516f7f0f3846415bea73a2d7a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829962, "uuid": "67bf99a2-f37f-45f6-ae69-23c70ba84592", "value": "T113733985F987C6F2D407483042ABFB3FCB32D8A511B19B4DDF569F35DA33502AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829962, "uuid": "0cf7d540-1093-4ae6-9786-a6db09d6d45e", "value": "1536:8A9Uqtm/qzBpeKm2XpQmj7qWSICRzBbkivom3aJ2ddLNn:8A9U7KBcKm2Xp3jnrCRzBbVvfddLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829962, "uuid": "315fbc11-e2bd-4dc5-81da-44860bc5bb00", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829962, "uuid": "ecd63d3b-982b-40c9-b072-21a8a9b8fe03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829962, "uuid": "7fb46ef1-78f3-415f-b78a-cbd015f7043e", "value": "ub8ehJSePAfc9FYqZIT6.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd95de2-d148-11f0-a129-42010a9c0007", "comment": "Malware payload (ThunderShell)", "timestamp": 1764876997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764876997, "uuid": "3c27e860-cf61-4909-ac99-304953f18b7d", "comment": "Malware payload (ThunderShell)", "value": "b3fefeae38cdf3e651ac6389bf5f12ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ThunderShell", "colour": "#81AE0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764876997, "uuid": "980d8f0f-dd52-490b-b6b9-a8247f07635b", "comment": "Malware payload (ThunderShell)", "value": "75485847e431dddea1d9aee4cbc49066defc4fa8347cda67835009ca7d95b799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ThunderShell", "colour": "#81AE0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764876997, "uuid": "d65b7024-cd6b-4c45-8ea9-cb8116f2f45f", "comment": "Malware payload (ThunderShell)", "value": "8a1203beb38115a0bc4e59308d3057fb63611cce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ThunderShell", "colour": "#81AE0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764876997, "uuid": "8c4e3888-2e12-4674-80b5-1cd0dd9e2669", "comment": "Malware payload (ThunderShell)", "value": "e20e9da4005f4ce96a38529e90d7b344129e4b52f25806cf278a1f3cc825cacefbd15dfa784f7ac5e76e9a48ee7d99a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ThunderShell", "colour": "#81AE0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764876997, "uuid": "8b88dc48-967d-42f4-ba6a-428cb211de10", "value": "T1E3A7337A151CF323F0ABC6BA17371F5458B405BBD1B569E37E92D43A9C8C3A2C0A5847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764876997, "uuid": "d9bf548f-a344-41f4-815e-74c3c1e8bd6d", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764876997, "uuid": "ec483940-84f1-4826-8850-a6e577483b26", "value": "786432:TDcNVAFe6xquU3k+VixLB4WofnK0a3GDts4ic1YTe0grV4Klb:TgNaLUfuLBUnKT3GDts+qy0g4Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764876997, "uuid": "49e27101-ae01-4b26-b4eb-76bc0d77e34a", "value": 44874280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764876997, "uuid": "6b737f52-3402-4ddb-94e2-c2423b30c4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764876997, "uuid": "44a4caef-55ec-4a2d-ba8c-74e66f32edee", "value": "RV-tools-4.8.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce6edae-d0ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764823069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823069, "uuid": "2ef78c9b-6a68-406c-809a-90302a521ba9", "comment": "Malware payload (Mirai)", "value": "0444e67490373a1cf698a9f7132b70af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823069, "uuid": "0e74000e-1d0a-4ff1-a7a4-367ddc4c3a6c", "comment": "Malware payload (Mirai)", "value": "75c645674684ebe8feddfc51b9299310c1153c376ff8d2c0d3de3317f98c3230", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823069, "uuid": "2ea2bc8a-a43a-4c78-a42a-0a67504c7ffd", "comment": "Malware payload (Mirai)", "value": "2b8f1dab5809a2934c93d4633006ea7447137caa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823069, "uuid": "7a30bced-a374-46d8-8461-6c19a95ebb34", "comment": "Malware payload (Mirai)", "value": "d5443c3fc646e356398bb1f812022d3601e1e34233293751fe4a34eec079adfa0db1745ef5905c951fe6ea400a5cab7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823069, "uuid": "ab76cc56-6987-45ca-b354-1d4bdba012a5", "value": "T10133F1375819969492F20972D57F9207C6AE01FAF04271F363D18B06EE0598E53BD9CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823069, "uuid": "5900aa0c-4808-47e8-b6b1-483bc5db52f1", "value": "768:3ZWcjjp1vhD2+Bx8XH+eP8mjsDu6sZy3xQ7DhS959u4rqSm77IapctnfEIszq3U6:3Nnp1vhDjBgH+HsZ2GnhWSsVm7capYs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764823069, "uuid": "a9aa81bc-c0c2-4d3a-b9e3-5c8bd745f029", "value": 54896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764823069, "uuid": "115cc996-8252-40d2-8a15-505f10d62217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823069, "uuid": "0ccb071f-f3ae-4e78-853a-556a7f7c9f79", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9774b3a-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829076, "uuid": "97af490d-7639-4785-870b-1527b6c45a69", "comment": "Malware payload (Mirai)", "value": "a422ac8642889d8fbeb4654ffb126fc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829076, "uuid": "307ccbb6-5129-4f31-bc1a-bc18179d890e", "comment": "Malware payload (Mirai)", "value": "760e11e1c96377092948d2a68ee7fb538103f701d50004b2b2fb23176573861c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829076, "uuid": "2ae50e0a-ef6a-4540-b4c2-a52abf26ecf9", "comment": "Malware payload (Mirai)", "value": "164ae6f0126464c977cdb5e0c0e2a553e91c54c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829076, "uuid": "cf46b303-5f59-48bf-b2dd-3a7c54238295", "comment": "Malware payload (Mirai)", "value": "7e3793ab21a9b81136e5481ee67afdae9e7a57f49e8e8ffa861a71757ab30f7c9fa007e2c67f74d501d8dd9788eaf2fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829076, "uuid": "19d2a359-ef9c-4cd5-8469-0f46b284fa48", "value": "T1BF03F2D9C89D2970E06F21B018F9E74B5410928CC0B88DD7DFCE124B2BA9716392CA57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829076, "uuid": "8dd652ae-2050-450e-9416-3a6c75b88008", "value": "768:WpDDQdmx3ELhtPG5AZhTHgQtiLDPNie3Asw64gE6nBjIuhAfxizFnbcuyD7UHQRg:WpfQdmx3EdtPnZhrft+Me3Asw6C6B0uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829076, "uuid": "cb1230cd-1dcb-4a73-aa36-ba05c2b55b50", "value": 39692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829076, "uuid": "316cfa6f-8e6f-4fd1-9b85-886b232a5565", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829076, "uuid": "fa95da77-2be5-4ca1-b211-42379f78799b", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfcd08f-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883120, "uuid": "b972e64a-7cbf-4544-b434-04fb2d2ea6fa", "comment": "Malware payload (Mirai)", "value": "48ba304c7c7645cbeb0ad894ae011c51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883120, "uuid": "7332cfa5-0dbb-43f3-b266-64f21a72808c", "comment": "Malware payload (Mirai)", "value": "76e6c934f150800c79554c23a6e891ce7ab46565e3bee115af0f2b5ae912b72c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883120, "uuid": "27f4e81c-b70f-42fd-80e6-b818d1a49f13", "comment": "Malware payload (Mirai)", "value": "25667ea6c656e73b7be2fdb350f1e7a5113a9b29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883120, "uuid": "029181e6-24df-4697-a5f5-31f3124e4496", "comment": "Malware payload (Mirai)", "value": "03e5b8b64e95d60229faf5d7c9ceaacb1b2bc7c99e370ed3f2dd22b295fb9d77bb802c025d55ec30fe1d5301d0ed4168", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883120, "uuid": "e5cbce3f-1f8f-408f-83bb-d67468aa4548", "value": "T19764D70E6E228F3EF7B8873457B74E20975D23D627E1D584E1ACD6110E2064E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883120, "uuid": "63b95e49-8b47-4c6b-a5c8-155c7a2d93d8", "value": "6144:Co43gjBFLshFwwIGiTpNZ9qpUDnpPAA88SJrs+FAPjvz3VUA26BHIpf08oxNoP3A:rSJrU33PNxNompHXVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883120, "uuid": "993a7e55-f0aa-4c48-8ed3-6d4eda5a3a98", "value": 327968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883120, "uuid": "5bc16f44-0961-4037-a5eb-1ebe89f70449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883120, "uuid": "06ae3e9e-7706-491a-ac01-19df154dc7d7", "value": "ecco.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b3c713-d0f6-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764841737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764841737, "uuid": "16e9adbd-dd4b-4768-a498-a0bb12436ac0", "comment": "Malware payload (QuasarRAT)", "value": "f3c9dc17facc19227ff0aff86a934b85", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764841737, "uuid": "20d1ac00-89bd-4052-9b72-64e58e8c988b", "comment": "Malware payload (QuasarRAT)", "value": "7781b6bd39048ad0713d0b6ff31ecd26b4a698cd851c5113d3e06e7e65aba2d5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764841737, "uuid": "dfae32b5-c819-47f2-b985-2b2ee1927d72", "comment": "Malware payload (QuasarRAT)", "value": "b1043295614715f6c20ccf6788a7e98eb9495e5f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764841737, "uuid": "c1f9a324-f58f-4a7f-af40-a76126724380", "comment": "Malware payload (QuasarRAT)", "value": "6581f11c18fd56878c41fccee31722469115685464661ac914c675e0cc5cebd3f14a5da4134fa4ce6e126672260fa6f9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764841737, "uuid": "87470e9a-1d2c-4e16-b93b-8ca3fb9de333", "value": "T1DF9633124E79AE7F0B7C55B820BE1E0F2AB14D440401EEF677E6BCCF6A8EE191557068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764841737, "uuid": "038610d3-7864-417e-b617-013077e49741", "value": "49152:+RYRSp+TYXeqZ9d6EtLjjG9b2vd8xP97hGf/X00cGBCRVNXV0pxgzkpCCjPp/FkN:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764841737, "uuid": "ebd4740a-a40b-44a3-b534-88cb46ee9014", "value": 9378321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764841737, "uuid": "a2b71330-1ee9-4256-8cd9-adb3c6b053c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764841737, "uuid": "6f85ebfc-f765-4bc3-a509-b594aad91be6", "value": "syn.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e913e140-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875434, "uuid": "51421a66-1d62-4d70-9c1f-2be79e1d7d1a", "comment": "Malware payload (BlihanStealer)", "value": "0a16be17def8e457db49c8d369d07b69", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875434, "uuid": "7c4c2cf6-ab27-436e-8283-5f9c32db95cd", "comment": "Malware payload (BlihanStealer)", "value": "7782d2d587752a83734a84ff58a22955ee112178c496edcb363efda0f64bee17", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875434, "uuid": "9adad064-e4e4-4edb-881d-2f5ce6b227ab", "comment": "Malware payload (BlihanStealer)", "value": "60a19ec75bcfa6b3f033ff72860542799a18981b", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875434, "uuid": "5d692837-03f1-4ad0-949c-1feffbb347c2", "comment": "Malware payload (BlihanStealer)", "value": "74faa00722ec8e016345ef17501b9ed1bb3f4c054ac8a912fe3758b0f704dc016db598ea5291fb15db70f453f6b32fdb", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875434, "uuid": "5020f59b-fee3-45ee-afa6-78d2ceedd527", "value": "T17FC3E60B5FB1C8DBD851043A57FAA22D86EBBC440DECE35687DDCC4634C2918C8AEA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875434, "uuid": "f51d8c5a-7aa4-4552-917b-99c2304d2ab0", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875434, "uuid": "36b48a9d-98b6-4a22-9745-bfd8667e8bfe", "value": "3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKw:eene", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875434, "uuid": "1f221c24-aaf2-4980-85d1-47baf6b60f58", "value": 129286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875434, "uuid": "ac98bc51-f4c0-453a-a849-f3cd0e3245b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875434, "uuid": "731d647d-b521-4cd9-998f-d66f5e235509", "value": "8i94hx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1952a01-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764834190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834190, "uuid": "f6eb84dc-25aa-4a80-8261-cca35173331e", "comment": "Malware payload (AgentTesla)", "value": "369ea3a5b4c6e79cc6faf3a7ab160a9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834190, "uuid": "0546fc74-d3cf-432e-90a9-6b3732270519", "comment": "Malware payload (AgentTesla)", "value": "77f1708ea636836dff7c34a890bdd1288b76cc422bad650c87003d163755bf41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834190, "uuid": "b4e56437-4526-44ed-9b14-6d15bafe5f2b", "comment": "Malware payload (AgentTesla)", "value": "9f1e384954cbf7ec1d59fa2dc85f88532f27ed4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834190, "uuid": "3b32b2be-2573-4fb8-8818-73855b47b258", "comment": "Malware payload (AgentTesla)", "value": "87cbbaf9650613a2e036b74630ce14e84a0e9ba8e34d4a37dc97c784f06508e57534f596c350a04698176409cadf46df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834190, "uuid": "a8e3840a-d247-40b6-8f3f-6ac68f19e0d0", "value": "T1484502114DC42FB5CFAC9A1880FE191ED3E05ACB542A6589FB37BD4AAFF7604021B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834190, "uuid": "4e0de2a1-ca2b-49e6-b764-e96f110cc56a", "value": "24576:FYy9657T96IxZnwbm+arMBvo1BmF6NX7lcL8pjxM++bQ5zZM2yJRlAI:F3X41XEK+FT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834190, "uuid": "71ac8e5b-64a9-4343-b47a-097865c4f17b", "value": 1223203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834190, "uuid": "95fef244-854e-455c-8429-8ca902843225", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834190, "uuid": "6fbf4375-7ce6-4b84-b292-c662ac06dcf0", "value": "LOI for Telex Release Customized CN - SHGS03139847.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5df9f2-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764829059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829059, "uuid": "4ee239e8-d1fb-4dcd-b0fe-2cdb9a93d850", "comment": "Malware payload (Gafgyt)", "value": "bc89cd0179b376a13ea5507588424773", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829059, "uuid": "400500a8-c06e-41e9-9794-400c12185721", "comment": "Malware payload (Gafgyt)", "value": "785425e7ecc7a929a3cb8348e89c1dfc02dd6ccdf1b39eb0d5a687ce395d1018", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829059, "uuid": "f3a198b5-515e-4dd3-9985-5fbb5d05c1da", "comment": "Malware payload (Gafgyt)", "value": "a90aa0961f8666505fab7f540a3bc023a3c0ea8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829059, "uuid": "f68aa29c-0a43-4d34-af24-3b69f435371b", "comment": "Malware payload (Gafgyt)", "value": "7c223ecd393a4956612f457eb039d1e9537ae9b20032f7d6aa3201e9ce5b67a6440ff2b92d0a3d7bd4dc50853dd6a3f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829059, "uuid": "0294f2d2-d448-4948-bdde-b1a7799e565c", "value": "T158734B03771D0B93C09BAEF02DF727F087AAF96112A66580A10EFFC41372AB02515FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829059, "uuid": "61c982e8-c437-41b3-96d1-7bdb316df201", "value": "1536:lotQm32LiSNGOHtMeFmB7DIa3mJ2vQPgmJaWEFA1Q8yVmX02q2//8fBgj:lotNGLiSNGOHtAnIa37EiFbfVmX02q2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829059, "uuid": "82619fe4-58f0-4b9a-9df7-cb0cca1a6d3c", "value": 80349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829059, "uuid": "fe31b366-3970-4750-92e0-d5d67bab50ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829059, "uuid": "0d4b1da8-e11b-4725-bf6a-c2a34d9169e7", "value": "bootingworld.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad14d4cf-d141-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764874045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874045, "uuid": "2988c531-d7e9-4e34-a325-92f9452b26bc", "comment": "Malware payload (Mirai)", "value": "ba3d7b0b7380aecb2f12cdc9f0a03194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874045, "uuid": "3d3d9c5e-0cf5-463b-b453-9868d67b7d79", "comment": "Malware payload (Mirai)", "value": "78707d0d4c13356a6fb017ba04c1a64d5c06f1b5250ec86fe7a824fdbc9747af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874045, "uuid": "c4086b83-321c-4eec-aff3-ad82f0d411b2", "comment": "Malware payload (Mirai)", "value": "070d614a1894e4a4ed8a091e85e804fb87bdf5ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874045, "uuid": "485750dc-4f76-4aa8-91a5-55107302f916", "comment": "Malware payload (Mirai)", "value": "9c9673ce714ed6b925c121b0b457d544e51509a42e7a304c65de69504c45c6824da9f084a08b3898fc3631afa4372a8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874045, "uuid": "5e103d54-bd21-4887-8527-61645ef4a42c", "value": "T1B6A67C4BF5A358ECC09AC430475FD663A931B89542317E7B3694AA342E77E305B2EF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874045, "uuid": "4df0cb9c-256b-4fc8-bc3c-5f4fe7b487bd", "value": "98304:a1uVrSrBIe6uK1JcVb28DTYtxeOmJosFNQ98s9PEqlWmEfpIawQW0OZkG4ckRUaL:aC/uKpE0SUa3Gn8gMB+5qNnIFzAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764874045, "uuid": "9fb447f8-0add-4e1e-801d-f0f41099a30a", "value": 10162888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764874045, "uuid": "74460584-8f9e-4f3e-8313-b528135348ed", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874045, "uuid": "01956654-3545-44ff-8c95-3b356e2fe4ed", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72edcee6-d0a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807805, "uuid": "379ed04c-c432-4092-8448-7621ee57736f", "comment": "Malware payload (Mirai)", "value": "9f89d1cb290655b292ed1587cf62824a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807805, "uuid": "d3e04b57-d64f-4a5c-b796-efbf18b45c1f", "comment": "Malware payload (Mirai)", "value": "788f7b8e67e9f00beb73d5a44cc2454ff8ae2caaa1c278c6535138bac5577c3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807805, "uuid": "67734c28-fe78-4891-8a03-569ddd0915e2", "comment": "Malware payload (Mirai)", "value": "ccbccea4e4e7d524e744b82da6ce267e5c5f528b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807805, "uuid": "bd7adcb0-67c8-4d7f-89c7-96b210b52bec", "comment": "Malware payload (Mirai)", "value": "dc490ed86a17c8f81d107227322eaf56cab63bc471638f09072035583b517f13f7e84062e992b966a9b236f165d240c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807805, "uuid": "e975e1c6-3415-4fe4-a52e-33168301cbe6", "value": "T182631982FC92C96AC6D82376B76E228E3321B3E4C1CE3717CD189F6537C561E5D66A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807805, "uuid": "a7b239f2-6e14-418d-8e5f-ed04b3c98d47", "value": "1536:u6HTrvpmLYpasjtZ8d6bmZY7m+zuvRKfOfzO:u6zrvpmEDbMr+zuvRKfcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807805, "uuid": "4bcf0eaa-bec1-492a-acf0-f5743b73f77b", "value": 67620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807805, "uuid": "d685b427-5f30-48ad-af20-0745429cd540", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807805, "uuid": "9cfd713e-4ef5-43b9-8a69-86c55cdcc5e8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e505c314-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764870703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870703, "uuid": "4c108912-c59a-4de0-9ddd-c4c9a65931f7", "comment": "Malware payload (DonutLoader)", "value": "eb1bc17a445a06a95f06e8a074db2cd9", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870703, "uuid": "896342f6-e330-4c95-ae66-2af44e77f03a", "comment": "Malware payload (DonutLoader)", "value": "79f0acf2131cbf540c40b01e4dca821afddbd8aed1b869395e07acc3c855dd95", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870703, "uuid": "4765b848-b59c-423d-a6b1-0ef7dd5bb5db", "comment": "Malware payload (DonutLoader)", "value": "4d507cf275844a0726ff3dd42a851a195f63872f", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870703, "uuid": "c4afe9d4-2794-4feb-bfd0-209b64cff722", "comment": "Malware payload (DonutLoader)", "value": "b565f842b002907063ec7310fb0963ed153808a7b344c018298631934aae424c0cf571a1a2405c02d8209ec752376419", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870703, "uuid": "c075cb29-8d1a-4cc1-9577-61d3cc3e17f3", "value": "T1F0044B5772A830B9E0BB817989920A05E7FE78155F60BBEF03A047761F376D0953EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870703, "uuid": "c309671c-01d6-41ae-ba1e-f2843ef2da59", "value": "efeb5d2e785b956a774e5a38aa6509fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870703, "uuid": "3f0ae4e0-6cc6-4f6b-b09b-7e50a436c157", "value": "3072:nDNnXHDSLs+FF+gXWrzDwFakFUlh/x0gG/IH7H/1WSAr:nDNXHD+zdAqaYa1HcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870703, "uuid": "defd5775-85b1-4c01-b6c8-7f302e6fec35", "value": 182156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870703, "uuid": "c0c94745-ec38-4856-aa4b-84af72c6a2b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870703, "uuid": "a9c775e7-ee63-4fb8-84d8-ba2fdab2eb39", "value": "y0lxsdefws.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4edfba4-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807030, "uuid": "3210983b-e08d-4378-80b7-be4413cbeffd", "comment": "Malware payload (Mirai)", "value": "688b7d07ec9cfe985ef3e5f6a057383f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807030, "uuid": "9f8f5434-cdc2-4a3f-9f3c-8560eb4f1c27", "comment": "Malware payload (Mirai)", "value": "7a56f51afbed2657e6b48c3f55d9ed9c68e87d0a6215481789b3eba362e4d156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807030, "uuid": "3925a8f9-9b2e-4348-9f9b-8ea71068e31b", "comment": "Malware payload (Mirai)", "value": "c38dc4d0d6613ff95a696a821aff7d00641f032a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807030, "uuid": "22d040c5-775a-4113-8b8e-42643c21f907", "comment": "Malware payload (Mirai)", "value": "2438a38ed4cf4df0ede3e25649590588b46cf69a09186470a43d252d4314c2abcb2c0527ac3ec9e66c42a2e6e376e856", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807030, "uuid": "28cfe09d-ffa0-4779-8b5a-c48b2116a355", "value": "T18C438EB4E42A9D54D0850174A8B48F750FA3F2C883621DF73BAA46B1540BEB9F60DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807030, "uuid": "a679403c-0086-49db-8a5d-abf2978ab54b", "value": "768:f3Dm+BLr3pN3b3xMmWQZ7YnYhJ2wGQDmhMOfPA1eCHo1Y4dbC2WwJZY10U:bm+JDpP/Z7VrGQDYA1eb1dbC2PJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807030, "uuid": "44c39f80-534f-48a3-9fed-455287518b93", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807030, "uuid": "8990d07d-4b44-40c8-b64a-5041df68c3ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807030, "uuid": "59224825-b642-47c2-8e0c-fbadb6ef4f45", "value": "uYtea.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d221a8d2-d0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764839747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839747, "uuid": "356d1726-c6f6-4a09-8051-387f4f153587", "comment": "Malware payload (Mirai)", "value": "9b4475f2877114c493d6a87ff26751f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839747, "uuid": "45899001-da50-4150-af14-71067a86f010", "comment": "Malware payload (Mirai)", "value": "7a61638f572191d6c51bd207a6be4feb0258a6b63653b72d0da9aafbcb695dc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839747, "uuid": "52d51043-16dd-409b-9e12-349b15903262", "comment": "Malware payload (Mirai)", "value": "af940e55c640af55c9eef3eaaccddcf68b4f8874", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839747, "uuid": "e4736344-2df6-4ef1-a78f-304e8c593cda", "comment": "Malware payload (Mirai)", "value": "7bb77c2181b3d7b6c21ab3c0fcee2bd8c10b036656434a72b2ca7f1708bf8cb4d9691607cdd39ff28634d9745e6ed40f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839747, "uuid": "9af21e6d-069e-4c26-ab89-d76a58552524", "value": "T1C5E30945BC919E57C6D522BBFB5E428D372613A8C3EE7207CD252F2437CA95A0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839747, "uuid": "eeef251b-d1a4-49fd-b151-c4494e71a0ff", "value": "3072:JIcUUO8EWeAcdVUFceq9u7nwjOwxhBHbg+Fzz65:JILAcdC+pu7nw6wxh1bTFzz65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764839747, "uuid": "c4f4c136-fdc0-4a60-94c5-84e1c86b1d49", "value": 154464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764839747, "uuid": "03180911-7ac7-4098-bcfc-4fdb4032dfe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839747, "uuid": "b16dc2fa-5253-4b9c-8e23-62cc673bf494", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7d2ea7-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880861, "uuid": "aa5f45e6-bff1-48e8-98b9-4e3d20912fe2", "comment": "Malware payload (Mirai)", "value": "9a25b731c93051b71b7980eb2c4fb83d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880861, "uuid": "9a597505-aef7-4f5f-a8c3-4343bc5306aa", "comment": "Malware payload (Mirai)", "value": "7a6e0222b6982224433647fad628d40b49463a9314532e9c84cff07e3b1bb142", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880861, "uuid": "dca36403-d15e-4567-b264-6f31ec80a6fd", "comment": "Malware payload (Mirai)", "value": "cd1a81bc8cd95fe952bce2f2b5e3260e0e3da441", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880861, "uuid": "f39c58eb-2e76-47c3-949a-372c5056ee24", "comment": "Malware payload (Mirai)", "value": "e07c718b85c9fcf08c05628822260151cd002c35c108ae21f0325ea5d66d5dde8f835f319a0bbf975c90aa8b49c68568", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880861, "uuid": "c928f381-a087-46ff-b269-035bf53d5b33", "value": "T1E5531846B8818A12C5D417BAFD2D018D731263ECE2DEB212DD145FB477C692F0E7BA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880861, "uuid": "5236e9e0-f9f4-4d77-afe6-6574512cf2ce", "value": "1536:QdnO1YaLG6KBJGaOQXH7OhJOkphJPLFIsi1qTPKWin1:5fGx7G9QXqhUkgqTPKWin1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880861, "uuid": "9b624a7a-32e4-4316-b6db-33bea3f79c51", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880861, "uuid": "1b613efd-ac47-449c-bff8-ef06a8bdb829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880861, "uuid": "39c59248-c4bf-4a40-8340-c7616312d4f4", "value": "DEMONS.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426daa67-d134-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868283, "uuid": "02b47a82-6064-4ec4-a30c-83334e7f4155", "comment": "Malware payload (Mirai)", "value": "95192ca357f6d560c29dcf7a9e519967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868283, "uuid": "aa17d053-f621-41bc-9d1d-fcf0c7e78d48", "comment": "Malware payload (Mirai)", "value": "7a997cc714605a82add49eb6a97b1609ab161f9d6c656692c55d5d690a01128a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868283, "uuid": "01d4b40b-d387-4042-b270-a8cf6b8071b0", "comment": "Malware payload (Mirai)", "value": "eaa038369aa4f5981ae2268f3861119d31493abc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868283, "uuid": "3b905384-d197-4623-9e36-38103cd4af51", "comment": "Malware payload (Mirai)", "value": "377235f1301ab71de7b7fa9d867db1465d765bd03fff09712c63031aebb1ae000b0c8d62d3e84b28b90606d312e42af9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868283, "uuid": "20fd1490-45e4-42e5-952f-0049bfb4e37f", "value": "T1ED34D60AABA10EFBE8ABCD3305ED1B0124CC652722A93F7A7274D514F54A64F55E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868283, "uuid": "8996fefa-e896-4d3c-8f3d-56c111c6784f", "value": "6144:+Yd8brdaeJkWYp6QrrP5GStNdzRHpkQQeJ:VcYLtbRRHzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868283, "uuid": "b920bee2-f28c-496c-af5d-0aa55df32b62", "value": 234588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868283, "uuid": "039e8633-9921-4f02-ba95-9a0b14516470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868283, "uuid": "1c68bbca-70e5-47e0-96d5-7bd6d917ea95", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d73b0bb-d16c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764892353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764892353, "uuid": "d716f8c9-7a77-4cbf-85dd-a36ee5da9563", "comment": "Malware payload (Mirai)", "value": "b68f70e1e6fbe9829b687676c7698a36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764892353, "uuid": "747c375e-445e-4ab4-9080-51d17c832531", "comment": "Malware payload (Mirai)", "value": "7ab8e6cb80957b3a7b4da9624c610481a565f122f27991e7c60474eb6d54fb71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764892353, "uuid": "be755f3f-204e-4f40-b451-f7e60323b366", "comment": "Malware payload (Mirai)", "value": "a85c80fd15859d623aff2873438fcd268ba42da2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764892353, "uuid": "a8476f65-2c9c-4dfb-ac01-3f0e6a9fa57f", "comment": "Malware payload (Mirai)", "value": "7b91493442b70fd21c67864fc1ec2c9d3c5c614465d0d7d9a9993359ce226589f7b16398108adda59a42fc550929178c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764892353, "uuid": "8911e199-f680-4455-af0c-84c2d50dbb0f", "value": "T1415173CD29A1093558A6D4F7D269C68C214AE0FB0CBE5F489CDE36F4C0ACD4479B87A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764892353, "uuid": "f89d3da5-d82d-4015-800f-c2652e286d67", "value": "48:vJyfl3GFJxXnZjsF9cDWTzGg+rb0SolJCsKe34lgrB4i93Ia6arnaeVcaxq:vJyfl3GFJxXnZjk9ZTzGbAzlJCsv4lg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764892353, "uuid": "444066a9-eee0-4087-b936-489325ea582b", "value": 2550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764892353, "uuid": "d07a5b4c-3e9a-4d18-b959-836f690ed536", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764892353, "uuid": "c36e7899-b4c6-46f9-95a3-41d2e782d555", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf3828c-d137-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764869533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869533, "uuid": "d518d02e-3dac-48da-b116-17a3b45385cb", "comment": "Malware payload", "value": "2da9f7fe1b626d812605fdd5ae41c40c", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869533, "uuid": "0c4e8eac-3652-4b82-92ce-11d4276301ca", "comment": "Malware payload", "value": "7b010ee4fbbab7d0c9ceec8009a4fa153df0e67d9482b4122cb5cfae2beff384", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869533, "uuid": "151b4544-b4a3-43bc-9bba-5783efa5e326", "comment": "Malware payload", "value": "af9616f89d3dfb5004e61661f7fa741fc0b3be02", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869533, "uuid": "9fbb053c-c8b8-4c53-bb6d-214d5849fd5d", "comment": "Malware payload", "value": "b7e8775a9877cd7f86d3028482b72f38042f31afd92569e8d3f619ec63bdf76547e016e15fc02af5833e805e5a547b10", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869533, "uuid": "de6cba43-e5d9-48d4-82fb-382c170c5fde", "value": "T12F451206E2D0DC19D5DBC6306517AE80D17EA912FB864553D72A370328B2B792B37B8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869533, "uuid": "d65c03ed-28c1-45bd-9f4d-5480db9a7754", "value": "24576:tFGasouI2y3fScBkyrSQFIl0x9qxslR4zjE4hYaJh:tAasomy3VkxQ4AREQ4hdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869533, "uuid": "c7832a89-265f-4374-a7a1-72ddf40be1f0", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869533, "uuid": "f1db2ad3-3b9a-4f31-b900-ac5753325516", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869533, "uuid": "5cb45b12-71ab-4da9-8dc7-0f7279ca6f12", "value": "SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.14219.29116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908b2ac1-d13d-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764872279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872279, "uuid": "24e884d1-d4aa-4f3a-b034-507125f10e83", "comment": "Malware payload (BlihanStealer)", "value": "f32545b50e4ad6b280532f9e0a8aac07", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872279, "uuid": "bfd4d4c9-ea7d-4ec4-91e3-af8da53bb053", "comment": "Malware payload (BlihanStealer)", "value": "7b84871fa14a549fbc91fde9196eaa415749e7cf1c1fd623b2d9ce17c8d9f77c", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872279, "uuid": "f399682b-bd3b-48a1-b86f-ba0609e422a6", "comment": "Malware payload (BlihanStealer)", "value": "af5aa549f95df0aee94fd2e03902d66c3699ff5b", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872279, "uuid": "dac55e6e-da46-4037-9c6d-59f74d6cfc5d", "comment": "Malware payload (BlihanStealer)", "value": "5692dad6c91802c89d704d142b1b8a4dcf2ffa6644a6dc205b9eae24c84b41c5fc10f423f91aa017a662a339de1c33f9", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872279, "uuid": "594fa243-5a89-40d8-adae-ab90315f7950", "value": "T103836C13A9C3C9B6C892153306B9967D92BBBD091EFDA3438B9DDC1D2352144EE1E743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872279, "uuid": "87396cbe-35a0-4235-95d8-e5694fa5076a", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872279, "uuid": "3436407c-9266-4953-870a-1998efa70591", "value": "1536:YAowfUJFgjT284U+w2EwRz6OlvaeEpIaCtwUaSvcmGCCCCCHCChCHCCCdg1WCiNw:YAowyFgjTiUkEwt6OlvaeEpIaCtwUaSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872279, "uuid": "c63a4cfc-c184-414e-986b-0a9f36384336", "value": 81396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872279, "uuid": "ef617c00-69c1-4750-9ca5-2799aeb12ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872279, "uuid": "77d5cdb2-7ace-4440-8c0f-040576715d86", "value": "microsofthelp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ad4c85-d132-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764867615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867615, "uuid": "b8bc9ead-dcab-4c6d-9caf-703880363f61", "comment": "Malware payload (AgentTesla)", "value": "720f170d0210b1435558427f73bd017a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867615, "uuid": "3fb30e58-506e-4a50-a1f2-9aebb6f0d610", "comment": "Malware payload (AgentTesla)", "value": "7c1e1c58bd5e506e2c8b2885ebb151425e95b51745e650b126e85fa714131426", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867615, "uuid": "65334464-d106-4e9d-ae10-d7054f71ee6e", "comment": "Malware payload (AgentTesla)", "value": "9de3ecf337464d81f1f6ac42ec9d65efdb6ea904", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867615, "uuid": "4b1463e2-4fb2-4c06-b3da-187ccccb1ccd", "comment": "Malware payload (AgentTesla)", "value": "e5d164445fbe490788107a6ad76b74b64723ada890865b184a66026dd4cf03cd2e5bda255ff63cb4dc42c0ee12e6ba56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867615, "uuid": "10a13924-dd41-48af-bc99-74dbd71e8621", "value": "T1C1C43312C6B7D62F5EF610416D63870A1352745C379AA3B6321E3BD37A602B6B3F2D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867615, "uuid": "43851694-a193-4790-8146-2bdc5198c2f7", "value": "12288:9wSTbD/jNLHLaQkH475p5crbjFymCAJP29ZAHetGHJO:91TbD/j1HLaQJtLcrbjkfI2EWIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764867615, "uuid": "7cb37c91-d00c-467f-affa-ae677c81a243", "value": 560281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764867615, "uuid": "b4a1d43e-4b67-4251-9615-3152bbd76fd3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867615, "uuid": "6645afa7-c88a-45fb-8f34-b1b0ea371c11", "value": "norden_6743.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499e49d5-d13b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764871301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871301, "uuid": "2fb0b229-be6a-4c98-b91b-03152ad097bd", "comment": "Malware payload (Mirai)", "value": "b21530f22ae7fc922177c5093a334852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871301, "uuid": "4b86e2d3-da21-4ba1-8145-58cba00c8d4c", "comment": "Malware payload (Mirai)", "value": "7d314bca4c8270dd84710c19a57f73d959dd32ca6f29552492986568379adae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871301, "uuid": "6fead1cf-47b0-421c-b0a5-58c5d0210bcc", "comment": "Malware payload (Mirai)", "value": "69e162d350771bbd98eb1cac6c1cb0c271306a37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871301, "uuid": "ac848b53-f795-4fdd-850c-56d5ce9600b5", "comment": "Malware payload (Mirai)", "value": "2dad6475f318db4d70c3790054853dbe694cbb56fb6b01326bce8f78890cf23d5e63eedc7102ce520b27b22eca9ea73d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871301, "uuid": "aa749ec6-e1a5-4dc7-888a-8f08112f0825", "value": "T18A23F1A8F281EB56C7341677C0E2064EA8663CFDE1DAF43A10447C9C3FD0A2A74A452F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871301, "uuid": "aeaae8c4-ac5a-4873-8b10-b757b7e0f34d", "value": "768:RBUEqwVkNpLviNmQDeRdJmLN9YZ+7Sp5qa0s6CbN2rMjyEt1/40Dy9q3UELUH:lVk2EQwrHp5A+NUg1/jnL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871301, "uuid": "917626cf-921c-44f8-8ea3-fb7bd7e61002", "value": 49160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871301, "uuid": "ed13eee2-af6e-4087-a7d0-15e35aac66a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871301, "uuid": "79401ec2-f047-467f-9788-906b959357f3", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b300d44-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816758, "uuid": "06b2a5f7-bf9b-4688-bdb8-5563325de125", "comment": "Malware payload (Mirai)", "value": "f9f63776228e1e3a8c73cac71a886bdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816758, "uuid": "d6b3c7c5-ad0a-47e7-9c75-4c253dcb8a3d", "comment": "Malware payload (Mirai)", "value": "7e11dbabe6d516158d29624cd44278d61a3f6eee0ff2fe0fe70ebe9dce784d64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816758, "uuid": "c693d112-749d-42e2-ab86-51b9b63d5855", "comment": "Malware payload (Mirai)", "value": "da138e09797711fc97c936689f473a27c1f0c513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816758, "uuid": "8552af07-3779-4e17-b308-db44fbe694aa", "comment": "Malware payload (Mirai)", "value": "6fff97b398d64dc57f025a9d68b4cdeaa99a06c08afec8183375d6ab38c912969b2ed5a2529f066b96fa23efcb102957", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816758, "uuid": "55c01dce-1652-45ea-b965-378675863eda", "value": "T10AA35CE6F400DD3DF84AD7BE40270609B920936517A30F3B96ABFDD37D321A85A16E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816758, "uuid": "619f444e-f419-4831-ba98-2d33f297ffe9", "value": "1536:hryDrdgXQmTSnhRFfcfyTQ5K9Z8NgvBi/DGXZoZMDXT+0YWWMkSxk:h6SQTnnFfcf75K9FDXOa7SMkWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816758, "uuid": "20224d53-4702-4488-8c2c-6dce0f0b6877", "value": 102024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816758, "uuid": "cc50e519-9d2e-45a3-ab60-345d32d09a3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816758, "uuid": "b6922336-c0db-4a1e-a057-399320266849", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28a0139-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829897, "uuid": "76826ed2-50b5-4f16-b0c9-d5bcbabd13b7", "comment": "Malware payload (Mirai)", "value": "e3c94ca26fec84f66276bfa0c92e4583", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829897, "uuid": "453c7216-ac5a-4be8-b53f-809a5c4d8117", "comment": "Malware payload (Mirai)", "value": "7e70e33fd40d93084c8879ee80eefc22718a5ed210b94f4fb31e8f79d4392005", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829897, "uuid": "a82854a3-c0dd-43eb-825d-dd3d0e761111", "comment": "Malware payload (Mirai)", "value": "36deff956a5a42ec3d44f247a21499a3efb3cfef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829897, "uuid": "f6a29e95-0c9d-4926-bddf-5978a7811523", "comment": "Malware payload (Mirai)", "value": "85f4e75777585d4c647f6aaa72f16366543b54a18b9eb942a6b60d8c77f52cf4385bc19921f1d8e9a5ae466a80aa2de9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829897, "uuid": "1ed833bb-64b4-499a-b9a8-7cd6bb573a74", "value": "T10A030213D45A58C5D95880F2EA5380422BE15BF0F4F973637350CAF59CAA8AA39F8F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829897, "uuid": "7bcfd01c-9d18-44b7-9053-1fd942a7445e", "value": "768:KWVVasPGxpBnekBYlk8i0fPkD+bk4nwx/RWUiQ5kHExkH+c9q3UELyq:KWXasPGxplekBgTP654QwGakxkHmLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829897, "uuid": "b71d3184-33ab-415c-93d6-060e77d0f1fb", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829897, "uuid": "ad14580e-f15c-4a26-a9ff-b607ee8e671b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829897, "uuid": "1a4ebdf0-4b8d-4afd-9e07-4bfb78bb5352", "value": "ub8ehJSePAfc9FYqZIT6.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b18664-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888280, "uuid": "df286ede-79d2-4197-8158-5e3c6eab58fa", "comment": "Malware payload", "value": "3af6bd73d450287ae97763174e041328", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888280, "uuid": "0e501914-336d-4c36-814e-5d980e410171", "comment": "Malware payload", "value": "7e83ec1c50e187d27aa84c48cb6d994a0a535333f75bbfdcb8dab11a57e7c529", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888280, "uuid": "1a2c82d7-65d1-4162-8162-ad02d1a478c6", "comment": "Malware payload", "value": "0445c7306af944e2115a8ca5453ea031e6fc1765", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888280, "uuid": "a54cd86b-44d4-49c6-b80d-a34fa90a8872", "comment": "Malware payload", "value": "927bd80ea58344608248de683ec6f85e0e3c262b7cb31930cc1fff4d88842a9396758bf82a5a6023ec70649c34724b5f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888280, "uuid": "466dc168-e883-4f64-8013-f90a78aa66b2", "value": "T1271151DF28D23141A568DD093B25A517624453CA26F83B1E21CE073F80E8E74B70AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888280, "uuid": "b8e7559a-9283-4ca7-8d49-2efd2a7f0780", "value": "24:e5nLh2nLhDnLhpHnLhYnLhFnLh7rnLhqnLhPnLm:e5n92n9Dn9pHn9Yn9Fn97rn9qn9Pnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888280, "uuid": "1b49faa8-2e8c-4334-bf9f-72deb5d0831f", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888280, "uuid": "90e724b3-f5c0-4b80-8797-5af037012fc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888280, "uuid": "8f18f47f-11af-4897-a0c9-4f78b00fd686", "value": "ipcam.goahead-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd23f559-d150-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764880622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880622, "uuid": "4c679efa-748f-491a-a794-a808fa8902fb", "comment": "Malware payload", "value": "0e977014353d0c484dec981ade39f78e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880622, "uuid": "14aa65f0-9087-4470-bc93-84b583347cae", "comment": "Malware payload", "value": "7ed1036ee93a37163c87fc0f39a846630aed33a9e304df697830c71cd1af616a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880622, "uuid": "249bd21a-5f01-4cc1-ab0f-e05fdc8baee6", "comment": "Malware payload", "value": "50e46f809bd5dcfe8b99aed30db79d7ecb2a836f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880622, "uuid": "e8a3b004-8532-4102-9c41-76a8700a2e50", "comment": "Malware payload", "value": "b620b16b4cc5a08841935fa968d7ec3fed942f300e17b408041db43387f9be55ca4b01c19387abc48f6461c066ed619a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880622, "uuid": "9626e6e0-ae8b-4135-b23f-87783c90d7c9", "value": "T16695CF13F24E673EE46A5A3649729A50443FBE60641A8CA3D6EC3E4CCE391601D7FE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880622, "uuid": "c53db387-cbb3-45bc-84ad-c5f75103c361", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880622, "uuid": "bc399214-c448-4d43-81fb-1fd300e77eea", "value": "24576:pXkwiiUWhWXKaOEMrNVNf+7ICyF7KDFbJnPrUXsazZ+Jsp1B34FGohdN1YL/iM7a:pDXrpVCywnjUX9zZ0U12GIyNts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880622, "uuid": "c97f45c2-ef41-402b-b308-ffa15d4499a4", "value": 2041720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880622, "uuid": "d64cc493-d17a-4f53-ab29-a240e9f7875c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880622, "uuid": "68c87885-f56a-4cf8-a829-0df1a1b83dee", "value": "0e977014353d0c484dec981ade39f78e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f41e2e7-d12a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764863902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764863902, "uuid": "d05ba775-247d-4304-b45a-fa07f2988522", "comment": "Malware payload (Mirai)", "value": "45294594c3902cdd09c408fc3c7327c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764863902, "uuid": "32d5d5f1-d532-4de4-bc24-600366873118", "comment": "Malware payload (Mirai)", "value": "803e382100c15488668821185252b67deb6e3e2f4abb794db3b01e6d62457f32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764863902, "uuid": "954f5197-9bca-4462-974f-2f8ab0bada2c", "comment": "Malware payload (Mirai)", "value": "6a8c5fa0106f520938f0e61be6d0d2ee79dc0cf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764863902, "uuid": "6ab0d539-b1c5-4e22-9a91-1f583ab603a6", "comment": "Malware payload (Mirai)", "value": "d93beb2990d3db3c7e85872763f923642b3446eea0024fed6ed590f432a511e39b6d69e19eec0231f4c2633f5af5a528", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764863902, "uuid": "3a954453-cd52-49f1-9b7d-533e1d83e53c", "value": "T16B43022BD3D74990F27F0271D89F6ADB2111FAEA700878979F4292488527C1C3B297C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764863902, "uuid": "05732598-8593-4c46-8dbc-5b242234fb40", "value": "1536:RhNZoUhtnJ2nz3/NKiremw/C2YiEwE9RtXivSeY4XwJnouy8tyy:RhToUhlEZKzB/C2Rk+pYHoutr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764863902, "uuid": "0c62fa08-c664-4b60-8041-ee9709090adc", "value": 56120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764863902, "uuid": "111083bf-5a92-43ee-96c3-1e712832ff13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764863902, "uuid": "c0b7c5fa-81bc-4732-ab74-2c92825299ab", "value": "Polar.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59defa3-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829070, "uuid": "6c7ad31c-3f15-4e70-b205-a36744f1e408", "comment": "Malware payload (Mirai)", "value": "60423e188078bb22e06c9edbc49dc509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829070, "uuid": "ff926520-5b16-4623-92fb-8b047d42a183", "comment": "Malware payload (Mirai)", "value": "80a58d5669ed8e70a0134fb032d4e2ce28aa1dadffdd33f4837d1f2028ba78c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829070, "uuid": "211b9ab8-d158-43be-b5ff-f4729389a67b", "comment": "Malware payload (Mirai)", "value": "734aa2c74f3ebe8b77d78e1636ce3529d73f9d4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829070, "uuid": "f4d96f73-0fdb-40d0-a00e-757cb14d5865", "comment": "Malware payload (Mirai)", "value": "7fa0e6bbd23b0b253107d0af5882154e034538c0d103cb1fa342bc3b5f7684f5e4ce83ed7988081692e2b6ff68d897b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829070, "uuid": "9846df31-d2e8-4681-be4a-b58d45512aea", "value": "T1E103F117D18216C2DFFF997424A2BBD063E44F8D02FFF6DB11829E11781B4241A5A6DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829070, "uuid": "3cd0aede-9142-4002-9a94-cb96770771be", "value": "768:nGfe47AQMTPqcOQ6utk3eZVw3JOt8QCSeEvH1es6h72ltuo4uVcqgw09w:nx4Csput0qVwg6Q5eEvVM9o4u+qgw09w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829070, "uuid": "29f1b621-7e63-4e42-b7f2-957d26008275", "value": 40140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829070, "uuid": "a972211a-f00a-429a-9ec8-2fbc993d86cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829070, "uuid": "ddf02ce2-c8c4-44f7-84d3-59168ae6e849", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76a5bb8-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829073, "uuid": "984ddbc8-fa6a-48fd-b7b7-578ddbda2a53", "comment": "Malware payload (Mirai)", "value": "af52a6c0f45aac9998ba1ef7c3c9d246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829073, "uuid": "a8fb02a7-6879-41b5-b09a-bef198ae4af7", "comment": "Malware payload (Mirai)", "value": "80cf67be2635e441cd5da20d256fea9d6825a053c12372d6f26f2a18df54829f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829073, "uuid": "acc9d023-9616-4923-a6d3-0b272cb421b5", "comment": "Malware payload (Mirai)", "value": "5dc9a315e7435b2b68445d11ee8a212eb246e811", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829073, "uuid": "22f885fd-02a4-4b0a-b1a6-55279b9f639f", "comment": "Malware payload (Mirai)", "value": "44807bd9e23a7acaf589c70cffd8d682cd2b1256bdb57e89a750d8da182837c23f03bc9087d1f6b14315fa23daba9e66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829073, "uuid": "d765a85c-2aaa-4d2f-8376-d957cd924015", "value": "T1FB73AE73CCAA2CA8D55842B4B5B4BE362773E41466871FF71696CA369007EDCF8093B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829073, "uuid": "331bc1bf-4ffd-47c3-b945-ff23b02ee371", "value": "1536:P/Q0G/PRRILXNHJKtmmHT74t73RCAZuj8FvgsM9:Po0GXRMX5wt5s73RTZuA1FM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829073, "uuid": "863520e5-5eee-4d47-9808-1a10eb109cd7", "value": 80240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829073, "uuid": "015760b3-801a-4652-9ff1-4e10ae34fd53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829073, "uuid": "162071cf-72f0-4efc-ae12-5be704fa1753", "value": "windy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e712ed-d0db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829958, "uuid": "bae79256-041f-453e-877b-3fc202f38ca0", "comment": "Malware payload (Mirai)", "value": "90424fa2de6458b84608af425919805d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829958, "uuid": "e787fc7d-0c13-4323-9026-a327ea346ce1", "comment": "Malware payload (Mirai)", "value": "81249a021d49652c540cdc85f1babefd0ef0fbba7a10f8a3b258f68541e26528", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829958, "uuid": "694479e7-0902-4d8e-9fd9-2050076e3f6d", "comment": "Malware payload (Mirai)", "value": "ed4fd84c9fa70edea238cdce212c81443f49cba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829958, "uuid": "1d45f04d-a278-4bb1-affd-21a8dd4eef3a", "comment": "Malware payload (Mirai)", "value": "4bbcbe7a8fe6d7b66d913de11343303f4285056e3a5950a3a4a51b8c303cf004c2e39fd133b4fc1aef1e0b064934aaa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829958, "uuid": "734848a4-ea9d-4875-9675-3135f3bb1d65", "value": "T12383285AF9818B11D4C5127AFA1E164E371347F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829958, "uuid": "642796ee-a327-4eb3-b13c-0ea793b306fb", "value": "1536:Gpn2EgaNGvcV+2sE/7iMPUNBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYtr:BVE+2dmTEZCSHYMactW4Bi9gnS4V0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829958, "uuid": "dde38e16-12af-4f51-a85c-7a89500b2488", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829958, "uuid": "36ead1f4-83c2-4d6b-9864-b0fa2e0eff51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829958, "uuid": "6db82911-907c-4856-8be5-eac907d438b7", "value": "ub8ehJSePAfc9FYqZIT6.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffe0f9e-d0df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764831744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831744, "uuid": "d876582e-d367-4116-a818-fd4d9e78161f", "comment": "Malware payload", "value": "1b39257924d8ea52320b751094df2eea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831744, "uuid": "17b47d9c-0c9d-43b0-be98-744fe3d21046", "comment": "Malware payload", "value": "82eed73aff63af82ec04008d7ad89d29847992b74fbd9038aa995866a16c69fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831744, "uuid": "5f382d39-696e-4e76-84db-7ce17559429f", "comment": "Malware payload", "value": "77c03d3aa13217504d6a02577ba9aa49f60e88a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831744, "uuid": "7fa25a6e-748e-4398-aaf2-9b4f452bed56", "comment": "Malware payload", "value": "81f82f51da9cf2b7c3b473ad4b996ac3ace06d7120e429f1788465757c80c4a79c2ee2ea1e67b973dfb069b5a41e1bc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831744, "uuid": "adcd24aa-3561-4a1d-807a-9d78318d7a9d", "value": "T1AAE4AE107760C467C5A202311876ABBB9BFAE97956664F0303503F5DBDB36C28A1F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831744, "uuid": "7736848f-60dd-4ed0-bde4-606286b9370c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831744, "uuid": "174a2d68-a55f-4472-8276-a349835d249c", "value": "768:T7ra/Tl+hs3E/jU0dugZ0T2Xtz+lHQW40Zz0D3jHUpi1GounzWlC/LPfw3+Ep:G/T2X/jN2vxZz0DTHUpouzWYguEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831744, "uuid": "9a88bb98-f558-48cb-9774-cd9d3d4b7f8a", "value": 684656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831744, "uuid": "1854c0f9-b7c5-4d01-bbf3-00dfabf14d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831744, "uuid": "1e2802e6-29d4-488d-afe1-c30c5074ba19", "value": "xsoeashaa3s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a724da-d109-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1764850095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850095, "uuid": "2560ed87-b028-40fc-9d5f-0e58467005bf", "comment": "Malware payload (MassLogger)", "value": "76caef4f07080313bc241af0c1bf6021", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850095, "uuid": "496b6ce3-2ddb-47b2-b79d-f3775b17f692", "comment": "Malware payload (MassLogger)", "value": "83a7f2170b05d2e8dc07557a199c34edb7a1ae451959b08b74e2006b99858875", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850095, "uuid": "dbd018eb-a571-472a-8a29-28087a452474", "comment": "Malware payload (MassLogger)", "value": "e8b807deb13b0b6bd5b4025053bbaf5ec1d788c0", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850095, "uuid": "758c6136-68b7-4703-b21c-356097894feb", "comment": "Malware payload (MassLogger)", "value": "7b6d10c69312585d07b2e5f680380fa89a64a94ed519d65b3e95b7a4eb520a43d05a362311a41a221e25c8311bcbd552", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850095, "uuid": "57cd6ba2-54fe-4fee-aed8-a3cdef036ceb", "value": "T10E55F65D5421ADD3A050FDF0F541EFA78CDB5394122B47121FE5A8AD6222883FFAB2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850095, "uuid": "8006b91a-f10e-436b-83d6-83a2a52a87e6", "value": "6144:FuAbA1LPJttMmgcJ5MJgmg2dq1RsI1DinfhzkC4aZhABWXLGNuMf+k0BQtZrCPxr:FSW8ERaBUplD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850095, "uuid": "51f01977-094b-4be7-8d80-f6532420b7b8", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850095, "uuid": "84917d53-0ded-412b-bd39-fff97d5405b1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850095, "uuid": "189027ef-ea66-4f5c-b593-1ca4825ef0db", "value": "N\u00b0 CF 22100103-2025.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0d4c0e-d13b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764871230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871230, "uuid": "49aeb12a-015e-4ce7-a82c-d771c66676b4", "comment": "Malware payload", "value": "36c0ae31d7226c7a897e1a23f8ce28e5", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871230, "uuid": "29656062-4ceb-4b52-91c6-b369764d3fbb", "comment": "Malware payload", "value": "83cb8155dc0ee75cc7a15b148f25b42f252c63625c3d50aa16073a00640b224d", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871230, "uuid": "0d0e7293-0059-4bc7-8cee-f520d0728925", "comment": "Malware payload", "value": "3e1308cf08f5eecf99b9c146058c964bad808f08", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871230, "uuid": "abe0479a-bcb6-449f-9cc2-4353300f99c3", "comment": "Malware payload", "value": "9eeae41d04e6a3086b387b384e30e1adb1efa281e5fe66795e4fb621450c9bfc6afd104e7eb70c903840f71ee8c37d9a", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871230, "uuid": "24959229-a6da-494f-992f-246308f269a7", "value": "T1E4A64A82B9954565CA6FF13995606261B7727C1A43303ED36FE80AA90C3BBC4273FF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871230, "uuid": "2c1c4ceb-e263-446c-b60b-fb69e0b2ee6a", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871230, "uuid": "6ccad936-cd12-4ed8-a9d0-e809fff342fa", "value": "49152:4pa8OXL3B7R2ZTmF0q6/TdLrHBP9w1UdnSpEGRJgMbDSR4aCjboUGTpAk/:tL3B7mTmwdRljdnSp58iSOPoUC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871230, "uuid": "67bbea06-ead3-4faa-8561-3b49af4506e6", "value": 9476736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871230, "uuid": "40859df3-3025-4b10-8bee-13baea3ea189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871230, "uuid": "93a4f6ef-054d-4e52-93fe-9c387a47ca8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf3bf55-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888270, "uuid": "887f31fb-dd47-433e-b0dd-7fa0641d0cde", "comment": "Malware payload", "value": "67c0fc549a1bc551127c182903306a53", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888270, "uuid": "bb243dae-3eba-4298-974b-6ebcdb8c171a", "comment": "Malware payload", "value": "83d4c68691f2d17f5f66a6ee0c2dbfdbfa7cb6a937bd30784e39bc6e70083459", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888270, "uuid": "32309f7c-4c7a-49f1-8329-06f37e28fbc6", "comment": "Malware payload", "value": "576ab35a66578daec00fc9b505511d4f72fa0fa4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888270, "uuid": "4ab20c97-8358-41d4-8495-7817d4dfdb82", "comment": "Malware payload", "value": "3a0e00ea97e934e9537cacd7b9f137a3d81e671fa79d67666de321ef288ad4d74867362dfa7036fef0fa7f832be122ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888270, "uuid": "d5b7bb74-ceb7-4781-9339-ec2f8ced5e10", "value": "T1A611167E34607580D39CC793F4EBA512F2549B6111E4BF2952CD4A3282FAD047A0AD89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888270, "uuid": "8520f42a-9d0b-49ff-b965-08ad45546d2e", "value": "12:78ZSHelR/IZTHelR/IZIHelR/IZpMHelR/IZXWwHelR/IZeHelR/IZ7wHelR/IZy:e9zuCzu/zupLzukzuBzu7XzuuzuDzI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888270, "uuid": "af25006c-e7c9-4aaa-91e5-78e9f72f81a6", "value": 1010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888270, "uuid": "9b52bd3a-3f0a-4ea2-8fdb-dcfe9da73e21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888270, "uuid": "d8874b28-e523-421b-b396-7dc82a1f9a8f", "value": "router.bytevalue-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4a01fe-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834639, "uuid": "941698a9-0ec2-4218-a193-34a1800a72f0", "comment": "Malware payload (Stealc)", "value": "12f9cd4a248a8344c1a06b91fac171a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834639, "uuid": "5241a499-0e1b-4c9e-9ea8-203e64b9130f", "comment": "Malware payload (Stealc)", "value": "8420c6d99e00d1992fc87b921c512a592a0e70065f0a83b87327b6471537e3e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834639, "uuid": "6cdabbe0-9ab5-4121-8279-7345e0ad4fd7", "comment": "Malware payload (Stealc)", "value": "d9de9f8d3155deadebec8b346dd5c7646c67e17d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834639, "uuid": "ef0aadb2-8b0c-4821-bd67-27740c38ec59", "comment": "Malware payload (Stealc)", "value": "e1de2915ed59d1400b0d6a8b94fa4ee3078125908bd73592a4951cb9dda9d307b952a2d28ee94e115f5697e0d0e81c1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834639, "uuid": "489d5e73-a795-4ca5-bb7e-e290a93a2194", "value": "T1A1058C1AA7A583F8D0ABC274CA428443E7B37D455770974F03E156BAAF372A0593FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834639, "uuid": "5510fd00-727f-4f5d-8725-e6fab491f490", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834639, "uuid": "7e764dc1-e89e-4c32-87ca-8cbcdb194a41", "value": "12288:PGLVpIo/cBJ9InRPehbyv8plnEs+7v3YZtF15kjH1I:PkkBJinRP6bw8TEs+z34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834639, "uuid": "a43ab297-2080-4952-98b9-e6f8a50c05d0", "value": 797952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834639, "uuid": "bf5ba800-835e-4d8b-a7f3-e154e568b8da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834639, "uuid": "a91a8d04-19d3-4ece-9286-b0f989b53743", "value": "mcxlj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5103bd-d0ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764837563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837563, "uuid": "d2c72138-68be-4266-8aad-89a9ac753520", "comment": "Malware payload (Mirai)", "value": "1d8067008e17c042920f0e784377863d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837563, "uuid": "de26614b-653d-49eb-9db4-a9c01cd4f497", "comment": "Malware payload (Mirai)", "value": "844627eb326d5bd358215e45fb315352553aacffcdd9c10c4872d7bff78cd6e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837563, "uuid": "ba0f6ffc-2a03-44fe-9443-f9e313743422", "comment": "Malware payload (Mirai)", "value": "5cfb611e7c21638006573e7f166ad8c5ba6018ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837563, "uuid": "1a220ff4-c123-42b2-b99a-2430953f0992", "comment": "Malware payload (Mirai)", "value": "c7b601483a1bcadee70301a3b50be18e907c37c90a093c56a6f4b887a198896da40947caeab8932f0312c6e3ace4978b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837563, "uuid": "c022803f-cf9e-4ee0-9ae7-0388fc6a92f1", "value": "T1BB330A47A8A1AFF7D045BAB569775E24035BF9126F4F0A9A712CAEA0034F4CDB40F364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837563, "uuid": "2bc7949d-781d-4f0b-9d60-3a866020bc43", "value": "1536:SesLE3UmX5B/N+5Zo+XT5tnCUAuhX/E3Uw:SeH3U25BYo+XT5tnyulskw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764837563, "uuid": "362b275c-3bc4-42f5-903f-bfc3b3f5330a", "value": 53802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764837563, "uuid": "1f84fdb9-72cd-4487-8733-57b488eafd7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837563, "uuid": "fe413bac-b334-494b-8367-c0f8d70c4872", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb6a4ae-d161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764887897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887897, "uuid": "c6b02e61-d112-495c-9a70-d603a6b2e052", "comment": "Malware payload (Mirai)", "value": "6762b3ec17b93422dfb8d7182a083b34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887897, "uuid": "600ef6f7-483a-4ff1-80f0-7fdf41586f73", "comment": "Malware payload (Mirai)", "value": "846ae4259d4b361d9c4687f19f5c0c341c89c75580f6331c38348a750ced728a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887897, "uuid": "ae766edf-370f-45bb-8f18-9c62e81bd76e", "comment": "Malware payload (Mirai)", "value": "712d90530ad71f344199db3a0a9bea696db5cfae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887897, "uuid": "3c3b60e7-5ab4-4478-b443-a96f0fab7213", "comment": "Malware payload (Mirai)", "value": "b060b39b7b0894b0133cc39968445b3f4ab0a5e476ac0f76ed13a402d7b12ca0c9520e480d8f9e872e353453aa34a503", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887897, "uuid": "83b8ccb6-72f3-4f2c-ab25-e8974a2a20cd", "value": "T133937D68B90EBC41D2C7E37DFE158BA1B22B3DD0871681B17C01634DD9FAAD4CA61A17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887897, "uuid": "052253a1-04b0-46c3-9316-191b85bf0d3d", "value": "1536:hey8+uqZWny7uYqAPtzd4XoPPtmf9Jo1liLwKVQFUWoZfozIKauQ1/JIrj:sF+uFatC4PsFJc/cpnZfgIKYcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887897, "uuid": "5cc9562d-04f2-4d8e-a809-509d459f5198", "value": 96176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887897, "uuid": "e7c09cb9-f7e1-4e50-b1f5-57868e49d2a2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887897, "uuid": "ebeb1bb4-3bd8-4e56-b2f9-d3d6409f97ea", "value": "frost.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d429a36-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849457, "uuid": "b43d1988-c0b9-4aa6-b86c-cc3c4dcfc8ee", "comment": "Malware payload (Mirai)", "value": "8aaeba5b9ecacfc5aab4872d25643042", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849457, "uuid": "ec11e4a6-9333-41ca-b7a6-47252b5128d4", "comment": "Malware payload (Mirai)", "value": "84ad52900121b3de89cd72558f18199f6167f853ad4b5d00d4d879133052ee9a", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849457, "uuid": "562ede91-db0f-4ab6-b7cf-7d8b0a0549cd", "comment": "Malware payload (Mirai)", "value": "7f334f15739d54e73c1e318d4e47e56b15ec7eb5", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849457, "uuid": "7393fe29-54aa-44ba-940d-6829725040cb", "comment": "Malware payload (Mirai)", "value": "c451064282209da5bf90c9fa23a6016dfdc2023aeb16a5a998fecd9d78a8a13be3070bba6e3a17db5672bd42b5d2470f", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849457, "uuid": "85a74c15-eb75-46a2-bae7-7e0a3f618c60", "value": "T11343E655B8C25A6BC1E423BBEA6E518D3331A3F8D1DE3217CC111B24B68952F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849457, "uuid": "1dae6741-cd07-45a3-bd9b-55766c61fafb", "value": "1536:jhZAFs6myVyXQPL5zcKQrrFRQ7VlG9Ww3fxH6d42+m:jhZbMrgKQr/Q7rG9r3JHOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849457, "uuid": "8cbfa0c5-0207-4002-8842-a4a25fd54b11", "value": 55564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849457, "uuid": "63d668ca-79c4-4420-8e3d-b44ec9b67224", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849457, "uuid": "203c9de4-bedb-47b8-ad9f-35bbabd8f8df", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf4df2a-d109-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1764850097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850097, "uuid": "0de1da66-0e75-41ca-8b42-d2f8be83ac37", "comment": "Malware payload (SpyNote)", "value": "2d62ecdd2ff76638a0c24f8c9cc13cc7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850097, "uuid": "ddee60ba-5276-4dbb-8372-3e81aa895c7c", "comment": "Malware payload (SpyNote)", "value": "84c5571ee75850514c0b09aa0f77b9ab5ea0b79bc8622371e3223810e67cd406", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850097, "uuid": "b0c67355-b488-46fb-a4ad-91ace261fe41", "comment": "Malware payload (SpyNote)", "value": "ce258924e1bd226aa1518f956d0efe84f74d8791", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850097, "uuid": "266d2cb3-3ed5-4aea-9350-2f290ce32213", "comment": "Malware payload (SpyNote)", "value": "3941845c9d09459bf656ae391d368fbd5e6d7362b7f2a9ace5279367d7cd6f83151903f9c4e69493c40d0830a6acc635", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850097, "uuid": "1309b3e9-9c4d-4b5f-ad13-8285a0d9b323", "value": "T1C506E007EB88DA96D8BA83F16F330D962A470F04C6529ADB406476BD3E7B1D40DD1ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850097, "uuid": "5791d8b1-f7b5-4f73-a7b3-eed75cd9a3db", "value": "98304:XRYzc7wxLwe3fNPDsNuMRjmzhzBlTX0txPkxJ:XN8Fwe3tWXCzRoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850097, "uuid": "b7a02a87-4e6c-49f9-971c-c3f96c62cf0f", "value": 3969369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850097, "uuid": "e287823a-5038-4853-acaf-117db03877b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850097, "uuid": "b2169c97-454a-4d37-b5fd-038f42b6947a", "value": "r.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245127e6-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1764834302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834302, "uuid": "5c99928b-a746-44e8-aef3-686cf4cebe2d", "comment": "Malware payload (Adware.Techsnab)", "value": "5753cd25d9a31066c54cf6e78ea3404a", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834302, "uuid": "9d8680e7-f9a8-4155-a3f3-84a9b1bceb86", "comment": "Malware payload (Adware.Techsnab)", "value": "850974732764152c9b0ac35246373e3624edf9e0d5d1b39f74756a373d0afd33", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834302, "uuid": "558359f9-abfe-4694-9b0e-be8221e62e84", "comment": "Malware payload (Adware.Techsnab)", "value": "a1de56865944d4ce64423840ebb80e55e0b232ea", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834302, "uuid": "cb7d7deb-ada8-46ce-bebd-7bae23acbb09", "comment": "Malware payload (Adware.Techsnab)", "value": "f6488631b892708ab793c81ce9360a7ffe257211d4fac0cb7b8eb280b9b6fd67aa9a8a8a639caba2ece1bb59b1e034d4", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834302, "uuid": "7133e08c-b31f-4c8e-a20a-5c9f5a88bea0", "value": "T11212C81B366D0F6293914969D9EFF10D78575637090A7C88B1ACC348BF1587883EC7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834302, "uuid": "29bf87aa-4b2b-4d51-a1a5-76b34d74ea05", "value": "192:vUCqAE5cty2IiCzrd4hJiJQStknu5douCAf6tBuridEMMJZmunJM7OB/4hx:vUPRA0mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834302, "uuid": "ca599ea0-ad75-4390-89f0-60931ff051c1", "value": 9785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834302, "uuid": "11a09a10-9a66-4c8f-90bb-93ead0676e2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834302, "uuid": "2f20ff81-cc7a-4330-9f43-d1a94a7ab8d9", "value": "850974732764152c9b0ac35246373e3624edf9e0d5d1b39f74756a373d0afd33.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2f1915-d12c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764865051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865051, "uuid": "80544b12-0ee4-46af-bd78-2641c20160ed", "comment": "Malware payload (Mirai)", "value": "bfc555e487b776d20cf4a1353c74c26b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865051, "uuid": "6a58a295-9c4b-4770-b3f5-b93ff81f1569", "comment": "Malware payload (Mirai)", "value": "8580243a271145682ec7a001af0c9a76625858a7264643ff9876a144e3cc01a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865051, "uuid": "764dca02-e2bb-447a-b27d-d74c5fc685d1", "comment": "Malware payload (Mirai)", "value": "b3e2f311285334ef031c683397bed449772669c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865051, "uuid": "2531e77a-c51e-4216-9576-b719a96a0600", "comment": "Malware payload (Mirai)", "value": "727cc68102c0d76330b9a4f4539d93f3e19b5f72104cd997bbf4966539e13c75230a8449b5db91de27b1cf30c9fc0c61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865051, "uuid": "f182124e-2ca4-4d3b-b37b-03f3fcf517c0", "value": "T1D023F15ECD45AC83CDED3E6780DB2B761E3460D1628B5FBA0328BC160639749F48D8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865051, "uuid": "30940c22-e86b-4ff4-a59b-b9f8ecb5764c", "value": "1536:6Vh/XS22iJP6kGQrXnzQ6w1bT3+kUTVvR0QSwZxEJY5X:6Vh/XLx6kGQzzQ7J3+PVvuQ+sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764865051, "uuid": "863870e8-1afd-4d78-977f-9c72df678532", "value": 49612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764865051, "uuid": "32e79185-a57c-470a-96fa-e0f28d469084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865051, "uuid": "012a9306-113a-446b-89f2-958f3d66ef1d", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054bfdf9-d0c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764820935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820935, "uuid": "64ce8053-d51c-4a63-91ca-2e16897543b6", "comment": "Malware payload", "value": "a590ecb6221e90afcb57dcdeca9ae682", "object_relation": "md5", "Tag": [ { "name": "intellexa", "colour": "#452A76", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820935, "uuid": "d54b3f8a-3ba6-4cc2-adc9-c020cad2be88", "comment": "Malware payload", "value": "85d8f504cadb55851a393a13a026f1833ed6db32cb07882415e029e709ae0750", "object_relation": "sha256", "Tag": [ { "name": "intellexa", "colour": "#452A76", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820935, "uuid": "78d54dea-7b90-40b2-93fb-758594adb3b9", "comment": "Malware payload", "value": "ca83880d9c62eaf8cefbda95e5813046561a955d", "object_relation": "sha1", "Tag": [ { "name": "intellexa", "colour": "#452A76", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820935, "uuid": "a61a73d4-32ad-4306-b4b5-f07f4ba19af0", "comment": "Malware payload", "value": "20e83be0522f48a64e02914aa5044c3f0f27a96d36c5fb3914e8f052902535761ad1adaf909b13a19a48d42deb7799c6", "object_relation": "sha3-384", "Tag": [ { "name": "intellexa", "colour": "#452A76", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764820935, "uuid": "d74ab357-dc52-4f50-8aec-1ec05648b7d3", "value": "T19DA48DD16A3E69A5D8CBB17E45420AA4312BFEB41539C2EC3E57911DADCCE80713E722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764820935, "uuid": "69093e82-0c2e-4c90-a672-a3ad26a5c457", "value": "6144:LxAElxGtVNA2rLl1JrWyUFzSPPiCkspT265Ly6KNqeijkzuQ+OrsQ+OrSiX:Lt6HnLqBspTpnKN5uQ+OrsQ+OrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764820935, "uuid": "182d9677-c77c-4b36-a749-59ec751c22d0", "value": 468256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764820935, "uuid": "bb555069-72fb-4ccc-bb16-fa3db3602f33", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764820935, "uuid": "9bc9ede5-c9e7-43f7-8753-76fe4bc08c36", "value": "85d8f504cadb55851a393a13a026f1833ed6db32cb07882415e029e709ae0750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe77c9b-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806719, "uuid": "7e816e45-6e85-4156-8802-8a228134268b", "comment": "Malware payload (Mirai)", "value": "66f46ba97943ff778c83a9f95f7d03c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806719, "uuid": "bdebf0db-4fba-4226-94e1-cc00ca9718d3", "comment": "Malware payload (Mirai)", "value": "85e20d9e6f1aec73f0eb6a35c24796d0d1a08de2f97458b705f5f6011ceb2084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806719, "uuid": "353c6952-264f-4ba4-a786-b6b0eabb8570", "comment": "Malware payload (Mirai)", "value": "ddeac97fa93e91ef1fb2c11ecafdedf977c66995", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806719, "uuid": "17efcdf3-e130-4bd1-95a1-9b6ddda20c40", "comment": "Malware payload (Mirai)", "value": "b0b8d1ee434961f858c1536a2aee31e0d8f2cb86b0fdf7eec79d476f4ce8d20f736394a6d4e420e0804f4acec442a08b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806719, "uuid": "543428b4-4e0a-47e5-a86d-83d3f6e6df08", "value": "T1B0B39DABF2071591C8A346F007CB4FDE6E1722C29F57C4E36C6E253E58750DB1A0AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806719, "uuid": "d29d825a-0447-49f5-888d-5101a223482b", "value": "1536:Rg4uLcytbI96nfY2aye7tcOiyRLqlqOgb3a10S/LWmoo:e4uLcytU96fY2JatcwRLqlqOgbWTqmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806719, "uuid": "6b33789e-f504-4d13-8768-4aaef4017529", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806719, "uuid": "0263aac5-eaa1-4d92-ba4b-9cee624a2cfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806719, "uuid": "f93d4d20-8244-4637-9b98-a5541af69405", "value": "uYtea.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe5110f-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764878935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878935, "uuid": "15042bfd-2e59-4da1-a136-1154880105dc", "comment": "Malware payload", "value": "d1ea5d47a9ee28656d5e742712da733f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878935, "uuid": "615949e4-d915-428c-bf0e-65aab3bb8d47", "comment": "Malware payload", "value": "86f257f7a37ebefcd51e76a9c8eb188e8834a1f6cacf0d7d61ebfa1fad3045bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878935, "uuid": "359460cd-5247-4515-97d6-e632ff814237", "comment": "Malware payload", "value": "39f1db70479418b416e839b3c544156e541e0130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878935, "uuid": "1482d42b-eb7e-4999-95c1-c49d8dfe4a88", "comment": "Malware payload", "value": "7816c5d5c686d622b9488ea168ab6cc70dc6d3936d0864cccc020a8709e851d040609d0e74068bf03bde8310d820a10e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878935, "uuid": "1e9b81b4-f5cf-43fc-a817-e9e525474f1d", "value": "T196649E51B991C033C4B2183005769BA29A7DB8302F2545EFD3F42A7D9E746D0FA36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878935, "uuid": "7c5b4760-d09e-493f-b44a-9af4e7bb82dd", "value": "96d3b47248dfa7c4da231a8ab233a3f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878935, "uuid": "f32c09f7-f0df-45cb-8c6b-28157ad46c30", "value": "6144:R2aw4PuLBlWQ86Bxiatjcs+P21hTl57sAOlNHf47T:64PuLfC6Bjtjcs+P21dlqV/kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764878935, "uuid": "16a330ea-7ccd-4abe-ab32-f0d8f7f8fbc9", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764878935, "uuid": "60d796db-a1cd-43cc-b3c3-6583707888f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878935, "uuid": "37fc4bf2-58e9-4015-87b9-d720ffbba3b1", "value": "MIWIFIRepairTool.x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7de090-d163-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888566, "uuid": "c1bfff98-7c3f-40f2-9a45-90a5bad4adad", "comment": "Malware payload", "value": "c42c787b6437b9c99e0a659d24cb2a46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888566, "uuid": "ca53ae8b-99bb-4809-8192-4bd8a85087e0", "comment": "Malware payload", "value": "8710be63fd7405c14b945dad2f792f098c856f6e6c87cd7d0f516e4a0c0b799f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888566, "uuid": "255709b7-ba2b-4b4d-abaa-e25fa21d4036", "comment": "Malware payload", "value": "4ca12b807eef245ae7b453ee92e59967319e3f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888566, "uuid": "718bf058-f374-43ac-8da4-690304c05739", "comment": "Malware payload", "value": "430864a1bc0e788166c7727da7f76742052a5401aa8750318b3a43a166074c6b73ceceb9f2fc1c6c6566387bafd33e5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888566, "uuid": "93976aa9-09a3-452d-8fcb-9c5f506de83c", "value": "T1C19733E51D429C2AED3BADB083EF9DC1F897FB8E876013D632587051E8A4B8D257D421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888566, "uuid": "d26e27cb-e360-4afd-ba2f-00cb082f8f62", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888566, "uuid": "b6e6dfcb-ce93-4d53-92b4-00617f92b630", "value": "786432:rptZmVDkD1m2annTpgOkhXFpt4lA7ylZmi2n4IZnWQmBgI/v10Du4:rpzKDgkTpgbpN/F4QPGtV94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888566, "uuid": "8c2b8eb6-182c-4169-b529-942e3379df85", "value": 41392864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888566, "uuid": "224e8210-f0ab-424e-a408-789fd0084dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888566, "uuid": "cddd93ce-a38c-49ac-bee0-e8acdc72147f", "value": "Order_01567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ecaaacf-d0df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764831716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831716, "uuid": "afff5aaa-9b95-47c5-8a66-9a4387a76f3c", "comment": "Malware payload", "value": "0fd3ee8460f1a40a84565e6d750f7c21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831716, "uuid": "a65735ee-81b5-4d8e-a16c-919155767240", "comment": "Malware payload", "value": "87177b52590fdbff992e79bbc1790d7e1abc4c907ea8fa2dc478d3e48da763cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831716, "uuid": "75d9bb31-4ef9-4dcd-bbe1-debf7dd6d734", "comment": "Malware payload", "value": "9ed28b7f3dcfa3047787b750cef173e2a0c6383f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831716, "uuid": "86edfcfd-8a82-4364-baf2-7a6765498d16", "comment": "Malware payload", "value": "ae8123c8ccb0152ab9a6d8b030aa3cfcf20c2ebf2dc57dbf216b2769a7624d0e87e3f67ee24426e8ed4e949f310abf77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831716, "uuid": "630ede59-f405-4cca-8e2c-705ea06b70bc", "value": "T118E4AE1077A0C477C9A202311876ABBB9BFAE97956664F0303503F5DBDB36C28A1F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831716, "uuid": "30e77419-cfd8-4011-baae-42cddaa6efca", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831716, "uuid": "df5fd5b6-55cf-479b-84de-b9484befcf82", "value": "768:07ra/Tl+hs3E/jU0dugZ0T2Xtz+lHQW40Zz0D3jHUpi1GounzWlC/LPfw3+Ep:d/T2X/jN2vxZz0DTHUpouzWYguEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831716, "uuid": "9b23a838-7424-4a76-8424-6352899800bf", "value": 684656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831716, "uuid": "703f9700-46a8-4e85-9af6-ad4e26940074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831716, "uuid": "0035e223-51e4-448c-87a6-5d3b9d545cd2", "value": "67xjcgjm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5855aa-d0ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764815980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815980, "uuid": "43c1bed1-be56-43a7-8fb8-4e7c8038f450", "comment": "Malware payload (Joker)", "value": "3150746aed04c5d57c5a53dfa4420011", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815980, "uuid": "dd8fa3ab-34d2-4f76-a7a8-e8b35c2c13a9", "comment": "Malware payload (Joker)", "value": "880b1baa0ab01c51e0857f49a8406bc25cef7c7c6ad5c785287c018bfe60a03b", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815980, "uuid": "90668db4-eabb-4993-80be-e9fa51d0c492", "comment": "Malware payload (Joker)", "value": "d22f2391cf97e2aefd6eabe1d62621eb0fe05a77", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815980, "uuid": "7bb13633-8670-4991-ab76-9f4d0a46d42f", "comment": "Malware payload (Joker)", "value": "da5570c797357f0e89c88486cdf55aa2f10a9089589217701f4ca4cddf9d658f160720ff1da7d3803df6845eb72dff6c", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764815980, "uuid": "b0c21c68-f084-41c7-9555-97708951fbc0", "value": "T116672306EB0D993FDDB3F03A4E5A12323866AC65B60196D76915F25C3AF3AE84F053C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764815980, "uuid": "e93ddcdc-f00e-41b8-b247-d5c30dedc1c2", "value": "786432:iMQWNv1fapr6Dc7hBWBu6fQ1yzZbkMnqyMuld3ONVaLoSD5SK:3QWpFS2cjWBu9yzZblnpldrMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764815980, "uuid": "ef62228e-291c-4d32-b8b7-43df18fde049", "value": 30059816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764815980, "uuid": "999daf36-d639-4b50-996b-ae7056877ae0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764815980, "uuid": "05cb5694-1c8c-428d-9474-99fa848add47", "value": "Quick+Cleaner+Pro_1.0.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94a7f68-d14e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764879703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879703, "uuid": "caa81c85-2769-48b1-bc46-334a034a9c6f", "comment": "Malware payload", "value": "9b6856ea79cf83a4047ac7df264d2677", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879703, "uuid": "15d03a91-8db8-4307-b299-07f5a9079e04", "comment": "Malware payload", "value": "88f826096be1ed1be32dd45dc2381189df7c5f349c7b808edb872e68be4a9350", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879703, "uuid": "d20adf4d-af34-46d3-beb8-1336bf70685c", "comment": "Malware payload", "value": "98d68cfdf1ecce4ffe575915620e338752745c44", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879703, "uuid": "d998b055-54ed-4c6f-b3d4-a3923f77f4fd", "comment": "Malware payload", "value": "472bea180f1a0689fdbb602e14f92b5ff6c0084b0c29d9963f2ec02639aff94f9decaef11189a0bdf9c4ce62aff92591", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879703, "uuid": "4e1aa23e-726a-4b3a-938b-6ed0c9df072a", "value": "T18403F12A45C10D32CE9566128F5A36273673990C4F45BCDBF829C7DD395F35BB189E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879703, "uuid": "8cad030a-75eb-4514-b421-c83f66a530db", "value": "768:NUOd/lQ124HYl3lq5kEOtrVIbLG/KI4KjDPlpAJHCGvxh:NUOo1Sl3lqWEOEbL24K0Z9ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879703, "uuid": "5fcacc22-cf0e-446a-9be0-70d36d15aec1", "value": 39889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879703, "uuid": "29086909-6f18-4b10-ae62-7edfa8bd8504", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879703, "uuid": "9f18ae17-2c95-460f-8219-97e3b54e35cb", "value": "RunasCs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dda5f1-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764878923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878923, "uuid": "0b703025-953f-46a8-8a7a-6709ba73f0d5", "comment": "Malware payload (Formbook)", "value": "371da7e6448e94381f795f2c649d3a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878923, "uuid": "bc82c6dd-8b98-49c3-9261-22c4e3fc9b46", "comment": "Malware payload (Formbook)", "value": "8922a21bb8ccb14d50163697eabcb685eb713f3845b0c666275dbbce0ea7c794", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878923, "uuid": "50137723-8665-4ecf-9e72-dfadc989547b", "comment": "Malware payload (Formbook)", "value": "446898e4835e2304990ec8c4603d15c2cacb744a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878923, "uuid": "d0a0bd35-a477-48df-950e-47268e85887f", "comment": "Malware payload (Formbook)", "value": "c0438cfb4b0097ffc12ea46d3c189a39a9f50780fd8d1839cfb10d605152d5bf61c2aa4b36339843a6a14701933d31e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878923, "uuid": "d44074d4-7318-4c2c-9795-d4e8d7c82696", "value": "T156B4E1C0B541EE86EE750D73483A6A615B622CFE98B4414CF6FEB22D85B6333501F61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878923, "uuid": "0727dbe1-248f-41dc-a8b9-be9c07691749", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878923, "uuid": "b9506fda-913d-4a63-8921-55a13400ddae", "value": "12288:R3s+KYLMNK1NJEA4IKEBeQIYEHE9vimL9Hv3U3l:R36w1NWhIKIeQjl5L9Hv3U3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764878923, "uuid": "90112828-3bce-48e4-93e8-4d5045d55f5a", "value": 520632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764878923, "uuid": "4f1211c5-2617-4ec1-8cb4-8021cd45c459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878923, "uuid": "1b0734a1-f7a3-458f-a42f-c48d9cd5e5e1", "value": "voice note.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44d1c82-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806734, "uuid": "9f5f6a1f-f204-4e44-b864-cedbcfd110ec", "comment": "Malware payload (Mirai)", "value": "1d34926589134112096d3348213e5b31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806734, "uuid": "45c0f1af-c20e-436b-ae72-97b3e2016dc7", "comment": "Malware payload (Mirai)", "value": "89781b7b8e2690596be5185dae0ccf6d50871ea50638a60940af4a433609911a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806734, "uuid": "eb6feef2-bc01-44eb-a39d-d51595a72f50", "comment": "Malware payload (Mirai)", "value": "500448c81be03531b5ef40f6c10dc492d2ec8a15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806734, "uuid": "1f635666-342b-4032-834c-02f22ffdc139", "comment": "Malware payload (Mirai)", "value": "f894097c86ecaf1d21e858a4a9e857624099b34255abdd8310a343cde9e4c500f3d218d570bfb03baa5d3f52ddc8039b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806734, "uuid": "62cb1408-aa92-4281-bc8c-49fe629d6241", "value": "T110435B52721C0E17C4A31A70263F5BE08BFBEAE021E4B685699F5F968935D331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806734, "uuid": "1681192b-beac-4fa9-ac92-955d2af8c999", "value": "1536:eF6QcATQdskHosl9k1dP9JT0bI666hJa108:tqgtJHk1dP/gbI6x4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806734, "uuid": "62503854-97fe-45b7-8c49-239169906566", "value": 59764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806734, "uuid": "f56d5fce-ba14-4530-ae35-a961a209244a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806734, "uuid": "faa3106e-690b-4309-8115-cd95329b6e79", "value": "uYtea.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1eac17e-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834513, "uuid": "3ee91ce3-9e94-4302-976f-3d04a76d8c23", "comment": "Malware payload (Mirai)", "value": "7ae8c69b4e4cb7ed5b0d22014c3992f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834513, "uuid": "3aee1340-d420-43ad-b742-78731d74b207", "comment": "Malware payload (Mirai)", "value": "8aeedf21403f34ed7bcd6aa92e920d74637e87037fc84d2fa0fa5f6d512017b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834513, "uuid": "8d03a3fd-7534-421c-b4ea-c8ef0902a6d1", "comment": "Malware payload (Mirai)", "value": "4663a0e95a4a6937e5c018d179d6371300ac51d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834513, "uuid": "eb9d5733-cbb8-4012-a597-508bbb13b0ea", "comment": "Malware payload (Mirai)", "value": "9410747e1ef179dc612b7dcc42205f48771fba4613636222469caf4383c96e4917fee51be7b922fc2329f6d7d82418ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834513, "uuid": "63df4f46-1d30-4aeb-aa2e-de3ee2dc55e7", "value": "T1B863970E2E35CFADFB69863583F74A205654339522E5C649E26CFE015EB070D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834513, "uuid": "86e4276f-2e11-418e-9650-73850acb0f31", "value": "1536:t0NTVpDuVo/JxlBifnKurBoLiLXabIvl8euI1HmJH:mNT/DIa+KunwIvl8vI1HUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834513, "uuid": "27d338f6-1bcd-45ba-9f2d-de1a2318d7f9", "value": 71580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834513, "uuid": "0f7159c7-3038-405e-87b7-ed51eefbc768", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834513, "uuid": "e77b3af5-87bd-43e4-93a4-66ff71f5e05e", "value": "DEMONS.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed09ab24-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (HeliBot)", "timestamp": 1764829055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829055, "uuid": "d3d734dd-5853-428f-a3d7-62b9ec92911c", "comment": "Malware payload (HeliBot)", "value": "a4b56e39643f3f5b5ebf890f4182323e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829055, "uuid": "1bd7ea8a-1c0e-403d-aba3-e1dfb3d8e633", "comment": "Malware payload (HeliBot)", "value": "8c463c115b145a7825dbb5ba74b1288a8bdf401a7f88765d7ba053ea74bf008c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829055, "uuid": "aeb4ece1-88a6-48c9-8ae6-6d26750c87a8", "comment": "Malware payload (HeliBot)", "value": "8162b0996f71fc31f8532f8b6d228d026e325583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829055, "uuid": "0987578d-2069-44f0-a39e-3f1614c69e94", "comment": "Malware payload (HeliBot)", "value": "9fe2b024822195a5ab0f95add1fc6ddbd1f31fe4ed38b4f931f2514aec4c6a682fe12e399dcddb974e02e54da31baa84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829055, "uuid": "d07b383d-324f-4ec8-8999-6d2a2437a6b9", "value": "T1B0E34B05E7408B57C0D2277AF7DF424A33339B54A3EB33099928ABF43BC27A95E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829055, "uuid": "6abc58ce-93cf-45eb-9297-ff109827c969", "value": "3072:1b2NQvfSUWKL2BaE3P079CaJQM/9ISGJomhwfCHQC2W:92NQv6UxL2BaSg9CaqM/9YJomhwfCwCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829055, "uuid": "f124b300-d29d-4e43-bf7e-d5a95e9227c4", "value": 144778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829055, "uuid": "756d7f27-ca7c-4b29-ac63-412ce05f2ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829055, "uuid": "9fd85a8d-db72-40c5-acfa-cc7ff43c3f10", "value": "bootingworld.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e96f7e-d118-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764856187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856187, "uuid": "cb790219-e978-490e-a4c0-80581018338a", "comment": "Malware payload (Stealc)", "value": "3a1ac061ac19287ce3937708916e2ff1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856187, "uuid": "ac872afd-73c3-41d3-a97f-b765711e5445", "comment": "Malware payload (Stealc)", "value": "8c6e8be26b5152a019fd7284429eca10f07ea5c8f0c160748e1fb5f2be2d5e42", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856187, "uuid": "989e103a-d0bb-4121-943f-ed8fe9fda2a9", "comment": "Malware payload (Stealc)", "value": "494f178a4ee815dee787dfbfb2afb747301d5747", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856187, "uuid": "f85870ce-7e8b-4234-b383-0fe15f160286", "comment": "Malware payload (Stealc)", "value": "a4f0ce610f8bf6a8c2ddbfd637863e0ceea75f6587c3d712a31768d91adf0a419d7130dd792a96de1aadff49c0d047e2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856187, "uuid": "11e1af6c-5b0e-4d39-8814-74a11914a932", "value": "T19416393A5EA529B6D3D78332D038A8A427B237F1754E59BBC098D7650CFA263871DC34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856187, "uuid": "05a400f1-960e-4c04-9396-fc071df0754a", "value": "f894a32abc42993c9901bda32a4ebd3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856187, "uuid": "633274e9-c45d-4988-8e99-beb7da05a73a", "value": "24576:7MbRBBjYai1d9P+tbpnbbXk+AGLxR5znx/ansAWOS3/iwxt4gafYiVGIyK3m2K5Y:QRYnib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856187, "uuid": "f5190143-7727-4702-a8bc-8c055df57ca6", "value": 4085248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856187, "uuid": "090f3a2d-6a12-455d-afec-35169505bed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856187, "uuid": "39ac0e44-1b1d-4087-a3c4-8b66b0172c4f", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0516965-d161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764887902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887902, "uuid": "3e7df54e-9ee3-4956-a39f-4932e291c8fa", "comment": "Malware payload (Mirai)", "value": "5d5383108c4050c4679352eb4b4e1590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887902, "uuid": "342e8ae5-0f95-4b66-815c-e0c66ec9f828", "comment": "Malware payload (Mirai)", "value": "8d681c267e5ca2f16e65d6abc4db69d7b89a9c410ee17641df875115abe63c80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887902, "uuid": "fa9e08b3-83bc-4883-b3e7-af1cbdb91020", "comment": "Malware payload (Mirai)", "value": "e6f9789322a55f721b8e8a21812912e0a3de6703", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887902, "uuid": "4ac49a63-63c1-4ddb-bfc1-243630e0f2d7", "comment": "Malware payload (Mirai)", "value": "be09bcc173ecbbce5d028e42cb838302bafb5754da8becffb31167ee5750fac3a7f621a7002bc41356358b4eebdd523c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887902, "uuid": "183ad1b7-65c3-42cd-af37-fa9898186801", "value": "T1BAD32946BE546AEBC05FCD70052EC30326EC98CA92E5731E717CDA8DBD6D2064AD399C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887902, "uuid": "35e60fd5-7a50-40ac-87de-2b780ecee357", "value": "3072:CT2dNUBJL0x7qIx2zSxTT8jfGXmoIX8+e0YxRk:FrU3L0gIxV8TFoIX8+e5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887902, "uuid": "1b6093a0-dccc-4eef-9595-ff55b1d0119e", "value": 140968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887902, "uuid": "526f821d-cea5-4aca-8945-da0290eaccdd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887902, "uuid": "a38d5eb9-ee91-44bc-875a-754f2cf90389", "value": "frost.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02fe805-d0fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764844012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844012, "uuid": "bd9425b3-49d5-4cbe-8c5f-8ef560f50c96", "comment": "Malware payload (Socks5Systemz)", "value": "aef23b1d7e1e37a0ecd659be9c5962d0", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844012, "uuid": "ecae5732-93ed-4672-a08a-b73f60dc2f56", "comment": "Malware payload (Socks5Systemz)", "value": "8d768d24be4bd6358dfcc5c6df7c140f6b3013b926a44763cb8dcf410aabbbf9", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844012, "uuid": "2cbbcecb-f7a3-44ef-b3f8-21d6c39b3af4", "comment": "Malware payload (Socks5Systemz)", "value": "652591758dbb06950aa5430430c7838e159e359b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844012, "uuid": "e35d93cc-0904-4f96-85f2-a041fc3fbb2f", "comment": "Malware payload (Socks5Systemz)", "value": "806d14b7ac2cc45659cef68723026be364b4f9006e9403bd91b1d42f00e1254f4656548b6dff3514d1fae139cfce80bf", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844012, "uuid": "ede076ff-bb58-4007-a20f-c53b6ce54fac", "value": "T16DF53361FFF10AFEE0695F38C527E2507919F503B6704C82672EA40EAF17796648B3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844012, "uuid": "f92cecba-723a-455b-bc74-49d771f9b7b7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844012, "uuid": "dff39085-e847-4c43-b493-b081d48e1aed", "value": "98304:MeS3g5uIpUFizxzFXMfR2jC6E5K8iWcQfyCov:FvtpUilWZqBE5U2yCov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764844012, "uuid": "c75bb914-d270-4059-be69-0bc515bccd12", "value": 3492673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764844012, "uuid": "f1af14ff-00c4-4c11-9410-ad0291c601e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844012, "uuid": "78a20b84-2def-4922-a0ec-1e7cdf09cc5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2599f9a9-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834304, "uuid": "54c63254-e385-4893-9f8f-64509e641189", "comment": "Malware payload", "value": "6ca3bdf9b26bd40d2e7d5f2d303f2595", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834304, "uuid": "5c05c112-d9b9-40ea-a9eb-4e51fe249843", "comment": "Malware payload", "value": "8e44ea93946bf840bb049f6085537765ffaa75364cb911194447478a4572a639", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834304, "uuid": "5b65a687-2d28-4cfe-817d-678f661dfbd1", "comment": "Malware payload", "value": "d34aa726be3462512ac25c636c77591d8b9b74a3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834304, "uuid": "a49e0328-8702-42a7-84e8-ae2b5ec4b736", "comment": "Malware payload", "value": "4a059bda2c4b57d531f99b746ea0238de1c4ad09335ac765764cd0220e2286b3d3e5e19e7a31402a1de894ffa7160117", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834304, "uuid": "f929fd9f-4f9a-4406-9f36-af29045d3352", "value": "T1D2E63388709C3E13BC9A198264C8FFFA92258754EB2981765A4F9D50C20CF5CFDDE85E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834304, "uuid": "8e6cd8f4-026e-4404-a34d-b815102a6bca", "value": "393216:/b6EFhQxUWYM4buHsl6dLd594GWb/TNBi3:/bzhAQbcslcLz94lTNQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834304, "uuid": "68969312-d79b-4772-9186-6f0e200e0f24", "value": 13878176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834304, "uuid": "5d7330da-2887-4d62-9e32-6b4dbad6defe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834304, "uuid": "94451f94-d722-466f-b041-c5c3ee2fb8ac", "value": "\u795e\u8ff9\u516b\u8352.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4381bed-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764870621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870621, "uuid": "5e1f19c0-0626-49c1-b51a-8b5613448fd9", "comment": "Malware payload (Mirai)", "value": "ada217774a35f4c3624e536ee51a1b0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870621, "uuid": "9c4c62bc-fb10-4a66-b14a-33cb51933248", "comment": "Malware payload (Mirai)", "value": "8e5d78432b6910e0053cb083fa39d0c4a664e55ce2aa46d696193f8429fe6aa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870621, "uuid": "08d47fb3-d4ef-41d3-8c98-fec388e9a934", "comment": "Malware payload (Mirai)", "value": "bb952f92790f2c55aca5778835f6b0800bb1786c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870621, "uuid": "dcb5652a-334f-46d9-a1c1-e094bab53003", "comment": "Malware payload (Mirai)", "value": "fb3dbc49d1cd9c2a56a49dd5e0b07b3187e86dad75025264aca78a2ecf15b15fa024c1e2a641c789182130002548beb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870621, "uuid": "70c0f867-050a-4e32-9065-250eebed2bb3", "value": "T157C36D31B4381A27C4E4647B12F78726B2F617CA11A8CA5F7E720F8EFF115402A57AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870621, "uuid": "5525bc57-d61f-4fca-890b-75eaf660dddd", "value": "1536:t1wCTXeNMLVwRbHwPplP4eVtO3ZAr55Wxc9pHUDzhvF1PyQdWxx4jowUt8xl954H:3TerjS55wht1KQIEqixlPFMs7yy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870621, "uuid": "7446237c-21be-4516-86d5-ba6243b1308f", "value": 121192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870621, "uuid": "79526428-d920-4531-a097-8092d75b424c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870621, "uuid": "bf973e4e-f6d7-4e7e-b4f7-0cbd439cce2d", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee28e7c6-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764829057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829057, "uuid": "441776f4-2f26-4034-9c0c-36485a58d6d6", "comment": "Malware payload (Gafgyt)", "value": "0fb7e941d11dba1d8b9515b1e68ed5da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829057, "uuid": "a8b9dfcb-3da1-4215-a814-0d38c9aa26d6", "comment": "Malware payload (Gafgyt)", "value": "8ed8aeeff36774c0d75a9f7ed67fa145b57f5fd605f368d31848b49004e4b8c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829057, "uuid": "49949ffa-ad86-414f-81ac-4cf396096a6a", "comment": "Malware payload (Gafgyt)", "value": "f982a9c461e466e448c82aa7ca5d7642cfb53ad7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829057, "uuid": "2a690279-9159-4afc-802b-c546d8fe4474", "comment": "Malware payload (Gafgyt)", "value": "c669e80d471066b3fa80cc7f7c308fe20e9d5ff0d3044adffc0e85511458d241c49234bdec45fc4cd2717c0b7231af94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829057, "uuid": "aee656c6-7ee2-4c6b-a1d1-4d91ac33f7f5", "value": "T160632A42AA42CAB3C8930AB506EB9A260631FD2A0F179F55F31DBDF49F134C87617365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829057, "uuid": "5838bd04-45e6-418f-b101-de1f102aa607", "value": "1536:Vk8bOW0mDIdV5LTepgWncXyiolDmF+l2OZ/fufYEZ:FbOW0mDI1LeNcjYmEl2OZXufYEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829057, "uuid": "d1d139a2-1685-4d73-88dc-225ce83ae633", "value": 68892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829057, "uuid": "77affac8-ce68-46b0-a7ce-504ef24cb78a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829057, "uuid": "f0f5d35d-0d34-421e-8682-8d57b68cb12c", "value": "bootingworld.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2e798c-d116-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764855411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855411, "uuid": "1c1163d6-3108-4218-a355-fa36e6394372", "comment": "Malware payload (Vidar)", "value": "745b11bb32e95013f15ad0d6961a73e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855411, "uuid": "487862c2-f44a-45d7-85a6-a67dce848f40", "comment": "Malware payload (Vidar)", "value": "8f447f99e2b0821301d24fe1472c56c7c65204b578e062d3c49b18ee63587081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855411, "uuid": "37027a67-6c5e-4a6e-8815-5f997085b31c", "comment": "Malware payload (Vidar)", "value": "36359cc6a6a96e99ac4c7da2cf2f77709bbaed40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855411, "uuid": "e9389099-408b-4a3a-9f31-b00f497d3a52", "comment": "Malware payload (Vidar)", "value": "e702140428abb32995cd4108192ad6275fae913dfd4407ead5cba0f4092ef1ef910c7b623b4fc1290e8ed6cae9ab3629", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855411, "uuid": "09d1cf7d-2e43-434b-abef-f8ab824fece3", "value": "T19B962A42B981952AC55BF234ADB1626077717C0883322BD76FD71A790CEABC4273EF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855411, "uuid": "e7f1230f-e1f5-4757-bc19-9d42e650e999", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855411, "uuid": "e9c37e4e-7dbf-42d0-afba-7da0b10c940a", "value": "49152:hri7yw3UqxsZZn1x7K1q8xUYz8sekomtDbWDuSSAPOoYFKLw5j8SmjCCzznMVO/0:8z3LcZn1kU8CkbWDuUu0H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764855411, "uuid": "2cdf12b4-5800-4ee0-be62-560d676390e7", "value": 8968560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764855411, "uuid": "f762fc60-3dc5-4efa-86ab-c44108f9eeb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855411, "uuid": "20c83e7d-de51-475e-9f9f-17531bd391f3", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a336a29-d145-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875490, "uuid": "1ad53dc6-effc-40b9-96c0-33f67c8f2d9a", "comment": "Malware payload (BlihanStealer)", "value": "73bfd897a00bc7c07799b4f42a153660", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875490, "uuid": "2d1491f8-659e-49b0-ac89-4655bff78920", "comment": "Malware payload (BlihanStealer)", "value": "8f6924755ca2c4a3dee9b082e0e185e139fe4a427b25ce328496568063924ca3", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875490, "uuid": "578d8c99-ca45-4000-812a-cef6016fd187", "comment": "Malware payload (BlihanStealer)", "value": "7ce3a77aa5f5d681d1a47bf3601968557a2e4fe2", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875490, "uuid": "ad4ef4f6-e165-4f69-b032-260c1edc3cd2", "comment": "Malware payload (BlihanStealer)", "value": "04a6b4844e263595d9da761a35cd1fb4a5ed32ea82ae0c009e1fc331c796c0d988ac2bb9533d6372cb1865c6458fb247", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875490, "uuid": "c962b73e-0c20-4b27-8014-a511e2abab88", "value": "T19DC3F70B6FA1CCDBD851043A57FAA22C86EBBC440DDCE35697DDCC4634D2918C8AEA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875490, "uuid": "7933836f-83ef-42fc-9e3b-1d780ecce0e8", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875490, "uuid": "b47bb61b-46a9-4607-b6d5-005a86669d05", "value": "3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hK0:eene", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875490, "uuid": "23d9ba61-f5b3-4386-9bae-82d9279bd3b8", "value": 126946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875490, "uuid": "466f5a08-2378-4704-b5bd-3b07961ba843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875490, "uuid": "08e2784b-2627-4f59-99bc-6af9d9392463", "value": "3zdh17of.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada6b4a5-d12d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764865456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865456, "uuid": "3a9864c7-660f-47a0-89dc-038a9d457b62", "comment": "Malware payload (Mirai)", "value": "f9ee6d93e8ae3d4c0e2d1edbc1351c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865456, "uuid": "2f42a0eb-aa0f-497d-bb50-ccc353f6dac8", "comment": "Malware payload (Mirai)", "value": "8f828ab7d2c438e64ca72ab9ae1210c92b242c5ac1da3125f681812af4935da4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865456, "uuid": "73087f54-e721-4283-9ee7-ae7319c2ff91", "comment": "Malware payload (Mirai)", "value": "75821a2e5a9f605ad3ae366c5a58efe1dbd3744f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865456, "uuid": "634e5dcf-5728-4672-8b93-eaf2b22f24df", "comment": "Malware payload (Mirai)", "value": "31d02cd70a432b7e8720f97961fd80ed8970030e7fa8075c1e757f4403bf2a637a742559c34ae8c3a5e8b6bb8e3ef49a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865456, "uuid": "94e090f5-640a-4201-bd2e-c29872e84fa7", "value": "T1F463020D65629CFEDA80447ADDA48DC7B90B2BB0C3B799771A50CE91CD9A04B4BF01E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865456, "uuid": "51448745-806d-4569-82ba-8197d2544029", "value": "1536:VTm9EOEIUr4TlFOuBowou68p1L+x58dWKLoKfrHDY:xcFEIU2lsumg68p1DWKLoKjHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764865456, "uuid": "c8e95634-66cb-47a9-babb-d0e8ebedd5ff", "value": 72312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764865456, "uuid": "ab181ac4-f0ca-4600-93b9-70ddf8fa7009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865456, "uuid": "7bb1f11b-02f1-4d07-82e4-56f8471497fc", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006395b7-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834242, "uuid": "4dcb3356-71e9-4ecc-bed4-52d5623ddabb", "comment": "Malware payload", "value": "9793258571bf37f9f90e45391091c209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834242, "uuid": "9b926946-e623-40e3-9081-a75aa97fbcb0", "comment": "Malware payload", "value": "8fb6ee9420452487b43a6107037d5bb1ad6be7f960cfabf24b0dc04879e41fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834242, "uuid": "eec3d9d4-76df-4440-a4d0-21d53435ef20", "comment": "Malware payload", "value": "cb6f8121e2aa029b573d8bec782f960aff935daf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834242, "uuid": "c33b8d4b-1670-49dd-af94-00a7117f0106", "comment": "Malware payload", "value": "598b7181c1d48c38f4cd62093d7bfdc731666b308c4a117bebb913296b29a1cb876c93ac45841557cd9769addd2989ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834242, "uuid": "fcfa0200-b3e5-484b-b4a0-77bad53dc82e", "value": "T1E33633C23980C1C9D589B8F6D21FC2F653A36D49E984532337F4BE2B3275883AD19697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834242, "uuid": "1db11cb5-9f23-4548-96c0-6bde249435ea", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834242, "uuid": "d29b3ccd-3a5c-4d7e-b3de-88b23d33f678", "value": "98304:FOWvwJH1w1nqo4TobJB5/zEFuT3CaT2cbACECWsVUl6V+PAGnvsC:UWYx1YnqRobJB5/zmu+c8qvSpnvsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834242, "uuid": "939cc39b-00a3-4e5c-897a-f4ff12b30eac", "value": 5305072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834242, "uuid": "0309f0e5-8711-4563-8c19-a9ce51435338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834242, "uuid": "7b713482-9d46-495b-967c-796052236853", "value": "fastping_silent_v4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e478b3c-d154-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764882046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882046, "uuid": "deebe069-f93d-495b-be47-091cd578dc79", "comment": "Malware payload", "value": "eac38bfa9a63138e11b201600961d869", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882046, "uuid": "63114d02-1a10-45f8-879d-aaf6cb6aa7cf", "comment": "Malware payload", "value": "903ea2bc595eeb324518a1e31b79bbaee0234192e1b38fefc295e00978e0f74d", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882046, "uuid": "e050ea0a-7902-4c51-b4b1-76bd43fb4fb4", "comment": "Malware payload", "value": "2dfecd4777bf75e9945b1e1e17800d7ce2558284", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882046, "uuid": "45b41790-be46-4b60-a0e8-befc0eacbe79", "comment": "Malware payload", "value": "56b7fa731c01d0b4a04b575ea59ea52df10956c6dab338462ce3c1f080089bdbe12408a59376736fedaa5142ec5342fa", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882046, "uuid": "a3e49929-449f-4e47-9bef-0055bea98850", "value": "T1ACF09E42BA42CA91283352930569C8FCFA28C05B04A0E472BC4055AF5FB17F80BC41DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882046, "uuid": "d5bd2f4d-1eda-4974-9f27-80e965a1fc06", "value": "12:FdzRPhHPMGKyRd1qypKyuL2YyAD/p84nj/Mejn:HzRPh9KCd1qtL2YpD/fzM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764882046, "uuid": "9c65f15c-c05b-4d91-925a-36e69f73cc4f", "value": 510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764882046, "uuid": "874e8158-e84d-414d-802c-de162a1d1a4a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882046, "uuid": "de4648d1-da3e-48a5-a1c5-160f02a1f5a0", "value": "asw.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed128151-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829914, "uuid": "f287257f-58be-400f-900a-11baae0ce042", "comment": "Malware payload (Mirai)", "value": "770fc2fcb82f2719e9452fa7fc4cee47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829914, "uuid": "73c76097-29c5-4f2e-b90e-de3b37b741db", "comment": "Malware payload (Mirai)", "value": "90b7e578af0714b52a06ee50dce6db037bae1aabf28c3876f3d2f42740443bfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829914, "uuid": "1ffa98b1-8279-4cce-95d2-39a41411e3c7", "comment": "Malware payload (Mirai)", "value": "278dba280905234b4c3ed3872a0053c5ca5127b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829914, "uuid": "92401fd9-0d4b-4dde-b831-112ca37a3e94", "comment": "Malware payload (Mirai)", "value": "b724443d337e388f08ef96307b20df2930830f8f1bd28c2c94ea82608e8b743aa278d29f94d414c555fb445639d760da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829914, "uuid": "50102d9b-82d1-4655-80b3-c4db4f869bd0", "value": "T1A8B3AEEBF64715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829914, "uuid": "68e29990-ea90-4adc-a3be-04cba1862fcf", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgDd/LWW:8YSZ3e8ZE3MYlphDgDdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829914, "uuid": "ae4c5755-c6b5-4b97-a513-68e98b90e800", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829914, "uuid": "cc59b3b1-19fe-463e-bd8e-5d192613221d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829914, "uuid": "dc9da90d-9af1-48fb-aebf-ddbb0c6cc879", "value": "ub8ehJSePAfc9FYqZIT6.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb68dea-d109-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764850073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850073, "uuid": "9a2428d8-84e7-47e9-a4ff-eddd2e2d2150", "comment": "Malware payload", "value": "af9412a81035d435c17a8ed15a49d332", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850073, "uuid": "e7e67a85-790a-4ac9-9767-c494ffe5ff0c", "comment": "Malware payload", "value": "90c92805e6e6e22cb32cc6c26bd0e81f446445c63e792072b2b34aec5df0625a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850073, "uuid": "09cc1c4c-c12d-4f71-9732-f3b98776a809", "comment": "Malware payload", "value": "83ec190e5fc1e90523945f78694a975c158c4749", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850073, "uuid": "69b76590-1f33-438c-84c3-cc89f1c2f50f", "comment": "Malware payload", "value": "d046c80fe95749c61a97fdfbddf880541c81f51d8cdac480232bada171e8e256f782d06a5c5c4efc9f15f6246af2ddfd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850073, "uuid": "939f1db2-5de6-4e8f-879c-ab0242c20008", "value": "T1F746F1C7F7D8A92FC877507289BE52B151874C028A839F836D18760C69BB5D42F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850073, "uuid": "3aac705a-779b-4ecf-921e-4cb59cd7e695", "value": "98304:9WPjoTwrYBKOfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltt:okKOfyaIbaciAFvrEZpXqmY9XrF/mpCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850073, "uuid": "26cc9c72-4acd-4f90-b65a-37842c815bfe", "value": 5813839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850073, "uuid": "acf3346f-fdae-4014-beaa-d55bf09d0d9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850073, "uuid": "614ded4e-f681-4483-88d3-0a6aedf9f8a8", "value": "Idagent138.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0473d61d-d0db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829953, "uuid": "93f26534-ff1e-498c-b9a2-42a692844e6d", "comment": "Malware payload (Mirai)", "value": "9db59be90bff445810dc881f0f818a28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829953, "uuid": "c901f250-a69c-4669-9556-ce2a164495a3", "comment": "Malware payload (Mirai)", "value": "9101ae71aa3dfcd8dc0854d9aa99d142c2f2a8b6c65f7860c8172fd9a9258527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829953, "uuid": "dc8223c9-af73-4ebc-8949-ee672a02fd13", "comment": "Malware payload (Mirai)", "value": "4f7ac507febc2198c49c8ca1745f3dff91673d3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829953, "uuid": "4255c7df-6efb-4cb4-bd4b-b9db36e744ba", "comment": "Malware payload (Mirai)", "value": "d94713f17bab6bc269c9eb1ee3e1876482d72c55b6d4edb1c0c8eb3791734bf48b361b1271bbca23597ee4a92363a2fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829953, "uuid": "1688fb4c-4966-49ed-b0c1-63997f9ddd44", "value": "T1FC733A55FD814B23C6C1123BFB6E068D3B2653E9E2EA72039E259F2133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829953, "uuid": "85ebd6b9-2ea1-4223-8d8c-57426ec5afeb", "value": "1536:OZWLxW3i3jV9ZJpcO72Rbu1U+qhxp8f8vNQ:OZWLnJpcO72RDRZNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829953, "uuid": "82bed5da-3a20-4eb1-825b-b6e3e27c39c0", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829953, "uuid": "8526300b-5751-44a0-a886-d2eb37f3fe56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829953, "uuid": "33d66fe8-bffd-4c95-be44-28927b8a11a4", "value": "ub8ehJSePAfc9FYqZIT6.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1859916e-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834282, "uuid": "d2b4abea-dd4e-4a62-91d1-b9b165329c76", "comment": "Malware payload (Mirai)", "value": "770646b175dff5a4cf56d6a4b8daa13b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834282, "uuid": "e8cad0e5-8228-4307-a8a3-53d717affe0b", "comment": "Malware payload (Mirai)", "value": "9104941b8189ab06e03855114de9f5050f158c6b85c3ff5a929fef1ab63a5082", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834282, "uuid": "ebeb4744-24dc-424a-94d8-228037b74d8a", "comment": "Malware payload (Mirai)", "value": "fb1ad3681d96a6d94be8cd604bc0d897da601602", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834282, "uuid": "454e24c3-febc-40ed-887b-57bdeb0e180b", "comment": "Malware payload (Mirai)", "value": "c3370abb7d84daa8970f8afcc16ad3ed484c31592733b48cdf98cb0997b65c109fda1d08850e47c6afd2de8e87869e5d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834282, "uuid": "976f501b-ac43-49e4-9069-1444f7659947", "value": "T1B251C7F81D17122A49459E17F37F04883037CA6BA8B9C9EAEE977C3493899317033E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834282, "uuid": "7fd3611a-2716-4099-92a2-15d9c63c447b", "value": "48:JRXLaXHA9jXoJgoXOrsXmyXs2OXhidXX+rXtwXCWHXEKBqXfFX36XATWHXG:JxLcHA1YgKO6mEsnhiVX+DtiCW3EK6fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834282, "uuid": "2c597a4b-9bad-4088-a6d2-5a42f342eb99", "value": 2447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834282, "uuid": "d1ccf700-6199-4822-b572-53760d1b3dc5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834282, "uuid": "7aa31c79-73e0-42bd-b242-ca207a187ceb", "value": "mass", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6afa27-d119-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764856948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856948, "uuid": "98d3905b-4e2f-42c4-a859-8fcd40200940", "comment": "Malware payload", "value": "3682218cf5c8db471e08fd07a4599ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856948, "uuid": "98421e48-3487-4e05-8327-ad87bddac0b4", "comment": "Malware payload", "value": "910fa2f406872b820130261429a47ad1fe7050d72906de2711335cf0dd43e770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856948, "uuid": "f0ad84be-0585-4758-8f27-934e0eefecab", "comment": "Malware payload", "value": "7d3c0224a396b5ba83c246bffbc2e14fcdd77b16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856948, "uuid": "7271162d-12f7-451a-8120-99d12921dbee", "comment": "Malware payload", "value": "814895a3eba3f27cdde4c6c01544664126038c4b81839729ee93ae34f53dc72bd58b4fbf63cf29883e49683746582672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856948, "uuid": "371ee9c6-b8be-46ab-a53d-38cd34b8ae75", "value": "T197187D13B3A705D5E8F7DA3096E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856948, "uuid": "88dffee5-6a04-4fa7-85f9-21bd3f9e78f9", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856948, "uuid": "5a37c2a0-8284-4f7e-8428-b1e5df301a45", "value": "786432:nZ/kuY2jlPNU4Z6RBNe4uIK4pgPVlcmD:nZ/k6jlPNULeiC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856948, "uuid": "5194f26d-923e-46fb-ae37-a1efb33aa0fa", "value": 90400768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856948, "uuid": "bad057a5-70b3-431f-b99e-7f5e64adb1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856948, "uuid": "c12a2718-498d-412a-92d7-31333ab47c16", "value": "Unicore Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216e15f3-d0e9-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764836015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836015, "uuid": "803dc9e6-1071-4675-a7a9-463bbba76942", "comment": "Malware payload (ConnectWise)", "value": "229c09327f1234cd8d701a46f4db4293", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836015, "uuid": "648c4bed-a749-47d2-a436-84749b85f929", "comment": "Malware payload (ConnectWise)", "value": "9209f767f03794858f7c742fadf337483515dbfc133c44e5f0f0059783fe3b47", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836015, "uuid": "e9c4ed3a-8cd2-4037-8f08-6d65249ab7cf", "comment": "Malware payload (ConnectWise)", "value": "add4cb3dc8215009f7ef6c5775f36828f452fc24", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836015, "uuid": "25f6d2de-4362-42be-a6a4-c2ab27b70d2d", "comment": "Malware payload (ConnectWise)", "value": "16588a79d0d9bec55cbc18305c7e7dec851a56a64a40c2f5c2deadafdeae037c0a94129168ca5fc200c25d42aa242013", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836015, "uuid": "ea0d6a7f-53ed-4748-8769-733fc0426fb3", "value": "T170A6231126E89134F6B31735FE3A56F55A3ABC25DD23C12F1268B91A2A73D808D72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836015, "uuid": "b8502f2b-e4b2-4222-bc0b-5e2838336841", "value": "196608:CsuCcGaDpPmcYMD1suCcGaDpPsuCcGaDposuCcGaDp:1uGjhMDGuGpuGwuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764836015, "uuid": "2500f682-0c63-4ffc-90f3-a9aa98339800", "value": 10059776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764836015, "uuid": "4a45c58d-8c85-4357-8566-70786c30584a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836015, "uuid": "6f4533ef-804b-44f3-8ca3-bb99c6196b1a", "value": "zoom.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193dcfd7-d115-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764854899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764854899, "uuid": "ba8d4ed4-175d-4e8d-894c-7c004c81a913", "comment": "Malware payload", "value": "179d72ddbbfd73f200120071accbe65c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764854899, "uuid": "35121722-712e-45cc-b094-46de83e6db27", "comment": "Malware payload", "value": "928ea57f00fbcbb6c764b584e84a2e837fce6af1332665b5e31522d6c2940850", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764854899, "uuid": "6e3bdc2b-4e91-48f2-b7b1-6bdf1fb80816", "comment": "Malware payload", "value": "d0049468520e6115f360faf4e9dfbe8195adf492", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764854899, "uuid": "3808cfe7-e29c-4887-a8e1-ba269f9f67b9", "comment": "Malware payload", "value": "638dd3afed187a823728f97a6b7072ba79fa1648e046ec151087d47ae7db68825a3f5edc3584ba1ebf3a4870e21a05d6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764854899, "uuid": "afb29270-d024-4751-932d-0769e1273c56", "value": "T11BC2E19A552E8D46E30CE5BA09CD5DC7789C0BE80F8FB72D87B6439715E138B11D6430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764854899, "uuid": "34825f37-0f7f-454a-a5a5-3d3569fb6740", "value": "768:sLN6N/3L2O6NPBzmuGbWO3Od/E2RboXo9nU9JVh:IINi7NPtabWO+d/UXfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764854899, "uuid": "29e4767c-eb8b-45db-90ae-be3954e45bc3", "value": 28044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764854899, "uuid": "cd8e29fa-c041-4499-8e7a-053f528b8894", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764854899, "uuid": "59a75c31-79a3-4699-9f37-3258b6c22c0d", "value": "DonutSmpdupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd655876-d0ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764837565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837565, "uuid": "cab26639-faca-4046-b43e-e684ef4157d0", "comment": "Malware payload (Mirai)", "value": "d7d80395d9b8bbd619511d2b9fd2ab7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837565, "uuid": "669fe405-a3e0-4e87-8cbf-a81e60945b72", "comment": "Malware payload (Mirai)", "value": "92bd0868efc37401a0d3d32515eca7962f800b1349e37b811755f56e6c8a10f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837565, "uuid": "87f04abf-81f9-4b9d-91cc-fd76d63c1256", "comment": "Malware payload (Mirai)", "value": "faf3d5640facd13561830d4d13e122882300370e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837565, "uuid": "7d0b3f35-827e-4d42-b195-78ef15d4b121", "comment": "Malware payload (Mirai)", "value": "a617dc18eed50cd6602b6ce24d8cc8ee7505f9b044725079d45aeb9024701cafb1fcc550f784ce4ddc25063964f78719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837565, "uuid": "576b6a32-2386-4b45-9dc7-c455cb1b446d", "value": "T138E239356A1AF2B8E4C4253CF8431A742F5384687A5EE7D3A14B0935BEA7B4C7C61F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837565, "uuid": "04822714-54ca-4d23-ade1-472ced4297fc", "value": "384:vafHsh69+Tlsa82SxaEbl/wZ5urmjXjzQp2nlxoL58SUGHKMqNGB/j8rBZvvV6hr:UiIuslk5KmLjdnlOX8S8DHskgDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764837565, "uuid": "beebbe02-e6f0-42ff-9638-6dd81c919a98", "value": 33100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764837565, "uuid": "ee72da1c-972e-4f84-bbbf-5f72257b0796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837565, "uuid": "857b6a50-d797-4e74-88ce-63d6ccb500eb", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7369fbf-d0a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807517, "uuid": "ee91ff67-0dbe-4b5b-892d-4a386c4aa40d", "comment": "Malware payload (Mirai)", "value": "c0f8ac39e2cdae0874b4712b35323b8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807517, "uuid": "482eec6f-e34b-4cd0-a2f9-edc37cbdbddf", "comment": "Malware payload (Mirai)", "value": "93abcaa7135e3f3f1bb5ae7567bb9c44eae6309d10d83d29017564aab0cff191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807517, "uuid": "bc22b405-3b74-4a80-ad5d-8193a7a4ed23", "comment": "Malware payload (Mirai)", "value": "7a1fd362e9f2022833b4d2b6832f213ee4d47ec8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807517, "uuid": "8e5cd3b8-4193-4880-b378-7af21fb5b384", "comment": "Malware payload (Mirai)", "value": "dbd98e688082f333ba77c816888744d611cf84ca6668d910f90a72521c0403af7cf42656780089ccfebe03fc18b16dd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807517, "uuid": "40d5cf60-f3d5-44af-89e3-0b538a44db0d", "value": "T1B3130218C2A91896C5327335BE2BBF8A2E09F955C75842F79E8238370450E16566C3FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807517, "uuid": "cdb97625-efd8-453f-9cdc-2e74cfa53168", "value": "768:av2PyKlRp/zxFhI2wNhQSQQ2O7KJr078PcWd2pCnQtHPVRYnbcuyD7UoQRj2Vw:aLKv5wEhdO2Y8/wpqQtvsnouy8oy+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807517, "uuid": "7054400e-f724-4aff-91d6-44c07473ff2b", "value": 45440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807517, "uuid": "dfb9b208-58c0-4082-b374-c1d8a8a24c56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807517, "uuid": "d594d19b-47d5-480b-8d27-859251d29323", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de255f5d-d0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1764833755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833755, "uuid": "cd45407b-e650-4637-91fd-be9e774c05d2", "comment": "Malware payload (MassLogger)", "value": "7f310105ac28caac13a9148d3028a181", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833755, "uuid": "67c2e9c4-24cc-4446-916c-83784f99ac0d", "comment": "Malware payload (MassLogger)", "value": "93e3e5bedfd27d7717659630c47b0ef45e97a4662ec2bee413e6b0d434d7233f", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833755, "uuid": "eed8132b-3285-46b9-847f-03cf3c2163d7", "comment": "Malware payload (MassLogger)", "value": "0d09ba9261fea5b5303c7732ef28bd8db8127daa", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833755, "uuid": "7c487feb-7518-4bcb-8504-5dd17746867e", "comment": "Malware payload (MassLogger)", "value": "d28179f302d14d78c80587bcf8d8a830bc5547f916498b64ed89aa329e50978ac081c926568b4dcf3555f83f227a576e", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833755, "uuid": "2b3c40d4-e09a-48a7-82c0-123a5f0c6155", "value": "T1EC55F45D4421ADD3A054FDF0F541EFA78CDB5394122B47121FE5A8AD6222883FFAB2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833755, "uuid": "ba8ab900-694c-4a13-bc98-f29278b2b4f6", "value": "6144:wuUdfnormTGlQGVCRmIspGy1aOaQbCGwzx1cXC/yCsRJecijkHSPmKeQnxysdcbx:eGlt0dNPCCQV1Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833755, "uuid": "ac29d15a-067e-4600-8c17-d2ac32266385", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833755, "uuid": "2f1ed7dc-d455-45ae-b438-bf4f5b2a78f9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833755, "uuid": "d886c64d-7339-4c86-8db2-1ed00ee45829", "value": "rrckk7895.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c12b020-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829134, "uuid": "07316b0e-52d1-408d-a2f4-dccb88af6174", "comment": "Malware payload (Mirai)", "value": "3c8d9f480793de67bed7cbf47df2fe71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829134, "uuid": "f61451b0-7a7c-40e1-b98e-8a9f82c9b828", "comment": "Malware payload (Mirai)", "value": "9465dec056829e029fe9f4f16d824b55015a9a0eaadd0d31d64053a886d2f349", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829134, "uuid": "c83365b1-3fc3-493f-a21c-3ead76a5d17d", "comment": "Malware payload (Mirai)", "value": "9a2e9642ce5ccd209ed8528493e2d1e17fb5c774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829134, "uuid": "5fc0aac3-5d24-4c6b-a5f5-82434f49ad6f", "comment": "Malware payload (Mirai)", "value": "343431ee92f69e220622f3751118d6266a753bfa1dbcc09b2ee2afa456628ba6516aef08e57bbff3454129c68ecde730", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829134, "uuid": "d6ae16d2-9c76-4204-8f28-11eb99c0f72a", "value": "T1F9A32946F8814A21C5D512BEFA1E318E331357BCE2DE73229E14AF3173865AB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829134, "uuid": "d59a3986-0db7-4a4e-bd46-a93056416a7a", "value": "1536:gAnQiGQoOTk+5KqmLUEqg/qSapwAo1MKb3TOaew4oXBDsRiciWRkOg8S7vJ5DYWa:JGKXg/qwSM3TOae6WRkOgJ7JJL3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829134, "uuid": "94b33005-254c-411e-a8e0-857a617fb76a", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829134, "uuid": "fad40a2d-acbd-4336-832c-d6228dd71522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829134, "uuid": "cd4d295e-52b3-4fa6-94b9-6f57be2b3844", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76635bf-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829905, "uuid": "fa47d23c-42e1-496d-9732-f1c1d1831c5d", "comment": "Malware payload (Mirai)", "value": "d2efb33b1a1737f12e6877dad48e56da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829905, "uuid": "5784a4ff-2926-4646-b398-e34cbc93f302", "comment": "Malware payload (Mirai)", "value": "94749f41f357a3f0d8b62d2bc3251852b0711755468aae0a390bbe42331dd549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829905, "uuid": "e67444af-accc-464f-bf90-7c26724af440", "comment": "Malware payload (Mirai)", "value": "dbfbfbd46a48fb1cea5f8ffe970da8c0bce53970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829905, "uuid": "efbc9c5d-ee13-42c0-ada8-e25185ba3c9d", "comment": "Malware payload (Mirai)", "value": "d55ecc8fb61f1b67d6ff464ce76cbcd4d201f44ee25de00ca68c20be516fd10b985604ead2c88e005d917f424b334612", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829905, "uuid": "adac8bb7-50ae-4b41-81c3-bcb7563b6108", "value": "T171F202B0C2714908E32C42FD89BD5A0D3885985D9D08E0B9DF80BC774A15FA5BEB1BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829905, "uuid": "07c065c0-d53e-44b2-8010-50c3e8525ed7", "value": "768:BW/zEpEYEgHE+Tc70R1cVC9owNnTAz9okfwq6AUug8nbcuyD7UHQRj4:E4B1E+TcAYC9owuif1enouy8Hy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829905, "uuid": "6de82ab6-24a1-49d9-b271-f21dec232014", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829905, "uuid": "ea83189a-577d-4f8c-b8d4-68ebdca2443d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829905, "uuid": "3b7e6fbb-f129-4c61-83e6-f18402e2dccf", "value": "ub8ehJSePAfc9FYqZIT6.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50765e0f-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816767, "uuid": "017de4cb-fe69-4ebf-813b-a636339767b0", "comment": "Malware payload (Mirai)", "value": "fe0838f75bdeec70d08dddb7eec1abd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816767, "uuid": "7da123c4-d672-47c6-83af-e16a461b6076", "comment": "Malware payload (Mirai)", "value": "9494558d0b697d65ca9b7083584f27077701b6b9228c4657304a21ff44324558", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816767, "uuid": "25e9c37e-13ea-4cbb-b641-282306ee1bfa", "comment": "Malware payload (Mirai)", "value": "4284ec2e7693cda34ba07eb24b20b4b3e2a2b50d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816767, "uuid": "239295d4-47fe-4c90-b245-4f45dc6c1934", "comment": "Malware payload (Mirai)", "value": "a4be90203fc1d4801b97ef612fde933b067b6108abe0f007b618633bcd4827cc091f7df45a18a951b16896836f8db908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816767, "uuid": "9c979d7b-85f0-4658-8f75-69c7300032c2", "value": "T1E65309917CC29A6BC6E423BAF5AE518D332063E8D1DB322BCC516B1477C551F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816767, "uuid": "9c290a0b-8874-473a-98dc-5753849fd501", "value": "1536:YdBG3AMkNm3wofDZzNd2TmBzEGILP8nYj2io1+Snu8ubjXEYlUoh+gjrieY:Y+3AMkNm3wobMjMVgUYlNhLj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816767, "uuid": "d09e1422-0765-4772-8be9-8edaf8d4b29f", "value": 63768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816767, "uuid": "ba090bc7-fd70-442a-ad13-6e0edd272fbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816767, "uuid": "1e6d2d1f-152d-480c-a391-504aa0570269", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2b3a76-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849487, "uuid": "06882376-2f15-4c55-8701-08cedd789f9f", "comment": "Malware payload (Mirai)", "value": "d45edda317c81e3146911cb52baf5f6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849487, "uuid": "57c9a94f-6c87-4d32-b5f4-c290a497dd8c", "comment": "Malware payload (Mirai)", "value": "9566bcde6b6f6db97aacc9c66336116829c0a7f830da367e66e8ef00a1587d44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849487, "uuid": "4c9557a4-bef4-44b9-8061-e402beb64cb3", "comment": "Malware payload (Mirai)", "value": "54aea4a1589f1cf0f18c73c7b97e5e1124a75511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849487, "uuid": "dd5566c7-dd7f-4ceb-9e08-e7ae79858a4d", "comment": "Malware payload (Mirai)", "value": "1df170b10d472009cd16093a3b7718427c7abf5ebc9d5810750c813b5a4be9da8d15bf26eb57317840deb35152677bdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849487, "uuid": "ebff4be1-f01b-4c3f-aaf1-d800e67f2c47", "value": "T1D1434C0333280E07D9961EB0353F0AE093BFF95126F5B68A194F9B758639E761182F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849487, "uuid": "ca3e7c83-b6fa-45ea-94b5-1a913ecdfb0b", "value": "1536:q01NDkjhWBPe1ZMaDy0wYrudk/GrZd42+P:qEgoBf3YrucGfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849487, "uuid": "2a56cd15-5313-499b-b17c-7448d38ad7a1", "value": 59960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849487, "uuid": "284a0307-3e16-41dc-b265-a7ced582c459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849487, "uuid": "17952f51-0986-4f9c-8e17-5d75541c1efa", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cddc1d8c-d119-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764856920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856920, "uuid": "4abb658b-bb11-4958-9c02-39670c32e27b", "comment": "Malware payload", "value": "e792e182653974fbb7871835a1434789", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856920, "uuid": "80d806ef-5c93-4d6d-b2af-d6e8693e7121", "comment": "Malware payload", "value": "958e76969d392166cc0bad1818e993b53db95723eb1967eb1ff2b9dff20f1c3f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856920, "uuid": "9f6b5632-5187-4bc8-b03d-49a196aaad71", "comment": "Malware payload", "value": "1da6563d1578fd654bb82f2e56e03a6bcc88ed07", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856920, "uuid": "2cf1d40e-cb68-47dd-bb7a-fa4a2a776b21", "comment": "Malware payload", "value": "a53dae110579b053fef7fb5a9fac2c02299184231cea9a979885db2aa6d6c33b8a062eabd603e4a19edbfc1b47b0b4d2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856920, "uuid": "04e12bbe-af2c-4d28-ae87-493f57c8a060", "value": "T1292733AD72A2FAB59B17B1B4C0714F66EC85F8EC32D7070C364207E469F09B44BE9529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856920, "uuid": "6f8a89da-65a8-45bd-b0cb-4b3c8c866059", "value": "393216:sxqI/dITZFscLRiLUaI3qrL3RTjfNBSE+rMRScE5ru+CIumSTHUz:s//d4ZFscHaI3mdfNB6rMAHru+CySTHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856920, "uuid": "b8064d4e-171a-45dc-9d7d-cfe4c4b938d2", "value": 22047904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856920, "uuid": "22ce4853-c9a1-41e6-a925-7704cb2acd6f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856920, "uuid": "15a1b2a1-bd6d-4d61-a1a4-25306ed3e976", "value": "Unicore 6.2.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea8e004-d0d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Hailbot)", "timestamp": 1764828494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828494, "uuid": "b012d086-be8a-4f83-878f-58bf3b86852a", "comment": "Malware payload (Hailbot)", "value": "5b28c7e19da1fe589ed1be65e4a9d923", "object_relation": "md5", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828494, "uuid": "21d2e57b-d40c-435f-a517-5c54aab55fad", "comment": "Malware payload (Hailbot)", "value": "97cd8fe6659fd021a9649cca3bad2c7512fdd3b0b0907c93f097222980771361", "object_relation": "sha256", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828494, "uuid": "5bfbed4f-43fe-4a42-83ec-d5be46df327f", "comment": "Malware payload (Hailbot)", "value": "8859ff983a2db2f76d62b711ba08c1711ea9c205", "object_relation": "sha1", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828494, "uuid": "3e142510-fa49-4ec4-88d4-980393b76c12", "comment": "Malware payload (Hailbot)", "value": "841ac0fc569deef25ace12213a5d65cc61bd39d9513d29afa1469d2431ce7f4175bf34954058d57d92881d129c8b0572", "object_relation": "sha3-384", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828494, "uuid": "988e56fc-e49b-4c4b-9040-f8be1c235732", "value": "T157D0A7A528A2147BCE48CFBBD37711F7354AB492AC20B1CA3133C316DE6C3E16B0A185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828494, "uuid": "796e96a3-bc46-4719-adc4-d100896c8f17", "value": "6:hx6eGrl49KGKwz8Jnoaf5BI9uN5tKKuNYR6:nP9MJoaBBEuN5tRuNYR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764828494, "uuid": "a1623ca8-f3fc-4b82-a7f5-4448175b349d", "value": 245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764828494, "uuid": "4e198c72-cb74-4d75-aac7-421cf3338def", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828494, "uuid": "8927c7f2-5891-4036-bf7f-abbf145f7e3e", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b79bd8-d0a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764808404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808404, "uuid": "2ae784a8-9d7c-4118-bc00-e2a1fe19ff3c", "comment": "Malware payload (Mirai)", "value": "5791439c68049049c542092ee628d32d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808404, "uuid": "11b9fd24-7645-42bc-8a64-17fd4ebc5276", "comment": "Malware payload (Mirai)", "value": "98a60ee25e2be5f5fe188ac6e87a31883d763c65d064f9e16791fff683e8d1d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808404, "uuid": "015a309e-25a5-45b8-b867-616ce3b367e8", "comment": "Malware payload (Mirai)", "value": "5f7ef6072235bcde8c003ef4af54be5fd3205185", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808404, "uuid": "21ece49f-1809-4fa9-811e-ae322e4111fa", "comment": "Malware payload (Mirai)", "value": "95646b7c4682123e033f8de2bcf1c03766ff839c88048d420143a26d4a70ecb21ac1af5af855a819a268c24c76ddfaea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808404, "uuid": "09acfdfa-0f85-4076-b0be-95be00190e45", "value": "T14CB32A47F992CA12C5C712BAFB6E514D33136BB8E3EE3212CD14AF6033865DB0D6A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808404, "uuid": "cc576809-4b14-4047-8b13-a3b55ee0d2c8", "value": "3072:K12y0nm56V8GKPavV6AygkOCAa8uz3bAP:62nKu8GkaheOCGuz3kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764808404, "uuid": "81cc11df-56d0-4081-9f99-fe5224c52504", "value": 115600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764808404, "uuid": "0d98ce47-3c4c-4d0d-a93d-a79b302dfb99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808404, "uuid": "363853fd-cc8d-46dd-8a55-144c92a04237", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea6737d-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764870692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870692, "uuid": "1e2d94b6-f5b5-41ec-9232-2f400b09a662", "comment": "Malware payload (DonutLoader)", "value": "d478fd105378f5cc7533628a6ac0b296", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870692, "uuid": "5e2701c8-c1f5-46bb-960b-fb2bc33dda18", "comment": "Malware payload (DonutLoader)", "value": "98e4d266baaf84d76b0c152cba4f2c0e36c30a3de818f4efa86012da3601a4e1", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870692, "uuid": "03525b3c-1afd-4676-9c83-d7376b5fe9d8", "comment": "Malware payload (DonutLoader)", "value": "c5baacf3b16e29c9f8cf053e1506ec19cb24a389", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870692, "uuid": "b6a86f86-f3ed-4064-92ee-98718da56cab", "comment": "Malware payload (DonutLoader)", "value": "f4d23a9c35b54448edd171da60e312ddc1d6c961520c3b7b54ce0322d40e1fd7fe97116e831b34162318e64e335339da", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870692, "uuid": "3257687d-2f16-45ad-8b0f-99fa5d5dc6b5", "value": "T184647E15BAAC30B9E977C178CB424906EAF1BC56C36856CF1B904A962F23FD0953E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870692, "uuid": "9066b3e4-e9df-42af-970e-d51b478537fe", "value": "53e19d5243b4f25d48df742c8d94ac9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870692, "uuid": "7b9f53b3-3fa6-40d2-a00f-12e276a75362", "value": "3072:HfRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OloAtiAm:HfRbGY6EDNNAuHe28Pl2ncxlprR2OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870692, "uuid": "3da37141-3afc-407f-a1be-49588fa66c34", "value": 317920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870692, "uuid": "6a228f9b-d3a5-43af-82ae-a5e9fb451a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870692, "uuid": "e450753a-d115-4abb-9471-f3d18bda2c73", "value": "3kr9e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c62eda-d0df-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764831731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831731, "uuid": "030791fd-0354-498e-974d-16c2c9760e1e", "comment": "Malware payload (GuLoader)", "value": "9eb41045e0b75162b8dc6393ceb25124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831731, "uuid": "e77db117-f19f-46e9-914e-d6ecfc7c495c", "comment": "Malware payload (GuLoader)", "value": "997fd3d11c6decadf7a56e384228fda1a8224bd4ed00e1c7767b998cc08e2196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831731, "uuid": "0b299a88-9b01-4668-8860-2c2bb90c8135", "comment": "Malware payload (GuLoader)", "value": "244244b579bc5dfae727498ac5e03e87cbd467f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831731, "uuid": "97bb06c9-8435-4cb3-b992-776afbb72eb9", "comment": "Malware payload (GuLoader)", "value": "23ff1a4aab443151ad8af721ee56988bac392c142155a04dfdc6ff433b79c94f2959cca3a2364e21f99cd1debdef22a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831731, "uuid": "2d5afe32-9e73-4116-9d2d-04111bdf9c23", "value": "T1518423107659C836EE260D301EB41B37EBADFA5DF3A18A4713403B59BD16BC79A0E5C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831731, "uuid": "5458a65b-7d53-4593-b6d9-afcc8ad74684", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831731, "uuid": "d29f91fb-fd47-42d6-a5f4-db3a6eea14a7", "value": "6144:ubE/HUS1Bqe3NU3o3msc9DXSf+LylxSgDiCCS32rCUKCILCwApMDnKIUUmyM:ubYXOo3ms6W+LwkgDmSGrDPgE2GUmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831731, "uuid": "130f246e-847a-4eb0-9dc4-3a3ca05ccaf6", "value": 404216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831731, "uuid": "4ecc6739-818b-4668-aff0-78c4eea77de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831731, "uuid": "dd840955-df5b-4939-ab9b-a8f008c84243", "value": "120325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca23fe36-d0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764839734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839734, "uuid": "a45c86fb-7afe-4271-91b6-ca54a1f9aa73", "comment": "Malware payload (Mirai)", "value": "b416b8858d6e942338f86ccf8f09a0b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839734, "uuid": "a71d2406-0002-4695-aa64-ee1d32ee1eff", "comment": "Malware payload (Mirai)", "value": "9a856e03917060e4fe9aa7ec296f369bf11316458859a730c1a2fcb9577fd9c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839734, "uuid": "f1562181-103f-4230-8089-41bbb04d42b2", "comment": "Malware payload (Mirai)", "value": "e2e9e595992525df86e7b7523d1da3826377e0f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839734, "uuid": "0388516e-0355-4e35-a2f6-bde6b5706aa6", "comment": "Malware payload (Mirai)", "value": "ad1ab10bda5c8d3903795e12b5fb65fda591c88d3ef0768b9dc381a3299931dff0337e608561d16edfd085c182182025", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839734, "uuid": "00744575-85b7-4878-8801-db26b10fdc29", "value": "T137B3E745F880DE52C6D5267AFA5E128C336317B8C3EE71068D209F3437EB95A0E7B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839734, "uuid": "fc4857b9-515b-48c3-b6fd-e66598fa2371", "value": "3072:LINNX2Ip9W+elk3HRC3lNfBUIrQSdJO4:LuNX2Ipzds3lNpUIVdJO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764839734, "uuid": "4ee9cea6-b447-48eb-92fb-5a17da73c754", "value": 107912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764839734, "uuid": "16e9a4e0-09a5-42f4-ac74-6f9fef0fd14f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839734, "uuid": "e7b0c4c1-5599-479e-8404-c750a519d53b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93577d0c-d0e6-11f0-a129-42010a9c0007", "comment": "Malware payload (OctoRAT)", "timestamp": 1764834918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834918, "uuid": "7117607d-b771-423b-9b47-5c0c7b69d4ba", "comment": "Malware payload (OctoRAT)", "value": "07400b1e5626287b554e4905b4660670", "object_relation": "md5", "Tag": [ { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834918, "uuid": "f9614b4a-6d90-4718-9626-dc0f6ee01429", "comment": "Malware payload (OctoRAT)", "value": "9a870ca9b0a47c5b496a6e00eaaa68aec132dd0b778e7a1830dadf1e44660feb", "object_relation": "sha256", "Tag": [ { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834918, "uuid": "d28f9672-24eb-4b7b-95f8-94064709de4f", "comment": "Malware payload (OctoRAT)", "value": "4c38830f2f8fb47b499719c05e9341f9b3d36e0e", "object_relation": "sha1", "Tag": [ { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834918, "uuid": "a3088770-8395-46a1-ab67-efcb11772393", "comment": "Malware payload (OctoRAT)", "value": "cdfa5fee0288333e578ade8f8710c2f597fc90c75c9afcb221fd916408e0dee614027c277c154c8aeeec8974ca2064fa", "object_relation": "sha3-384", "Tag": [ { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834918, "uuid": "e142168f-c3c1-43f9-b04a-7ec6f56364df", "value": "T1479423005D54DFE0BEEC911D2A7F86812A5E4FFD904EC22B42CAFC88129F65A45FF5A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834918, "uuid": "41905e0d-5395-4fe0-9269-c9e2bcffe543", "value": "6144:dwrfeV+hPrsxUxOYjy4Pl1PvImSfnh//KSez1i4I+j8kHlb4xxcG3uUnmu4+ZkC:Srf7Nre4eSlCnh/I1i47nHwpl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834918, "uuid": "a24b82d6-04f2-4c42-b2b9-076cbe3e551a", "value": 431181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834918, "uuid": "0140db3d-9324-462e-94b6-f47e2593d059", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834918, "uuid": "bde6bb08-870a-4707-89f7-0c4b31bde29b", "value": "9a870ca9b0a47c5b496a6e00eaaa68aec132dd0b778e7a1830dadf1e44660feb.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acb63be-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880859, "uuid": "49b277d9-1202-426f-8e06-0652567bdfa0", "comment": "Malware payload (Mirai)", "value": "02020348e30a52fe0e2e6bba962ead89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880859, "uuid": "022dfdfe-36bc-40e4-8721-e845af2408b5", "comment": "Malware payload (Mirai)", "value": "9adbcd67e5b21d89b8eee016d2a0476679b09d5066644441f399e69a059d65c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880859, "uuid": "9229a305-f038-4d6f-a2f1-058513536995", "comment": "Malware payload (Mirai)", "value": "8151e98dc8ba40ae6218fe76af1fa151c1e0a71a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880859, "uuid": "3686b253-90c8-4453-8b1d-e7a9af0868e1", "comment": "Malware payload (Mirai)", "value": "8b431cc0479997c7be52f5d4391609131a6c34cd15fdbcf5b20b98efeef78246d392f6c49e22a88e4688fb74cd9a9ea0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880859, "uuid": "a582de5b-5359-47f1-b267-d29056a3361c", "value": "T144333A4332280A47F5A65EF0BD3F0BF083BEE99125E1B184654F9B564235E73188AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880859, "uuid": "ea50b1f0-c3b6-433f-8f63-64f311bb470f", "value": "768:ffQOM1vLx13THWDKlRE4hs3fU+1z3YDnBm6g94zHdsYVyKlRfWXXfiSQAmOz:mZLx13THMqfpT9mDWkGRuXq31Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880859, "uuid": "e4cf29ff-00ad-4ec3-aa71-972a69528fb7", "value": 53164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880859, "uuid": "d0a892fd-6e6e-452e-ad3b-16fcfb2583de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880859, "uuid": "deffab3d-afea-4f74-9173-5c3bbeb7ed96", "value": "DEMONS.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff109d51-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829085, "uuid": "c1d43d70-e250-4af5-b4c0-db7de453d2c0", "comment": "Malware payload (Mirai)", "value": "ad0e6c6956d5550ee6a5faee929784bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829085, "uuid": "7a1355f6-2547-4ad2-932f-3f23d56948d5", "comment": "Malware payload (Mirai)", "value": "9b32e79f2286613c905ed6ad84bface9c30d00cca770438b56932f9f0fa65102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829085, "uuid": "b05bec34-fdc3-4707-99e1-5a17bb26073b", "comment": "Malware payload (Mirai)", "value": "d2ef71d570df84a29ce8d8091bfb278e90f17814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829085, "uuid": "59d26f2e-d5bb-4b8e-8bb6-041864fbd9fa", "comment": "Malware payload (Mirai)", "value": "f2c923eeec472b97588cb6ae4be5564ef88e75ffbb9684d243b9375c7c3d036c946d3bec15f97e84ad5adffd0d916110", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829085, "uuid": "11e45d8a-a058-4ac0-8c12-eaac2fc4afa8", "value": "T11363027EF74398A870747E7AF8E6FA0924E448B5CE6F7D9686141E203FC3D4151613A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829085, "uuid": "5cdf8777-a869-4480-be48-85913b13d8b7", "value": "1536:vU3Bp2NvAdO9spSBKC5pOJzYQg0LR4SraHLG8gZNN:vUKNodhMBKCgLRLraHLG8wN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829085, "uuid": "29a40fd1-38c5-4120-9162-43c9e6020c0d", "value": 67404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829085, "uuid": "44fb8da1-f88a-4abb-9d96-1b3680813634", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829085, "uuid": "f09a71d5-41e7-40ba-9335-e0d6f9b61a5f", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e46b143-d14a-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764877725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877725, "uuid": "84dac57d-0369-46ce-869a-84152a6d95ba", "comment": "Malware payload (Vidar)", "value": "7cd135cf134b85182ebb35bfcb4fc8d1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877725, "uuid": "69741a4c-9404-461e-9d5d-7d020cd33de3", "comment": "Malware payload (Vidar)", "value": "9b9f39b85d6ed4a781f937c925e2b9943294818c2041ab85331fd175b79480c9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877725, "uuid": "c356a3b3-25c9-4c69-b8fc-f02064ea72bb", "comment": "Malware payload (Vidar)", "value": "ee13e51e5d6de4881ae30911c05299b470b6a333", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877725, "uuid": "21e3f3bf-97c6-482a-99c5-8744f29cdb04", "comment": "Malware payload (Vidar)", "value": "c795e53edbd547c9d12d9bb45c0e8c7c037765a511b37a212dec5a650fdfb97577a85385cdbc585dfa6a4f5522e848ca", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764877725, "uuid": "90f7f786-d56d-4228-8347-8de90dc6cf41", "value": "T19ED53351A3EC9172DEE057B60CF7265B2E333CE15834CBAB06D21E4A5C61A19E57331B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764877725, "uuid": "795f567c-a653-426f-bde1-6aaa24fb094f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764877725, "uuid": "f3f72e6d-1cff-44d3-8f7d-db407258480d", "value": "49152:tS7ZZJgF/0ObxFrow0Mbk78H5GfDWIO4OIDkneCSL/cWJ/9R1oGtlklQd/iB:Y7ZZKRPdhJvUfk4HAeCzw140zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764877725, "uuid": "a1ac7947-d08e-4499-85d4-ce0ff32f9f94", "value": 2830984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764877725, "uuid": "46e3d6cc-f0c3-493c-b35b-78fac31d4214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764877725, "uuid": "abe89f39-01f2-488d-a246-c5836ea23b27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dc2a30-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764872899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872899, "uuid": "f072b2c5-cf3f-479c-be52-7a7682b240c3", "comment": "Malware payload (BlihanStealer)", "value": "d7b6f3f4c06930ee29babb9eac7980ec", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872899, "uuid": "b3227f9c-a09e-4fff-a46a-a158a614df82", "comment": "Malware payload (BlihanStealer)", "value": "9bf1654f43413c69bb04e690461a2e87b4529a974150a0661a392bd9df0f3ab5", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872899, "uuid": "ae1cd22d-1791-4a2a-97af-3228008931e5", "comment": "Malware payload (BlihanStealer)", "value": "6c54140608eb72eb543a62a76ccf3442fbebfc57", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872899, "uuid": "266c158f-8aeb-4ae2-a920-5270559cd8a1", "comment": "Malware payload (BlihanStealer)", "value": "bd5b43b29ca8bbf5f5e0075715d56aefe3cc0b3fd71a8c7e966d8a1b150104ab57e2e31da5d2280e74df95fa139f9132", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872899, "uuid": "392608f8-0c6c-475f-97d5-19001128696a", "value": "T1AE936B1BADD3C9ABC05050370A75977DD6AFBD051EE9A342CBD8CD092226648EA6F343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872899, "uuid": "3a8df340-e399-402f-84d5-aeee4c288bfa", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872899, "uuid": "17759e12-9465-48c5-8d03-161d23f96840", "value": "1536:wAowfUJFgjT284U+w2EwRz2OlUPTHBljxIJ82CDVXhqGaavtV02MSgiuAaD8/KAn:wAowyFgjTiUkEwt2OlUTHBljxIJ82CDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872899, "uuid": "fecf6efb-59b1-4f27-a6d7-7e3b4da5042a", "value": 94100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872899, "uuid": "253435a4-46d9-4bac-8e17-541f759015f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872899, "uuid": "eac7d4de-d63f-4f4b-bfa3-593434e39509", "value": "microsoft_help.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0733cce5-d138-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869901, "uuid": "f76c8767-9214-450b-bcb1-fa8b1dd2b4fb", "comment": "Malware payload (Mirai)", "value": "4718da2a697bff17a6fcf4309599024f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869901, "uuid": "59537f8d-ed4a-4205-a066-58fe7174176f", "comment": "Malware payload (Mirai)", "value": "9c11d342a352995c63f7630470f06955555aa2a283ad221104d0e094fa5e6a30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869901, "uuid": "26bd815e-80b7-4c10-976f-0d632445dc85", "comment": "Malware payload (Mirai)", "value": "d9b6ba9d4bc36998213197db758e980ad3b0089f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869901, "uuid": "87a708cb-fa2d-4a9c-9acf-718e41ae5be1", "comment": "Malware payload (Mirai)", "value": "5b38eb6de20d01bbe31ff9cbbb89d2094e835cace6953aebd52034132fa6505bf4ddf59536d21cd7966a330518d81b07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869901, "uuid": "cb1ca969-0398-400d-9ba7-52e3b1242854", "value": "T1F6530251E5C8CEB4CEDBFEC8B8679FE1A1001E9E228ADE1254C6E7558E01D8F354178C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869901, "uuid": "553d6147-9067-4fb5-9ba9-b8047249bb60", "value": "1536:6czZx2Lhh2AuNKj0V/ALr6p+xlR5f0krnT4u+qgw09Z:6cdg1ZuK4/50V4u+qgwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869901, "uuid": "f487af84-d123-47bd-b697-e15833384e49", "value": 65932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869901, "uuid": "fd8521c1-155c-4c87-9108-561ca0995828", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869901, "uuid": "2d24b435-d3b5-4358-89e3-cf0700f2fce8", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b48327-d132-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764867328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867328, "uuid": "a583e774-383a-463d-a6c7-da94913ec15b", "comment": "Malware payload (Mirai)", "value": "fd626fd913f557b0c5e567380f388d2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867328, "uuid": "80dae2ea-ebf3-456d-86be-f9eacae07043", "comment": "Malware payload (Mirai)", "value": "9c3648b191ae41911dbb654f1a5142c671849d96d72442c62e6c93fd03720319", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867328, "uuid": "c1f6ea99-5add-435e-944e-9f69fe62fa50", "comment": "Malware payload (Mirai)", "value": "ca7ca5844c84717c7ba35126699e523e3c5da3ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867328, "uuid": "8017135e-62eb-4981-9952-bf2b6f138f37", "comment": "Malware payload (Mirai)", "value": "a2be932120aaa299e804be1f6db69cbccc4731a259ad7d79db1ed708f73b08e8668ef42361c2ad7f281f72621a80303e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867328, "uuid": "3f4b53c1-d027-4f59-890d-43386999cbcf", "value": "T1F9B32980F98B81FAC84B883060A6F63FDB31D9E94173CA5DEF999F32DA37941911164D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867328, "uuid": "b8a15fa4-2c40-44c7-8cfa-c53f7ff4eca8", "value": "3072:okfZVtG90PZAMi5TjRgFydm5Y82NofhrwGMmBa1CPji/JY:PvG90PZcBVgMdTXNofhkgu/JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764867328, "uuid": "1f5fbf5b-603f-4d28-a890-ee66f09f3547", "value": 116624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764867328, "uuid": "8350685a-d1d0-42fb-8b32-686a14b41b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867328, "uuid": "ccaf1ae2-7859-4d80-b89c-8c23dc414fbc", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2910b2-d13e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764872726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872726, "uuid": "0591f4e8-ba95-4a7b-8c99-a195735e0e42", "comment": "Malware payload (Mirai)", "value": "83683658f15ea1c8ce6022dfe132ec6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872726, "uuid": "4d649a73-c49d-432b-9a03-f0d01c269c62", "comment": "Malware payload (Mirai)", "value": "9c81dfe0b51c5c2f7e94ecc7cde6d5b46cff36887d928c99a0e408106344bb3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872726, "uuid": "d8211fe9-08f4-4332-9d40-24bd0129d896", "comment": "Malware payload (Mirai)", "value": "84820e469cde56ba0f56dbe2233a7275ed583502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872726, "uuid": "ef4888a7-fbca-4778-9a32-41c7a5ddfcb5", "comment": "Malware payload (Mirai)", "value": "a8b8a8be4cb24c7e39001beb8d04ec8b8b250b9a698a3161a3e9d86ba2405237e4fd4dbd68ce2df725a644ca1d976363", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872726, "uuid": "3e5f6005-41ac-4175-82e7-eeb6fa8a918c", "value": "T1BCB34CC4E653D4F9EC0621342137FB379E76E1BF2329DE83D7A499366C92942C409A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872726, "uuid": "66a0c205-646b-491f-b3ee-0c4365055f3f", "value": "3072:hvCulDl79bmjmpLbNxVn7yrXCjYBriVA:h6ulR7RmCp7wSWiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872726, "uuid": "76687697-dd92-41c0-b394-b1884718a6c8", "value": 108016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872726, "uuid": "6b851ee4-cab3-4352-9c69-8bdeb0bf7cad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872726, "uuid": "cd098f2c-528f-43db-b520-2af094e44fdf", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee231949-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829916, "uuid": "c9797eea-52fb-4e6f-8f27-37f68b921fa1", "comment": "Malware payload (Mirai)", "value": "c5785dd0f36982acdb375ba7ff3d3443", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829916, "uuid": "f08ccfb8-8eb2-43a6-aa41-9f61cf1e7f41", "comment": "Malware payload (Mirai)", "value": "9cfeffedfd2bcf0b7442c17ba887af18b6d850a7b6132ab0239ea79b8e6b10a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829916, "uuid": "bbd82684-28dc-46ae-baa7-10bd0b0fb5ad", "comment": "Malware payload (Mirai)", "value": "09a2a2fa32262fdfc6cc173c87f4eb664b35dee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829916, "uuid": "1bf9798f-032d-471b-8f15-f39574caee2a", "comment": "Malware payload (Mirai)", "value": "fb173c8512fba4e10c7415ced41a1922b416bb3e232b77f5a2fe7ae737227e73214fa55ea194ecddceeb9de8460858f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829916, "uuid": "6932d0f8-10c1-4b93-9209-d4320e47fa2f", "value": "T10B734B21F9391927C0D5A17A21F74B23B5F643CE20A8861F3E710F9DBF615403A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829916, "uuid": "bf583ca0-7870-4a98-84f7-255955c39cdf", "value": "1536:0km4j59k6XTXypv4u4YF7tR7SYm5BHxS1H1tTNfT:7PQbrL7SYOBR2NfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829916, "uuid": "482e8109-4a66-4a47-bc59-39104f101861", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829916, "uuid": "b38ac843-3aed-44ed-aa93-5ad4b668cd1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829916, "uuid": "ba0afecd-385e-4d73-8810-77eb8eaea295", "value": "ub8ehJSePAfc9FYqZIT6.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dd6912-d15a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764884765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764884765, "uuid": "7b4085c4-0272-4c69-a569-4eb6c467deaf", "comment": "Malware payload (CoinMiner)", "value": "98446a000ee144c5136512a6c9e8d0de", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764884765, "uuid": "05531a43-68aa-4fe2-a5ae-b468313855c7", "comment": "Malware payload (CoinMiner)", "value": "9d140474f1c6b998cffc94ec840ca6b9b91f82b390fb64c10e18bfb559958f54", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764884765, "uuid": "463161c8-e80a-432b-bc32-84703226fc52", "comment": "Malware payload (CoinMiner)", "value": "157fa4fb51503ddb46c3bb49fbd11527b8ff5667", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764884765, "uuid": "1c53c6bf-64a1-43f4-a382-dbe397d2ea56", "comment": "Malware payload (CoinMiner)", "value": "86d91e3f9cf26e60525022e559eab68e54737d8565f2d745d7d0c486a23dab403a693732fe9da39a21c3b8c5dacd6717", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764884765, "uuid": "9883eaad-b314-491c-9c54-ee1d924bdc5f", "value": "T167E523E2608595F6ECAB9239F247EA51DAABB83103F051CF03B046307E674D95C7DA78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764884765, "uuid": "630ca605-f16e-498a-8c7c-5d6b4bb87e85", "value": "a04338e07c426b2fefa044b2835c73ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764884765, "uuid": "89f4514c-39a2-4e7f-9025-11efd49fc63c", "value": "49152:R4XpUXRLhMujOsiX4VqOM8PxRyzX7FooaSuz7JWEa/yNAs:R4Ajccq9sRyzZpqXcEa/y2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764884765, "uuid": "9e98359d-5096-40c2-b152-cc9d9f4b6dae", "value": 3200512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764884765, "uuid": "78a3b48c-f72c-4b66-a8d7-bd368cade1e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764884765, "uuid": "7b9ded8a-3694-44cc-ae31-c41ed951b3b5", "value": "SecuriteInfo.com.Win64.MalwareX-gen.94812939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874ce24d-d12f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764866251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866251, "uuid": "74ec89e4-fe3b-492f-90d3-7cf2b945621e", "comment": "Malware payload", "value": "2022bf476ad33dd81a35cdd5fa5c75d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866251, "uuid": "aa65d9a3-bf66-42bd-af64-4143e287e90b", "comment": "Malware payload", "value": "9d3ce11b54843b0914154d0f615168088beb517179857efe600a6543aa63587c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866251, "uuid": "67a46f7a-5127-42cf-8b60-84ab81557898", "comment": "Malware payload", "value": "3e1976cc20a6a3d9c3328fe354a199b0e6273c09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866251, "uuid": "b55488df-3bc8-466f-80e8-08a8db6ea1ea", "comment": "Malware payload", "value": "41494664ccf89ada424bcaa25a3b955097c3a1f984212a6c6094077d5de72fd7fb30b8ab1e4c286c45531ca6e0ad782e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866251, "uuid": "5fc33fbe-7320-4868-af39-c12adb6ce5f7", "value": "T10496335BB2AC03EEF9969238B6718471D2697F170B15C993B2E4DD6E0D232CC16323D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866251, "uuid": "e050e58c-fb3c-407e-83a0-c08fc6602cd2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866251, "uuid": "f663b562-70e5-4067-8486-8bfcba8ca226", "value": "196608:2Cugl7AkVurHmoFP/XRL94GG2NTsj+lOnO0:2Cu5SuCAXH4GZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764866251, "uuid": "d50c6d9a-8cd7-4d34-aa8b-258fa16fcfbc", "value": 8790872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764866251, "uuid": "865338fc-5904-4bf4-8f02-38134dc6d0fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866251, "uuid": "11b47286-4817-42ba-a32b-fcc72e8dd41e", "value": "Order_421345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f82c35-d0d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764827481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827481, "uuid": "b5391019-2938-4a90-aded-88044f1a59a4", "comment": "Malware payload (Mirai)", "value": "0042d60a6289b1c1454f9ffe8997a989", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827481, "uuid": "0b5f4840-5bab-4e51-b5f3-9a94a664a5d4", "comment": "Malware payload (Mirai)", "value": "9ddfb09ea9fb0896997d6a91080ac9bb01b6d7e4501e160aa0c276d72629db46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827481, "uuid": "5b371b5f-4989-4892-903d-abf60ec6b4e0", "comment": "Malware payload (Mirai)", "value": "a83844318e554cb796aa51551d8eb6d0982fac35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827481, "uuid": "edf58c5c-d686-43ca-9cca-a6db6680992e", "comment": "Malware payload (Mirai)", "value": "5039d1f74920c908a2e6d04fd6b31fb4a4080b25a423adcbd4d886711a94f4822c5f022cff00f61f1299e0ebd87457b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827481, "uuid": "40714130-ba46-4dfe-8545-fa3cf20fb360", "value": "T16A23F14292C564A3C1A304317412C4A0F9F772A8D7DEBDDB9212D19D4199AE33AFCBBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827481, "uuid": "48d99bd8-8ef5-4317-b50b-e36cb265a8c6", "value": "1536:VGsShaJNyF8VmC0H9rTZe09tS2TzkFb2Q/+B:VGPQmhdR9tS2TzAWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764827481, "uuid": "fdd17a21-718b-4b97-bfdb-bc0fec09fb58", "value": 49980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764827481, "uuid": "b8b22250-d61f-47d2-88f1-ca382a4ee746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827481, "uuid": "8e772877-c0cc-4665-9e17-32ab95d91c41", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88cb0bbe-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879138, "uuid": "7435702d-65aa-4e7b-9184-8f09aa52aabb", "comment": "Malware payload (Mirai)", "value": "46611f84bedb93e1c96a3dba46774432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879138, "uuid": "39f99636-6fe6-4fd8-8c7f-ec98565ca64c", "comment": "Malware payload (Mirai)", "value": "9e4230fa65a94a31f677248c72d350bc5d280fe8702b98542455cef385d8cbdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879138, "uuid": "fc031ee9-027a-4804-b0fb-d4a68891f6ae", "comment": "Malware payload (Mirai)", "value": "f2188872902d8add70a7fab14f2da9ad36c9d129", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879138, "uuid": "74094abf-30e8-4b20-9989-4730c57c5617", "comment": "Malware payload (Mirai)", "value": "40730ce7a7845cfdfec739dcd5d84d35583a60716918607f001f149838321f5cb35aa492a392aad707e8a045b7e57c2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879138, "uuid": "08f75387-ef12-46d3-bec1-ed506c937792", "value": "T105436A0233280A47E1621FF4293F27E083EEE99121F4F589660FDA468275F77158AFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879138, "uuid": "df036b86-a033-4348-a313-9009ae8c13b9", "value": "768:UapBtbSHgJiWrrrP2mjNYBaRT5EM0rVbuk+tvqbMyqCGEgT03f/3owYtZAIsYsRB:U/AgWljNYQqr5uD3yqTJT03fCDs/xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879138, "uuid": "68643488-69c7-4eeb-bf42-267eea82aa81", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879138, "uuid": "7a2ffa86-90f2-47fd-a5bc-2249d03ba843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879138, "uuid": "53683aa7-9a3e-41f3-82e9-c27413290887", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee576dda-d161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764887898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887898, "uuid": "9c026440-b888-4816-a37e-5ff7877d5f32", "comment": "Malware payload (Mirai)", "value": "3746d9646c104bd6591f850444d65996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887898, "uuid": "f1bddd45-d19d-4d68-bacd-27b184adfa44", "comment": "Malware payload (Mirai)", "value": "9e4c07975a08955f2cb3cc4fbbea70b52f7052098311d50bb946ffd257921a85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887898, "uuid": "0da41735-9bd4-4488-83c6-080af554444d", "comment": "Malware payload (Mirai)", "value": "d0725253dc39a57049ea48e2a8c9316b7ee5159e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887898, "uuid": "d3d0d773-c718-4587-8660-48b24b083047", "comment": "Malware payload (Mirai)", "value": "3483a18ccb43ede02e13563940850c9127162b0802ec540a07e9cfa2dba3047a906c02e477e66fd881f772a7c45ee6fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887898, "uuid": "0bd2a547-9fca-412b-b96f-69cd53d03d73", "value": "T159830755F481DA62C6D826B6FA5D538C33131BB4C2DA7105CE10AB362AFF9570F7AC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887898, "uuid": "9f0cadd4-3ad7-4bd0-bc3c-630ec6e7e8b3", "value": "1536:nRAN6wKmhBVniZDgBGHi0XO+D9TQ1lsd6MIVM1oi6zNWPmXQrs:nWN6w3piZEBD+D9TQDzDZWcos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887898, "uuid": "ea7b3326-91b8-46fc-b58c-f8a50ba66447", "value": 87472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887898, "uuid": "fb88bc9c-5856-48b6-ac8b-7b8972e3f707", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887898, "uuid": "635ff150-644f-4628-a281-1f0cd71a2cd5", "value": "frost.armv7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e5394d-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834169, "uuid": "b343d587-e549-4a38-b5cb-5453fd7e2e53", "comment": "Malware payload (Mirai)", "value": "78e950ab7096d73fe7c8ef3cda28bc24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834169, "uuid": "5759e386-c959-44da-82b2-bc1bc66a09a0", "comment": "Malware payload (Mirai)", "value": "9ef27ba77690d2a36b187ac021f73b2ff7a3f3150d0372587823b1d675349690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834169, "uuid": "b705f76d-13fc-4595-a1d9-2a824e159889", "comment": "Malware payload (Mirai)", "value": "67174125e6f975ad7bba913bb6cc58d3bba13f86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834169, "uuid": "cfc8c5c4-6a4e-4f30-888b-da786e0fd9f8", "comment": "Malware payload (Mirai)", "value": "4dd45f9aed463110de7dda2b3f573ba52574b50020ddd6621f881497d460158ea356c4da0955578ee0bb01266affb5ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834169, "uuid": "f42f516f-be7f-4187-90de-222001a2e289", "value": "T1862339C19643DDF5EC1191752033EB369A36F1BA2029FAC7E39D9A32D512B02B94738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834169, "uuid": "475c4a84-749b-4484-b0ae-083d04de0c46", "value": "1536:R4siMVoqpRt1+fj4btHK9oYYZ5IwgJb4aa:9VoyX1+fj4bBv/ixbja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834169, "uuid": "4fe20023-fabb-4c5c-b0c8-d3a1a89127b8", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834169, "uuid": "407906e7-1c44-4257-98f3-92a80eed3771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834169, "uuid": "f283bbb9-f7e8-411a-9e27-3fde10bcfa1d", "value": "DEMONS.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6d898f-d0bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764818317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818317, "uuid": "f9e2a568-7905-4704-b042-e864daa5e097", "comment": "Malware payload (Vidar)", "value": "a7ce1d1490ae264d6b00c7124662140a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818317, "uuid": "ad3d484c-caa4-4e03-80e3-f7be9f946175", "comment": "Malware payload (Vidar)", "value": "9f6fbbca2eceba50607e2e5415b8713f540ada9b2a5ca2359dd19b79fd543abb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818317, "uuid": "2a9db3bb-1f27-425a-9f01-7a1363e98d92", "comment": "Malware payload (Vidar)", "value": "0032997478556ac7ad90f509d0f801788b1108aa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818317, "uuid": "0509ca74-6eb1-40f8-aaf5-3e0f1f9e03e3", "comment": "Malware payload (Vidar)", "value": "825f69880a7187c2e9378d48ae1a3f609d38e6b7396f2c7995d4a3907d5f511b8cf7e0a1d1b86f581d4f29c25e5bcb61", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764818317, "uuid": "75cbf68a-1416-4199-81b7-c89ab5fba620", "value": "T14E861A42B9C249A9DAAAF134A5607251B7717C1D43313FE76FE81A650C3A7C42B3EB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764818317, "uuid": "1efbb77d-7c6f-4750-a99c-192981542c5d", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764818317, "uuid": "303b57c0-4f6a-41af-8e12-80dc7c69acf2", "value": "49152:NvU182X3kowhg9ERoS8DSqe0gW58+E4Pm/99E2U6f2wCFoZ7hD7K1Cq:L2X3kqfK0gW58+E4y99M6+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764818317, "uuid": "0c381b4a-01da-4ce3-a061-9e68d1a4ed0b", "value": 8088192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764818317, "uuid": "03161d80-fa4f-4879-84be-41ca11280a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764818317, "uuid": "bff9f2b4-d13e-40d4-962e-3e04318628aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a630f9db-d141-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764874033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874033, "uuid": "805e539a-09d9-49ec-82aa-02b00a56bc91", "comment": "Malware payload (Mirai)", "value": "731814e077687662cf48913838676357", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874033, "uuid": "8667e475-beec-466c-b8b6-7d06e6e226af", "comment": "Malware payload (Mirai)", "value": "9f8bf4e70302330c30ad5b0883bb2ae589fd2e15cee9e5dc4610d84ad5f501a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874033, "uuid": "44c36516-0bfd-448a-b17c-83e8a6591511", "comment": "Malware payload (Mirai)", "value": "90c355a677a66b79e7cbe54e2fa3e2963ba5137c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874033, "uuid": "f5adc271-4428-4549-ae01-c6e257f3363f", "comment": "Malware payload (Mirai)", "value": "15b1d816d65963fa6f981029e2cd0f001aa3f95ff2229aaa99882a1d5fff0a64ac0213062b3d51d86dbaf85d66a180e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874033, "uuid": "1c8cd459-c335-49cf-80cd-6d3c0252e834", "value": "T1A0D32A06B30C0A47D2632EB03A3F67D093EFDAC121E4F641356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874033, "uuid": "1cdb4458-bf93-4c50-b8a3-ed63bed3b097", "value": "1536:cP0nwryWv+n/qZIYcST98z+xpnvTnNIkH5Afg57PMfgvAtI20jDWB/qHs0kBB/zU:ccWv+mcG8z+x57np0gVPM9t9BBben", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764874033, "uuid": "83add637-7d1a-4623-abdf-27c4cf72568b", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764874033, "uuid": "5e932e64-1b6c-44eb-9905-4cc80afe584b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874033, "uuid": "3b3e5265-c2a8-4967-b08a-54ba66f0a1ba", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc0cd72-d117-11f0-a129-42010a9c0007", "comment": "Malware payload (LinaStealer)", "timestamp": 1764855816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855816, "uuid": "d9c37844-ddae-427a-8734-86faa42592dc", "comment": "Malware payload (LinaStealer)", "value": "b03c54333efa373775fdc5ad8c69f886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Linastealer", "colour": "#4F1651", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855816, "uuid": "8b614d25-0978-4e48-9d2b-9c4b2a8bb26b", "comment": "Malware payload (LinaStealer)", "value": "9fdf4415759c6535a3e7464458954143a7e0bfee97eadcfcf3d635a90caa202f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Linastealer", "colour": "#4F1651", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855816, "uuid": "754f61d9-2633-4c47-b54c-83e3b6c3eae3", "comment": "Malware payload (LinaStealer)", "value": "bc49e95a152aebb6c1ef908712cd3f2824533510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Linastealer", "colour": "#4F1651", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764855816, "uuid": "86138b7a-39cb-4f3c-90b4-f35aef5279ff", "comment": "Malware payload (LinaStealer)", "value": "ace78a42b209d9ea85ace7f6b10754e2f32f08c0a7f16a2c42bb7531bcfa2347934783bba2d054bc678eb5df92c76c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Linastealer", "colour": "#4F1651", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855816, "uuid": "808092a8-012c-43ee-a360-56d6923dd200", "value": "T14128332590368407E2A439F8AD72C27113F11FAB948065ED61E6BFF3F26D10867F87A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855816, "uuid": "67ac3b9e-701e-4c22-89c3-35f1d683b5e7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855816, "uuid": "69c6f875-4a32-4f30-b9a5-ae6ed90e521d", "value": "1572864:TYoAO73e+mm8f43pJWKcujMoN37jxUDOsWWyP07vYqu4R92PupWHCQ8:Top+rK47/cGt9oWWyP0jSP+q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764855816, "uuid": "824882ac-0b33-47b6-b3ea-ccc8da5a91a3", "value": 95058558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764855816, "uuid": "10f969d7-fd09-4422-b349-a6d5e7627d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764855816, "uuid": "b66d73fa-032c-4330-a2e0-0d8011dfe2ad", "value": "Error404 Setup 1.0.0 (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841889b6-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764831027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831027, "uuid": "d977cc0c-b749-4c19-90aa-527df3937151", "comment": "Malware payload (Gafgyt)", "value": "1add4f2a9ba22e44b845a2e4e6d27da0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831027, "uuid": "7c2df484-ffd1-47f4-aaec-e36ae7f91b6f", "comment": "Malware payload (Gafgyt)", "value": "a00db9f639ca5beb42be7f2e4b8ba48996d823c187492b8661408c0796c798cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831027, "uuid": "8fe79b59-bda4-48a0-afbd-3633a96b2796", "comment": "Malware payload (Gafgyt)", "value": "6957b350bf9595e9bb3b1b7b9edf4692f941f662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831027, "uuid": "3c49e28f-467a-4dcf-be5a-e0f44ca36b62", "comment": "Malware payload (Gafgyt)", "value": "a6d9c82657491cd55c820e42e6364e0e5587162f60f51ab7ad3714714488a75868f9f754e13e9e398804ad2560574ccc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831027, "uuid": "5333bd6f-b109-4f82-8d13-fc7595f6c8f9", "value": "T135A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831027, "uuid": "4dbdf7b2-bf98-4554-bec0-e213bd566c66", "value": "3072:VSx+i6mqaObhNqnPNKV+qKmZuqQ4DPwXXtse:y6mRObnqnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831027, "uuid": "08f245ba-fe67-4df8-b1b4-be10255806fe", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831027, "uuid": "3b77b664-e22e-4a75-ab85-c90c9bbbf2b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831027, "uuid": "003f8737-5a05-41b0-b397-6c929e90872c", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79069ed7-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1764806527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806527, "uuid": "1eed2f61-2c76-4ef1-888e-dfc20a3bf464", "comment": "Malware payload (GoProxy)", "value": "97a13dbf605b7a363473ac6648567888", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806527, "uuid": "f491bb5f-d98b-4447-8546-f862148d82bc", "comment": "Malware payload (GoProxy)", "value": "a0833c96c647a67c9ea6cb2545e3c157f2ef6a062d2e9e8e05871845dbd40c1a", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806527, "uuid": "d01af0e5-257b-44a6-91f4-a19fe7b6831d", "comment": "Malware payload (GoProxy)", "value": "fb285840950e2be85e0f6fd12f8b7019b4bd3bab", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806527, "uuid": "08b91ff2-7faa-49aa-9cf8-6543c1b7b051", "comment": "Malware payload (GoProxy)", "value": "9e8a965163f1cabc084bd2bdc35214c060e4b10129e2bed137de989fd8b93522b6c2d23319e948507f5b1efa03ccb4ce", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806527, "uuid": "9deca635-d11c-4000-851f-d560365774a4", "value": "T174665A03EC9515EAC1AEE63186629253BA717C485B3123D73F90F3382F76BD0AAB5714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806527, "uuid": "91659227-786e-464f-83bd-5b5ce77f5072", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806527, "uuid": "7731e98d-fc75-4673-8dac-1da17641ebdc", "value": "49152:7vQFhq3Y5HbFyIaMkZgocNAmll4X99R6ecmioeEvkj+Ra5wKeK9Kpvw5H5E:7u0Ao2llsjcL+YE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806527, "uuid": "637970f7-cba3-4b52-b682-8156950ad4d7", "value": 6519296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806527, "uuid": "6abec352-0ac4-4931-b8f9-846f733b8e95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806527, "uuid": "4e780eda-8e50-471f-8ade-f2cec5b3ae09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb605b8-d0df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764831684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831684, "uuid": "c2b51342-2bad-4e8d-add4-cd59f576a0c8", "comment": "Malware payload (Mirai)", "value": "491ce05f87d4737932a8b0b553d41e94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831684, "uuid": "e51cfe01-9d94-44a3-8c58-2a15661cca03", "comment": "Malware payload (Mirai)", "value": "a0f0495ab470e4ee7e8f3dff17fe1eb0e42936fd968d2ea8a0fa279563594da7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831684, "uuid": "f29db5f9-d78a-4d1b-b538-d5482cff664c", "comment": "Malware payload (Mirai)", "value": "1e2357e438b15bcd4fc12b7f97b5fb5dbbf262d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831684, "uuid": "81f89c91-0bb6-46de-869b-2076be031b58", "comment": "Malware payload (Mirai)", "value": "ea11118a5bb8d5d372d494a612a19e0ad92b2c6b9fa4c5ea6365a75d42e19ac276ae7ce22b11a2f81fc8c9aaef7974cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831684, "uuid": "41ae5e05-04d2-4f71-b0e4-bcd118a0bf6b", "value": "T10783AE23C82968D8C19845B5F5A5BE7A1363A90056472FFB16E6CBA6D047EDCF80D3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831684, "uuid": "357eabc5-42f2-4229-b3d0-5a57a6b1cba9", "value": "1536:7/JolMo9KLkmp+b5Kv50k7h9XEVCobsheYcuug:7RolDCkmp+bAvj7XEVytTug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831684, "uuid": "e1c302bc-a748-4a93-8f7f-b08fccc4f1bb", "value": 84784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831684, "uuid": "e72ec79d-083d-4a53-8fb4-15194fdb9277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831684, "uuid": "0226aa0a-cb57-4212-a957-99f7bda6f9c5", "value": "zerobotv9.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd7c322-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879143, "uuid": "9bc80e9e-ffb3-401e-8c74-477299e1a0fd", "comment": "Malware payload (Mirai)", "value": "535a03b59e6d1013fee056c1e7f6df1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879143, "uuid": "2fdd174b-7bbe-4f58-a31c-9f30e7425616", "comment": "Malware payload (Mirai)", "value": "a0f2ee9abfd87d9e13ff892fbe11c0925503e7c8d4422b5e1e8c133184032c03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879143, "uuid": "3341ea9b-fdcc-4578-bc21-6a3b66899e88", "comment": "Malware payload (Mirai)", "value": "0d8ccc42165a47d26b850ed5843a1c028f03a48e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879143, "uuid": "e3157a35-4c3a-44f4-b99e-07e14c0a0a4e", "comment": "Malware payload (Mirai)", "value": "74eb45b28d53eabdc88aab2fde41bd571d6ae7735c3d7dbca9d2c3ca759a495abc72665210a53f9f615343ef45c6da3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879143, "uuid": "c7594879-2275-44c8-9aea-cc3b5a2ec8cf", "value": "T146533921A8792E17C0D5F57B52F78328B2F61B4E25A8C72E7C710E8EFF2455065472B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879143, "uuid": "efe513b7-720f-4b34-9b3f-3b17d27faeea", "value": "768:0lov7IJXkMiq94PAzX1m/KDkR8QsapO62kqIDapC6KeDmO+hkDHFYV:0lKC0MiS4PAz1ukkR8ap32kq1khb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879143, "uuid": "5d07f050-1311-47c6-9a04-7049a679625f", "value": 62508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879143, "uuid": "9d8adf22-03d9-42fa-a99c-800126d084d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879143, "uuid": "8328c3d4-1159-4e79-80d4-ede47ac79da0", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a186d616-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883045, "uuid": "93eba2cd-1872-4029-bb7f-fd53a0865dec", "comment": "Malware payload (Mirai)", "value": "beef3e20ae64a81860bd2743054efc95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883045, "uuid": "77baa52a-1568-4d49-8942-c08cec0eac3e", "comment": "Malware payload (Mirai)", "value": "a0f9e0eaec631ab34efde17517e6732dcaa878bf415db23ebe99c26897d7c324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883045, "uuid": "861041c6-a32e-4b31-893e-e02631b11702", "comment": "Malware payload (Mirai)", "value": "fa394d2aee0b6059af68ad5f37baec3892b37480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883045, "uuid": "d40b4490-1d90-44e4-9e09-c714ebee15cc", "comment": "Malware payload (Mirai)", "value": "f34e244168dfeffaf9b30e102678661cfb45d82668fe4b3beb269c858f1e8847566e7ba1f7ebac4b336bea000086ba14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883045, "uuid": "0cb8440d-901e-4457-a157-527e5908769d", "value": "T197930215E5B3746D852EA53F51E927E6C45075E8686CC73E6B03C84FB38298FE9E3020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883045, "uuid": "503bd42a-27c0-4bed-a2be-63141932c4b6", "value": "1536:9VH256BqTIU8XGbay6tvN1UD9uWfoQOjDwrVNj8+wyLZxS1g6SeAxrJ:fo6BfsaHtXU5uWQJvc8BIL6SesJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883045, "uuid": "0fda5a14-c713-446d-87a1-8fc690a6c5f0", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883045, "uuid": "31b65816-999b-45fe-aba0-2408beb6cf0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883045, "uuid": "127e581e-96ed-4ab9-a75c-809f6603861e", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3379d80a-d0a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764807699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807699, "uuid": "66fbca8e-fb39-46e3-b3ae-1d98a0961d3e", "comment": "Malware payload", "value": "2a7d9e076c1760833e1af817a8052cf7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807699, "uuid": "a814163f-5576-48db-8c20-790a713f840f", "comment": "Malware payload", "value": "a1bf167dae2f46de07fe5f969368e8cd3c7a6a83a72ec7b54b27d252e9aaec37", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807699, "uuid": "0ed9af3a-4d0c-4afa-b829-783307cfec52", "comment": "Malware payload", "value": "0c2864835fd8a5d9155ed475edbf59d8fe7b64c9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807699, "uuid": "1432cdf8-60d3-41c6-b73a-a37fd10ef1ed", "comment": "Malware payload", "value": "5490a63d1399a0a02a17cdeac2a2c687d7cc41e2fea96fc57b2d7d200daafa21df21ab9819ea1ecd59733605600d8bb5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807699, "uuid": "44274472-9d6a-46f7-b404-48695501345e", "value": "T103E42940B689DEA9E9160230886AD2F31915BCB9D751214F39D8BF3FFA73748101DE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807699, "uuid": "6a899e9a-a5e6-4786-9e80-e34532674658", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807699, "uuid": "141c906c-8894-4e66-a15f-4b60f6ae4e04", "value": "6144:YahOhKe5v0bURyWKV0VC3QZd05Pp9HfZu5PIImWyJyw:YijNbURpKVuC3SdgpRBuuW4yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807699, "uuid": "e20eed30-825d-4de9-8d1b-5aacb6513de9", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807699, "uuid": "0c4ea405-a231-4a9a-b0fe-2a0846602956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807699, "uuid": "26c7ca96-b2b1-4e9c-b330-d9c2a7bf55d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f69f2b-d0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764833652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833652, "uuid": "65d2e4ee-99ab-4a14-ab8e-9e4d4b8b2a21", "comment": "Malware payload (AgentTesla)", "value": "7828ffd06f1c5dbd3391a70098566b46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833652, "uuid": "80e81a14-0545-4317-92c6-9dd10d5b58b9", "comment": "Malware payload (AgentTesla)", "value": "a1dddf96cfd672130d1e0e93e7277d8ffbea7e896cf43cd951138e22ccbbf76d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833652, "uuid": "451b70a8-25a4-47fd-976a-8f5e8c8585cb", "comment": "Malware payload (AgentTesla)", "value": "2c2ea55e0215d3379a304e5fa1f3aa927f4526e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833652, "uuid": "56f3e861-b600-4fe0-8adc-e0ebeedfbcb3", "comment": "Malware payload (AgentTesla)", "value": "0083bbbf58fe1c42e989e8476b8ea70cff41c4d554cca4da7de2cb60fe63080e16ae23450a3c698cd054abe26ef74240", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833652, "uuid": "5ce8efc3-6f6a-425c-995a-6302b44b9d1f", "value": "T14635AE0273D1C062FFAB96334B56F6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833652, "uuid": "7f0731b5-2d75-466c-b63c-719affd3fa35", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833652, "uuid": "22e55732-1573-44ea-b489-adde4ebc1116", "value": "24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXda0dpqtzWLD2d:tPVt/LZeJbInQRa0dGzWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833652, "uuid": "4b12c21f-68b7-4f0f-8e22-0766f944cadc", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833652, "uuid": "39791f55-b8ad-456d-976e-aa311faa434e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833652, "uuid": "7b2f50d7-c622-4b50-8b2d-dc2b8de001c6", "value": "pedidos 36530 PI-18789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ced6390-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849510, "uuid": "cd1170c7-683a-4e7a-852d-d7a4d3f8690a", "comment": "Malware payload (Mirai)", "value": "766ac8c3ac26cfdceedc4222022d9e65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849510, "uuid": "ebb45d72-3a6a-4b5a-bf8a-eaee1a0003d4", "comment": "Malware payload (Mirai)", "value": "a2e9d9436e5a2e4bb41927cfd77fc52dea1230e7dee0b688a03e5948abe783fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849510, "uuid": "9256d44a-8a46-473d-9fc7-5e9d03f322bd", "comment": "Malware payload (Mirai)", "value": "14417e8100d93ec31cdf0931e6f0945dbccbf45f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849510, "uuid": "3402144d-72f7-44c7-883a-46e942d3fd76", "comment": "Malware payload (Mirai)", "value": "0e501dd9a674a1663dd2b7045417b73575c51aad9a77454c83a48aea92223b9124d57ea7058100404ffa45b8937200ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849510, "uuid": "7cf9083b-f919-4489-914e-2d59597778ce", "value": "T12F3329C8D987D9F8DC5115712027FB368676F03B101DEAA7E79CAA23BC49B81D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849510, "uuid": "df90a2b7-6d48-4962-b20b-8647c5c1ac3a", "value": "1536:BAmkKnnAvjccy7ZeDm4EJd+67ZhP/2Bj6NYc2dZKQDfS:ORKnAvjcV7ZIEJdxZhP/2taXSHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849510, "uuid": "43f834db-fa2b-451a-937c-b20289e22dde", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849510, "uuid": "66891f07-444f-4951-a0dd-8631717f44a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849510, "uuid": "9b0d636f-db29-4b89-a1e4-1dc5e7cb88b3", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c663ba85-d0a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807516, "uuid": "bf2e9d5f-5d14-40e6-a8b6-8fa04b1b9b27", "comment": "Malware payload (Mirai)", "value": "7eeb153700a19b11d2475339cb331993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807516, "uuid": "95c44e1c-483a-413f-a289-506b69cd4cfd", "comment": "Malware payload (Mirai)", "value": "a356051dc7001cd69c769ff9c4e9d620c7c7fad944df2a63285fa2f1cb3e52d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807516, "uuid": "0c4e3c02-5639-482c-bdc7-835077f0b5fe", "comment": "Malware payload (Mirai)", "value": "3d0bf692b3d3016629245fe1108f6c95bd19912c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807516, "uuid": "80545d84-bd5b-45c6-a20b-1aecbea13d5e", "comment": "Malware payload (Mirai)", "value": "d2a6faa2b07fae7275206f3e395c26c4da16c4f2efc088ab821206862fde5212946f76892665c8ec0b29a11309d24ba5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807516, "uuid": "675eeee3-aa70-4895-82b6-fc929d9cc822", "value": "T10E13E13F3C4E1C55CE72C0F09EACDC93EA96D6BCDAB0B3B654640791209B5504AB1BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807516, "uuid": "da0eb5dc-7b5c-4e32-b5c6-954531e53285", "value": "768:K7FTyYG3+r9oDWy09vML9WameK2skTO1dgAlB8DrkmcgNmDRVndC49/s3Uozg:ETpt9GWZk9WaBNbTO1DzskmVQjdCwyzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807516, "uuid": "fab589c6-400e-4014-a001-ad87944489ee", "value": 44140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807516, "uuid": "e77962d6-ef80-4323-b71d-50adbc9f09b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807516, "uuid": "1fd473dc-f7ae-4253-8129-8396cf794989", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2b09f1-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806723, "uuid": "888c6604-431b-4026-82d3-df74a36a40bb", "comment": "Malware payload (Mirai)", "value": "4164831ffa1684c6acb508e7b6a3fa45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806723, "uuid": "c37d6aa2-6c57-4348-ae49-cf69d7fc6e12", "comment": "Malware payload (Mirai)", "value": "a36cc124c89263e88e0a388d6daf2918114bff62dd91fbd72222f6033c1a5829", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806723, "uuid": "711adaf7-893a-4e58-97da-a0fa2f203de1", "comment": "Malware payload (Mirai)", "value": "f51bb4ecf6dc58b3a4031aaf44f535c8e6335e22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806723, "uuid": "09649a22-497e-4ec3-ac1d-9a3c23b5e940", "comment": "Malware payload (Mirai)", "value": "f27ed0ade958498eddc901f2414303bbeedc27f36d23d97da675f2e178b23c5b2feccfb952194f82e951affdb78e0d24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806723, "uuid": "c651ba34-cf55-4b81-b5e5-3107b71c1d80", "value": "T101D3BEA7B34B2491CC5207F447C74B9E3E532112DEAB98E36C1F667B297A1EF0912391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806723, "uuid": "ce788449-3a72-420a-a521-8417f1cf8fe6", "value": "1536:XctV7RRhqLFtJAyiGg7BSbL3eeAcWz48aVl3EyHaHSxpIm5Ygj5dX/LWJ:XctVd2LFtcdSbzZAFE8aVuyHahgjbXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806723, "uuid": "bc23bd51-e0ba-4874-ab71-7ddc46c4ddba", "value": 132596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806723, "uuid": "3185b439-cf66-44f7-868d-e20918b2eb2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806723, "uuid": "1e8a3a3f-df23-4a11-ad57-de1ea8959d16", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b11276-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816770, "uuid": "731b6e39-fd5d-43a6-8355-4ad723646099", "comment": "Malware payload (Mirai)", "value": "1f394b6aaa24b22fca89b2e401236e49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816770, "uuid": "210aac87-02d0-4184-93b7-7d2595217ea5", "comment": "Malware payload (Mirai)", "value": "a3ccca2f17d5a5eb14277846f820809f56820a63459934c7665976d23b484e5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816770, "uuid": "c9e53a41-292f-4cce-b52c-6c4162bf2e9c", "comment": "Malware payload (Mirai)", "value": "46101094bf94cb4232faa169b0504862257a3f14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816770, "uuid": "6a746d89-adf4-4b45-8238-06496056659a", "comment": "Malware payload (Mirai)", "value": "f7ce1da61e8e8ee6f442e3ac0e02ee8acf3480527712e167286fcef80d2941d9209b3d05d1d3b8dca32244986379690f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816770, "uuid": "924180cf-0de7-4bb7-a977-0874629f8cfd", "value": "T17DA32985BCC29912C6E163BBFA6E418D332563E8D2DB3217CC256F1537CA91B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816770, "uuid": "14d3e73f-d7e7-4975-8a9a-c265f0d4e100", "value": "3072:khzzaV0cVfBqudXIgMEoeAhVUek3zWQzPh/3:khzDrmWQt/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816770, "uuid": "f3eed09a-28b6-479b-9fb3-da2ca3eabfbc", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816770, "uuid": "0e5fe149-16e4-48ae-b80b-fe4f2ab783a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816770, "uuid": "701027a9-033d-45f4-9b73-21a0c0e81fd7", "value": "UnHAnaAW.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5081253-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883105, "uuid": "d2d5d9c3-87d3-491e-9a0b-58bc9146ff22", "comment": "Malware payload (Mirai)", "value": "0f3f57e5d4c849644bbc4e5618380675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883105, "uuid": "6b0c38d4-e9b8-4ed5-b392-f9bef5f5ade5", "comment": "Malware payload (Mirai)", "value": "a41611efa71401db495dff6bbd6dad789d25f6a6a0b44e520af59d3c2c1d6be8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883105, "uuid": "e2bf56e8-49c6-4691-be54-c8999c1b6819", "comment": "Malware payload (Mirai)", "value": "2348c6df358ce52049d37dd859d14318b68d449c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883105, "uuid": "13b90d5a-2aae-4fb5-a4ce-8b50ef41a117", "comment": "Malware payload (Mirai)", "value": "d14cac0da031101a9072b88686ad3d79adb3aee05c6c7fbde727dbfa836ba5ca70f326caca9eb84fff86442f65ced697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883105, "uuid": "e37857be-1620-44ef-8b48-40de078e8714", "value": "T1FCE32982F8829A6EC2C71BB7EA6F228D335163F5D3DA7152C81407A577CA50F0D27B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883105, "uuid": "27d45107-da7e-47f0-bbfe-534ec83a8ca9", "value": "3072:Mz618rNv9QzFYDqTsq0/CtT9wczkia6hh1r7:O618rNF2YDqT8g9FZF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883105, "uuid": "e3f6f4d4-ca0a-4e96-aca0-e1f29f811214", "value": 149324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883105, "uuid": "5d3ea9ed-7871-47e7-8914-0a9d46daddd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883105, "uuid": "9e974af6-3755-4e82-8a97-4c731abbb7f5", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c2e505-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875398, "uuid": "1cb59d37-2d4d-4b9c-bd35-e087ddfb5464", "comment": "Malware payload (BlihanStealer)", "value": "88937bc41cf095d55e444769451180ae", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875398, "uuid": "7acce68c-5d53-4eb9-b4c2-e3718f89121d", "comment": "Malware payload (BlihanStealer)", "value": "a422d7953ecbdeeedce0e05dc58229fd534c9a2996a6b04eff2de60604adc247", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875398, "uuid": "0e67dfee-2f77-4cc6-b660-8d0db1e8c15d", "comment": "Malware payload (BlihanStealer)", "value": "03077ca6ddb321f2e56290ec58f6438ef47c6990", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875398, "uuid": "987b6f45-92f0-4d41-918f-afcf5ec714b8", "comment": "Malware payload (BlihanStealer)", "value": "517a0f3a040edd1b187a1439bd4215ebc557835b35ff81c02884e020f64b2f08709b01aed44931e13656edaa0d5b429e", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875398, "uuid": "d4b5ebc3-e127-4ec5-a197-9ce9ef11a739", "value": "T122938D1369C284B5C4A2263259B9977DA6AFBD001FFD97C387CC9C5D26622C0DE3E643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875398, "uuid": "9a033204-fbf2-42b2-b3e0-ba4beaf3ce3c", "value": "757708ca9fd3f4d0b8bef404d6ad71f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875398, "uuid": "d103c4de-ee0f-48b6-99b0-80647869b340", "value": "1536:vAowfbJFgjQ284U+w2EwRz/IUqX51n22n2n2n2222n22n22222n22n22227XjCF7:vAowVFgjQiUkEwt/XqX51n22n2n2n22t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875398, "uuid": "f9286918-68b4-4e04-935e-36349ac0ab79", "value": 94828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875398, "uuid": "e06027cb-770c-492e-8d6a-869ecac6e34a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875398, "uuid": "022aff41-8c59-4052-bc5b-0c1d67d161bc", "value": "n4vb1km0y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462ee2bc-d0c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764818897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818897, "uuid": "5352dd2d-175f-495a-a31c-dababe5752ab", "comment": "Malware payload (Joker)", "value": "a5293a6a0864a0b3fa73534a04cd2b62", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818897, "uuid": "60520d8b-058e-4e7d-b319-c05db8faa152", "comment": "Malware payload (Joker)", "value": "a4cf05a4c1e0b90781c5de2621fec4e6678e59308cc8904444d12f2c7bf82de1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818897, "uuid": "02034b87-499c-4560-8897-a0401af6d5fb", "comment": "Malware payload (Joker)", "value": "35a5589f8075a50d1331e4500921b58b70cc2ae4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764818897, "uuid": "0c687bb5-d4ec-4737-9a9a-8bd75d26cd76", "comment": "Malware payload (Joker)", "value": "42baf7eaffca00f71498c855887d271aabe644eb18221e03793fe2018af93f33966793cf5271eaca48c95946653dd37f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764818897, "uuid": "9f80db9e-d9cc-48f3-b980-2e6d47a1ce03", "value": "T141F6239AEB1DE83EC47B5073CE66966332A78D0145836773351CB31C2AB35499F0ABC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764818897, "uuid": "343e1455-bfc1-4c35-a584-b92724bedb06", "value": "393216:+mYFWmRlkeKRW9QI/TsZehiA1WJrful5xr:RYFnROWV+pA1WJLcxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764818897, "uuid": "737ea40a-e539-4732-ad38-b4233e27a8ed", "value": 15883835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764818897, "uuid": "9f635417-7001-477d-98e2-40dec7aa620f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764818897, "uuid": "ae6b15ff-83c8-4a05-b1e7-2641d4df4a95", "value": "Ultimate Space Cleaner_13.1.45.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfca68b-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829912, "uuid": "8d2220f4-6e1d-4ebb-b481-7a887d0af797", "comment": "Malware payload (Mirai)", "value": "0f7561a8edaa071c4c9999de3b79c1c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829912, "uuid": "a39469dc-2c24-47f1-948c-e66dc463ddbf", "comment": "Malware payload (Mirai)", "value": "a6464a1fa55443cb28d7eab9c74045f446e9f08dff075670b82035afbb20351d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829912, "uuid": "1936e5b3-9cb2-49e8-ab10-3f0fa94f8fec", "comment": "Malware payload (Mirai)", "value": "9cb99668d052b19b1860a806f4af03cc2fc05410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829912, "uuid": "a9b182a0-103c-4e79-a82e-1c691a607809", "comment": "Malware payload (Mirai)", "value": "0c2d84d7cef3179a40d47df169586f6c7c5ce4a331c31d66e8960728d30fbee3b9ef2535cfac956e0751f05a486d1fe5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829912, "uuid": "15aab04d-6cda-4e7e-ad3a-230731bb5321", "value": "T1D8F2F135D6FDE9B8C03E34360D5C8B86F882F5152AA0373A4519A27E9EFB9C03D15AC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829912, "uuid": "b83a2dde-297d-4d92-8642-4b5dacdb6f4d", "value": "768:WwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKTJtBwgUx0nZc:JOX80VqVi2otGtzXgzYMZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829912, "uuid": "e549f4d5-7310-462b-a149-bf9d5756d061", "value": 36924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829912, "uuid": "1207a423-4122-4db9-b3b9-7f339109c0c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829912, "uuid": "5e761e00-281a-40fb-b067-1a80153b4c04", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990ea967-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879165, "uuid": "9beaf586-0fbb-4c91-866e-213c966b8c9d", "comment": "Malware payload (Mirai)", "value": "34bf593869c8e90f6ffc0b7a7eddc372", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879165, "uuid": "3381ff41-0807-464b-b2d6-39cee5ece8eb", "comment": "Malware payload (Mirai)", "value": "a714dfe00dab69341856417021b71eb4ce9a46277ed225fff4aa043fc84988b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879165, "uuid": "a56f1e94-d9fd-4dcf-8e62-3b4923466590", "comment": "Malware payload (Mirai)", "value": "38ac6c62317eb6cb61e1daf1a85f640935d1b178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879165, "uuid": "85b1e248-9757-4c47-9d96-396e5e959f08", "comment": "Malware payload (Mirai)", "value": "e06f3b67f3f13ae45d14da9435298509abdbccaf89c51aea14e7a4a4ae74f778e8d6aaea664a57b5360ba5dcf2a6b87d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879165, "uuid": "2b69e010-9537-49e5-ba69-7bd4b1b3f010", "value": "T17B235CC5A547D9FCEC190A712177FF319BF6E83E2158DA83C359AD72E942602E5032AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879165, "uuid": "8654b8a7-63f2-488a-9cc8-40406d07298a", "value": "768:r+WtjNuFWittDEs3QysdebVj4o8NYeWTd/4cKOzFcwjKo:r+cwttDEsAysdqVj4DW5/4cKyFcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879165, "uuid": "792e3fc8-bf94-44a6-9d7c-6b11adfec45e", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879165, "uuid": "853d4d4c-cca4-48fb-9cb0-ab83fd7d9c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879165, "uuid": "026da31e-289c-432a-bf01-be5f1e50c5f0", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b30f76e-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764831039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831039, "uuid": "a5aab07a-5f02-434c-b9fb-d31ae03f2cfd", "comment": "Malware payload (Gafgyt)", "value": "8b4522e53423b1d8cb0da8e150b6e3b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831039, "uuid": "c400b737-e563-4a69-9035-b3a63be9c1b8", "comment": "Malware payload (Gafgyt)", "value": "a74908ea9a46e8676d4763c1c24d514fe75a24b8b815a78af2fb0766e279821a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831039, "uuid": "c71961dc-6b41-45a4-ac8b-f1c262b29dbf", "comment": "Malware payload (Gafgyt)", "value": "153ad660a06e20d1ce1badb8ffe9d286dad57276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831039, "uuid": "fd500edf-10df-4b6d-be33-6d68346c205f", "comment": "Malware payload (Gafgyt)", "value": "230ffa6d3f2a2d6f5a4f6067a6efbc9ddc019bd001a3ce65eeb2f6dbd3953b8d66da0c99139e11cd5a08e3a8356cf91a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831039, "uuid": "725d7877-1d5e-4151-827d-201f6d0cedbf", "value": "T10D833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831039, "uuid": "46f204c4-302b-4079-81a7-070a6be7738a", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJC0dojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3J3BQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831039, "uuid": "3550fb3f-344e-4746-8293-32f0cf53e246", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831039, "uuid": "7fa57794-ffb2-4257-af7b-697dba4b426b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831039, "uuid": "e9a2fc91-6521-4237-a980-a9761f18a543", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176f5f55-d0df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764831703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831703, "uuid": "dbdf41f9-323b-4429-a3e4-964d0cd65a5e", "comment": "Malware payload", "value": "6dabd77f67e6b502f68f3c68c96718dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831703, "uuid": "02f46304-4daf-419f-99c4-5c8f8a01e576", "comment": "Malware payload", "value": "a77f71fea9689c8abaa52ffa148c19e2b6e9bebbf10b6d6a127107dcb430c4aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831703, "uuid": "6e01ebd7-8a16-4d7b-9d69-98d9860993e1", "comment": "Malware payload", "value": "83b51389074b6eede327cb02e9442d91fad745a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831703, "uuid": "18812f43-7586-4f8f-828a-2dd715472e72", "comment": "Malware payload", "value": "a697c796b80fe9184c0a40ef1a75f45dd6a17f63556d527c8f28e7882ad433c4f2401c2ca18cb1f1f56773604a9f8342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831703, "uuid": "e94a2ca9-410c-43c4-8efd-7fa24003a0cf", "value": "T1E6E4AE1077A0C47BC5A202311876ABBB9BFAE97956664F0303503F5EBDB36C28A1F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831703, "uuid": "28f8f3a0-45c6-4523-a15c-52f60514d97d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831703, "uuid": "6d2cbe10-9d8d-47ae-b612-118ccdd49b99", "value": "768:z7ra/Tl+hs3E/jU0dugZ0T2Xtz+lHQW40Zz0D3jHUpi1GounzWlC/LPfw3+Ep:m/T2X/jN2vxZz0DTHUpouzWYguEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831703, "uuid": "477f1cb4-0362-4f77-955b-acf9c030538d", "value": 684656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831703, "uuid": "4fdd753a-1c20-44e6-95bf-5d7dd934cdb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831703, "uuid": "a8ecd0c0-0739-4d33-a278-bee345ba2345", "value": "ux8ew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6bdb88-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875389, "uuid": "b0bd9616-a2a6-47a9-bc73-02d1ef499301", "comment": "Malware payload (BlihanStealer)", "value": "fe2a3d1f9d5c2eb5a07268ff190a84a3", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875389, "uuid": "0691938c-7658-40e7-a43b-d574679be090", "comment": "Malware payload (BlihanStealer)", "value": "a784cd4c59e6949c670b4bd2c0d263d0646df64c099129f145d3fd8e3fc144a9", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875389, "uuid": "1a5d0e28-1882-4695-b3a3-6f79bc45512d", "comment": "Malware payload (BlihanStealer)", "value": "fc32aed016da8dd4d3523ebf8899ac2535f03206", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875389, "uuid": "afd67375-c9bd-4c6d-8660-2f3540601cc6", "comment": "Malware payload (BlihanStealer)", "value": "80df000a559c0eebe655ac0c793df23a9b5d62a0d73f1e5813f1934cd1b54ab4eedaeef262219343e57413141d5dce0b", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875389, "uuid": "a706b89c-ab71-4e41-ac9b-d8d00b383264", "value": "T101938D1369C284B5C4A2263259B9977DA6AFBD001FFD97C387CC9C5D26622C0DE3E643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875389, "uuid": "f5b2b87d-d35d-412e-95f4-7b5ca383f69b", "value": "757708ca9fd3f4d0b8bef404d6ad71f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875389, "uuid": "c9638c3e-c3e1-4fcb-b527-353caf7baa55", "value": "1536:vAowfbJFgjQ284U+w2EwRz/IUqX51n22n2n2n2222n22n22222n22n22227XjCFo:vAowVFgjQiUkEwt/XqX51n22n2n2n22m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875389, "uuid": "0a4212cb-54f8-4dfe-9abb-69a3c826ca09", "value": 95088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875389, "uuid": "c1344fac-d7b1-4b94-98d4-c0699f434acc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875389, "uuid": "fefe2d4e-9683-4bf4-aeb7-7840b4b1933d", "value": "dcmtbcrt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb46e21-d11a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764857051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857051, "uuid": "41507bc2-eb36-465e-8db6-f4f8b7ab3ce4", "comment": "Malware payload", "value": "e2460a28acb94e065268db8e871a269b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857051, "uuid": "feae6c2f-234b-4720-8108-32598bff6bd5", "comment": "Malware payload", "value": "a7ef9d3ce42195b06a1a58e66baa07d7b70b642014676b64500cd71598aca655", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857051, "uuid": "8481f62e-145c-45db-8ce2-c35bfe5f1e98", "comment": "Malware payload", "value": "23f900eddcb3040eb7a1cb82bbf0dd691afd04e2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857051, "uuid": "0cab4733-087f-4ac4-b112-bf02a2fe686c", "comment": "Malware payload", "value": "e8dbc75d4dfc65e703bba5f9a094fd32da9f7b3796ff7b9ac63438a4e12ae1a44ca5a99514ee09e8a441ad7b01d82174", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857051, "uuid": "8ec215e1-a264-4d98-98bd-d526426a933d", "value": "T1D373436C4ACB41F8EA2774588ADF5C03F7DA8503152CC5D5FA9CA9A1AF11838E3F59E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857051, "uuid": "f566f74c-ee9f-4ea9-9f45-51206d6810e1", "value": "1536:78hh/t0hV/iuWbf2T3wUnRXE7drRh0AcrYJp:Y+V/i9uTgURuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764857051, "uuid": "83b3dd1f-1b0c-47f0-b4ff-c96cdd77d664", "value": 76907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764857051, "uuid": "e2097364-f1fa-423f-9b65-95bee7ce08c8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857051, "uuid": "c89a5bf0-f749-4e74-a1a2-b5ef410b5f33", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38760a8-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807028, "uuid": "7d47dbda-f16b-40bd-a1b3-f9372eec9fe2", "comment": "Malware payload (Mirai)", "value": "f95bf09fa1188907bc8485607fb533d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807028, "uuid": "c76645f8-c842-4634-bc83-512ea85ae028", "comment": "Malware payload (Mirai)", "value": "a8a6f0dfb151a8cbd1283c71fd2e1ed4ca1cb9160c838d7a2dd4883a8ea4bfa4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807028, "uuid": "743b1d71-840d-4ad7-bc08-4388e7611572", "comment": "Malware payload (Mirai)", "value": "a9839801b863389b0a748a57649b7ec32331ec49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807028, "uuid": "e9b4dbfd-6b44-4580-8be3-68009ea2bfc6", "comment": "Malware payload (Mirai)", "value": "bc99ccce6e7b41f42706b425aee2487aaf2f6d41d6b874674c0637fa2c264edd4c5ece92cc057c550dc8b0a967cc5f1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807028, "uuid": "0f9f00ba-c858-4eef-a404-83f034920f0d", "value": "T1B8432B95F802DE7DF80FE67D44164E09BD3063C261830F2A27ABFEA36C720966D56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807028, "uuid": "8dafcb2c-9fef-4cdf-9f8f-389e44c2f20b", "value": "1536:/+dPsTgnLbMuv5tXbaXnb7f98V8TWl9ouSQy8fNLsA:23rXbobZ8V8T4oHQD1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807028, "uuid": "36fb3145-f4e8-4984-b617-9f7155c0eea7", "value": 60452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807028, "uuid": "8ee2bb21-d01d-4400-9411-67332e923617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807028, "uuid": "d3b6dc84-61f6-4462-8e95-e1ce0cc3a2c2", "value": "uYtea.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e4a69d-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883051, "uuid": "c83e6b3d-4cb3-4bc2-abab-107ce756b2e4", "comment": "Malware payload (Mirai)", "value": "0e8df272504e372829e187d721d1529e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883051, "uuid": "26ee2bb0-8655-4332-8b9d-cfb43b0e7688", "comment": "Malware payload (Mirai)", "value": "a90141cf25a22b84a1f1bfc9a1b525a434efde34ac0d7ff0b7986095eb94e59a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883051, "uuid": "07f7264f-7be9-4a90-97fc-c685b22854db", "comment": "Malware payload (Mirai)", "value": "f77a86894314c09237638889364fdcdc21723431", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883051, "uuid": "c317589e-edd6-464e-84a9-3684b2ca0a08", "comment": "Malware payload (Mirai)", "value": "919ea78c06ee6a4d465cd17e4c2be1f28a5e397471275a4532aa4db95c7b8e9f234ae87106449603047751d601f0b68f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883051, "uuid": "b97ad05a-5378-4db6-bc56-370cad99e0b9", "value": "T1CC34BEA7FB8E0990C85205F40BCBDBAD6F13114B0D6BC2E2B8693639593B5DF1125BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883051, "uuid": "6eeb5bc9-edee-4507-8a1a-3fe20a4c8c98", "value": "6144:JMCo7OhIM2YFVrlO2DnxSAArCjAvQCmqwC:JMCG2Y21L9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883051, "uuid": "80be6c50-4163-4b26-ad27-e78dccc7b5f7", "value": 239412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883051, "uuid": "dee1ffaf-5cdb-4ba2-92a0-54e7a99313d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883051, "uuid": "20daa72a-65fb-460e-ae04-505a4fd64cdf", "value": "ecco.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f596c4-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764831021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831021, "uuid": "0b17d509-d47d-4c5b-9b45-4f39af0226c8", "comment": "Malware payload (Gafgyt)", "value": "f2d071eb710b69d61820e3fc45c068c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831021, "uuid": "23df0ed2-c803-45a4-933a-abdaf186b5a1", "comment": "Malware payload (Gafgyt)", "value": "a9b9301e75806ebf5e2e007b1ac6196d993a3cf0630394597f02f9e2be2eb461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831021, "uuid": "46e9823f-4b3b-4416-b694-71988c0b6c53", "comment": "Malware payload (Gafgyt)", "value": "5d0a58cceae995e1ad17632eed2e8786672914ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831021, "uuid": "f1727759-7029-4fb8-a0b5-b9ac56174be9", "comment": "Malware payload (Gafgyt)", "value": "a17d09f5ffb2a8f2cddab41fc92cd3b25d2b6182fc7f5716f2a7ba7c01869b817c6c6647b9795b20e82be5f17be73abb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831021, "uuid": "b05551ee-1643-493e-a034-6a2e1f43f90f", "value": "T169833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831021, "uuid": "33361923-7e1e-4cfc-9811-5865f0bbf088", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LdWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YZ2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831021, "uuid": "a5bb0000-d3de-43c1-8e82-8c1a6bf1db52", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831021, "uuid": "091c1f5a-456d-412b-9ef0-e41a51b3326c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831021, "uuid": "b85c8908-7e0a-4ebf-8e05-6e6649cb1800", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98647277-d131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764867138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867138, "uuid": "7724842a-15bd-4ecc-a2d7-f8bc844b6d9c", "comment": "Malware payload (Mirai)", "value": "e93dd3d64a5c8c918c1609167c1b7e43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867138, "uuid": "61c13a67-8732-4955-81ed-92da082b7531", "comment": "Malware payload (Mirai)", "value": "a9f42ea4abbfc5054631a4da5a4b23450c962f746969e7f6bf993e4f09afadce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867138, "uuid": "b4391ce6-e8f3-4264-a8b2-b790ae338cba", "comment": "Malware payload (Mirai)", "value": "e955afc9d530035f9ddd1d2973ed56206941ade0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867138, "uuid": "345f0381-ff5d-448c-a3ff-d0df77a098c6", "comment": "Malware payload (Mirai)", "value": "fc0a4b2aa7e6984a6cacc2cf8c51c5e4546cc0b32e37968a3675ab9a2cd50d1146864e1561657c309e358bc48f85b4e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867138, "uuid": "edff4cc0-8966-433a-b45b-ca9fb08c2bed", "value": "T1FD342A46EB808E13C0D627B9F69F42553333D7A4D3E77306A9286BB43B8379A4F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867138, "uuid": "ac07a421-d29d-463c-842b-bbf9ea6bf1e4", "value": "6144:lDbea5qa4hy2q2a94GmB0kldpM7op+3JrV/G0Nd2eqSmB:lD5qRBq2a6GmB0kbWsc/Dd2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764867138, "uuid": "64b85da2-3943-4293-982b-61a575705ad5", "value": 252037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764867138, "uuid": "9e0a2161-9cad-4137-acc8-fa8da7dab68a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867138, "uuid": "bd69a581-0367-452a-8156-55fa565fd83d", "value": "Polar.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a168371-d11b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764857612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857612, "uuid": "1661bbbd-f946-4d1c-b790-1ea076af0032", "comment": "Malware payload", "value": "acd98815daea960507095e3805a8b8d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857612, "uuid": "dd1f3f22-187b-4986-98e8-8e1cd66f5342", "comment": "Malware payload", "value": "aa68d3bc135b922fdcfa6875400b85921b1571fdf0227c9bc53c14b0adc0458b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857612, "uuid": "0f7827dc-247c-424c-885c-fdb7edab3e3e", "comment": "Malware payload", "value": "6cad49484631070cfd0627efb5434940bbc8a4a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857612, "uuid": "d181f20e-a88f-4470-8860-66a5e5cc2463", "comment": "Malware payload", "value": "a62689ee0ae048334aeb50f93c6699df0601a21ce1a5ee449b890f87018d353ab3a64a8b617803977adcde60fe28d201", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857612, "uuid": "e40ce557-b5d2-41f4-8105-920c35c790c0", "value": "T1EF037C0BF65A2CEDCA17C134A1DDDB73F4B1742029128FAE5314CA360FA594097EEE68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857612, "uuid": "6d6c9fa6-32d4-42bb-81e7-d0801c3d540a", "value": "04e16ce245fed809a7c8b486f409f3af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857612, "uuid": "4344acff-ebbb-4577-9ce8-5da281def6ef", "value": "384:19p8nnTQW68hu266yIloi2iV+83TPKKS7CTXxXSSE31/mw5y8RbmL4nNy5iB:R4nTQWH6Zi2WXTyQThSmw55ALCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764857612, "uuid": "8c76780c-262a-4a5c-a7f7-bf9bf3f6ab9c", "value": 37752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764857612, "uuid": "19b56a75-1c3d-4375-97de-2e2227156397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857612, "uuid": "ae52cfe5-75d3-450b-8455-a283ca3b4c42", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b05c7da-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849480, "uuid": "bfec4276-5848-45ed-b905-40608a830475", "comment": "Malware payload (Mirai)", "value": "7e1b8205be2b944bfa41ce1f57d089ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849480, "uuid": "7b632876-8a4e-4e04-866f-4804f1d30bb8", "comment": "Malware payload (Mirai)", "value": "ab9bf0d9a200e280fe482114c210b8f5bd6750febc629129212df0ea74cd8a8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849480, "uuid": "40dd9af8-87d0-47e1-9c21-4d244ca4e71e", "comment": "Malware payload (Mirai)", "value": "b517b91b1352df6aa2622628a139c82815c886d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849480, "uuid": "9c09849d-6bd3-4385-ae15-4ffb20819238", "comment": "Malware payload (Mirai)", "value": "da6cfdd6ffe63447a9fcd3ff543d112abab7caea305cf82db668c000f1d7677e89ad8664d2a45166c6c2ffb3b00b67b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849480, "uuid": "40b75b48-b723-4808-aa14-8d0c02e6d7ac", "value": "T190838116BF601FF7EC9ACC378AA8170528DD611A31A93B75B830D428F25B25F55E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849480, "uuid": "2744d1f7-7dbe-4d0f-8b11-28aee99e8398", "value": "1536:LsMhLMLiQAlHvBoaAopJpLwA9Z5lsiYd42+:LsMhLamZvBkA98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849480, "uuid": "0cc613dd-adab-4b4e-a175-ccdeb56499ce", "value": 84168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849480, "uuid": "78184e04-1e5a-4cc0-b23c-ff91ab09c728", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849480, "uuid": "1e983e9f-fc4d-4ef9-a24b-112d3f70b030", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881edcdc-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880855, "uuid": "c88def7b-2c31-4560-be88-d423290e744d", "comment": "Malware payload (Mirai)", "value": "4dfa1d7d77eaa7a04666f19c01ba827e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880855, "uuid": "c89f0764-d252-45a8-b7f2-a987262df894", "comment": "Malware payload (Mirai)", "value": "ac5057ecf4cf4e0cda67dc1c0f3f078b6614809278f1d634b7e69d5ef1cb77d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880855, "uuid": "6b8bcf37-8dc0-48e0-8982-527691a081f1", "comment": "Malware payload (Mirai)", "value": "d30dc5de0ff13147520755f2147a543405127fe9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880855, "uuid": "711955d1-0935-4799-9ecf-2cf21c4f7944", "comment": "Malware payload (Mirai)", "value": "27722bf1bbe389482d19c168a00a13bd283317f80d35224127fb59a71b86666ed0aea1e1209b223f575be008ce3fa073", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880855, "uuid": "56f4a386-e0fe-44ce-8abb-bd079dcaa3ca", "value": "T11963970E2E35CFADFB69863583F74A205654339522E5C649E26CFE015EB070D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880855, "uuid": "de6c8f51-802c-4d50-803b-d111c8e8f251", "value": "1536:t0NTVpDuVo/JxlBifnKurBoLiLXabIvl8euq1HmJH:mNT/DIa+KunwIvl8vq1HUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880855, "uuid": "7b81cf05-9306-43da-b47d-a44734f4f8b7", "value": 71580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880855, "uuid": "29e64e15-468c-49c4-995d-234d482d8191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880855, "uuid": "8e26936f-fc45-43e1-812f-42a33092c832", "value": "DEMONS.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3db376e-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834167, "uuid": "bd43068e-a86c-41aa-8d29-2fd11249dde6", "comment": "Malware payload (Mirai)", "value": "0f607b23bd95972c549d8731c89d086b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834167, "uuid": "fec65664-7cd4-4959-98ab-760ddb471203", "comment": "Malware payload (Mirai)", "value": "acc43514f6a6d323bd90d6eaefcc72e9ce9e645c8fa77253c34faa6e86a0fe4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834167, "uuid": "c4449504-9bee-444a-b34d-cb37067f045d", "comment": "Malware payload (Mirai)", "value": "98c43fed917209e5cd2513be3da9d305dfca1e14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834167, "uuid": "06abbc79-199a-41c4-aee3-4a1d8296371e", "comment": "Malware payload (Mirai)", "value": "f8935cce2e15bf4da349e007f91cc102a075370959a4ea7a2527bc91141e6cb2e5f9bf1ac8cef0d1cb4695c59fdb6ded", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834167, "uuid": "5c2cf24d-5831-4101-bc50-45935b600c06", "value": "T18843382579BA3E13C0D4A4BE16B34F15B2E0377E30A4C62EBC721F9DEB50950664B6B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834167, "uuid": "aeb44264-0ba4-4145-b83e-fa0ce4cf4801", "value": "768:BZoDGT9zOq9yaf7luDysHqf4zB+g2J+7vlGvpO+PpB9A2y:BZ8GT9zOSyaf7luDBKf4H9gpxVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834167, "uuid": "daba6b1e-cf17-4a39-a4d4-dfb90493b7d3", "value": 58604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834167, "uuid": "a560942c-b5ea-440c-ac58-4e5af934562f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834167, "uuid": "b8bcfc5b-82be-4bc9-80f0-c2b5f91d2b5b", "value": "DEMONS.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c27eec-d0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764833574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833574, "uuid": "534e831d-3f24-4cb6-b924-b79bbd89e4d7", "comment": "Malware payload (XWorm)", "value": "2a5778a4bace831fd915d293902efca2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833574, "uuid": "b315529d-473f-4c94-9e11-2e3332527ddf", "comment": "Malware payload (XWorm)", "value": "adb9b24067cca8b16838ec25ccc1eb81b289820243e3cd5edde4788633c18746", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833574, "uuid": "02e42fa4-923e-4f88-bdfc-df99ddc104da", "comment": "Malware payload (XWorm)", "value": "db0426a675ff93ca205521e6a9de1f125931aaaa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833574, "uuid": "e9f618ae-adb4-451c-b5f9-25a7522ce38c", "comment": "Malware payload (XWorm)", "value": "bf4b709a8b31ad7ee0b5a087e150f9366e6528732633d330764c00c95f5029694b966f6820a1a56a4d3c8439be6c4f3f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833574, "uuid": "a06111bd-4ecc-49d3-a140-bc19849f0b2a", "value": "T16F431778D91C36560D4B7BEAEC2925B1C9BC8057052701A7FD98231D710EAEC63BDE3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833574, "uuid": "0ba07b9c-16fc-4b93-bae8-2273b7fc808b", "value": "768:gWRcd2r5lm7Gq0twNA61JCVk1sEjuk+YWiBaDrDxjTNAgc3D8B/aBmHaIpG8qzr0:Hfruy8WIJwEJ+wBUF9yESpHr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833574, "uuid": "d5ba4a6e-17df-41ae-b52d-163bf660ad9a", "value": 58504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833574, "uuid": "4f15c74f-bbaf-4e6d-ae39-79a43f4e9568", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833574, "uuid": "50816863-0afa-4a6b-b189-23bba1768932", "value": "Maersk_awb_shipping_document_confirmation_request_04_12_2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e7e4d0-d154-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764882224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882224, "uuid": "45345c14-9bfe-4bf4-9234-595e2fdd9872", "comment": "Malware payload (AsyncRAT)", "value": "1d568526db62548786c3c9f9643f4c18", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882224, "uuid": "fa598d18-4b21-4560-8f90-114b9b79e021", "comment": "Malware payload (AsyncRAT)", "value": "adf651fa794a768bc0337455a50dc8212c4f8c730610d06ea20f1d84812deabc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882224, "uuid": "38062776-a8ee-4a83-8ff5-26902eba16a0", "comment": "Malware payload (AsyncRAT)", "value": "fc06bde58612e74415a96ef361ed5c8277b019ce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882224, "uuid": "10ada57a-4b60-4e82-bfe2-698ccd572263", "comment": "Malware payload (AsyncRAT)", "value": "c99185075d7378fbf6e63fa4f452b8aa2c3ea3df482eff6208f5a08fb6c682de20676df16329b805fe4daeabe538da25", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882224, "uuid": "e2fad6d5-7bfa-495b-bd52-402efefaf6ca", "value": "T16021DC812AFA8B24E3F25B76047B67108A3AF840DEB6C72D4A64489C1991B00FC34F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882224, "uuid": "8318b4cb-7c45-4e13-9a95-cdfd15ad2d71", "value": "24:8ZfJYHmrfurMV8PAA0vmx+/1RUV0UUNl2dJS4EAXKlqneTmf:8ZyHmrmrtPXkynUNloG/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764882224, "uuid": "44e7490a-9646-4b93-a443-17666e5bf182", "value": 1146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764882224, "uuid": "2947d7a1-639c-4ff5-b9af-e4209c3c4dfb", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882224, "uuid": "bb6e5a73-fc2e-41ec-8770-a6f572f49b23", "value": "OR60415OE + OR18750OE.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e390428c-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829898, "uuid": "f6f51016-3024-4959-943e-510c0932b463", "comment": "Malware payload (Mirai)", "value": "7246ce795caea2cad9dcc42549721b2c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829898, "uuid": "ff5c4842-632a-4a95-9450-efc4f0682988", "comment": "Malware payload (Mirai)", "value": "ae6528be474ea7e0a07f30100b64b8b0146b673bd0bafbd200490f0b2155e5fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829898, "uuid": "a1da9ede-feee-414e-a61f-4cb5c0f14d13", "comment": "Malware payload (Mirai)", "value": "e7f8d5fa19cf1f0ceb18f77bbb479b4e2102dbd7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829898, "uuid": "19413c7c-52be-43db-8e17-960551d54750", "comment": "Malware payload (Mirai)", "value": "c0e247b5577694adc72e375c373b1085574a4984965948089ce192aba9b272d792375f64d9afc3b0858fb9ebbcb45111", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829898, "uuid": "4c4fd16b-3853-45e1-98dd-6aaa41157c18", "value": "T1ED717F91D90341741D1B1762EABA23EBF082B3E274EB7B1B358828F5788CF009485DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829898, "uuid": "acdbbfd8-64f5-4e44-872e-63d436ee9767", "value": "96:iD313ax3A3O32B3yE3h3g393e3I3M3T3Ewz:wlqxQ+GBjRQtOY8DUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829898, "uuid": "457ffd6b-0ba4-4a69-8be5-426436cdde48", "value": 3784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829898, "uuid": "b4c7617c-55fc-4802-832e-ac9ee7a9f582", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829898, "uuid": "1ecf1f77-bf70-439c-a25a-7c2d6dbf387f", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3396bb6c-d0b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764815000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815000, "uuid": "b0fe169a-e0d9-4eb2-a5c5-004c1b5c303a", "comment": "Malware payload (Mirai)", "value": "f6729d2f3fbc2e03f56d64f532c35818", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815000, "uuid": "38502f12-7b37-4d6b-9180-62eafc2d81ed", "comment": "Malware payload (Mirai)", "value": "ae8ac1844ca139174bfbb6c0fdcd65f770c2bbcac933da5c2f63dd88d1a5d665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815000, "uuid": "cfb95873-3cc3-4436-b2a6-85b3bb6bdf1a", "comment": "Malware payload (Mirai)", "value": "73756c5d9d78f030a17a180e130be9e2e373f917", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764815000, "uuid": "f344b5c1-c53f-46cf-bf27-8f0e279c90dd", "comment": "Malware payload (Mirai)", "value": "7e52a70fe95c1187c46207bdbe8d18330817c820ac5e5096f401e2c8af8a58fc0c76b9e1f6c122eb1d0c90f96d60a57a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764815000, "uuid": "44d29857-5edb-4244-8f3d-2c9bb375d39e", "value": "T154C32A46FD519F11D4C722BAFB5E414D33136BB9E3EA3102CD20AF6523CA9DB0EA6512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764815000, "uuid": "f87b9c51-8346-421e-a873-ff957258dee6", "value": "3072:rTPWnAEqZ6a0kxDtpZ/cazlUaPhqHWntJj:rTuJE6a0kxDtphcaSaJq2ntJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764815000, "uuid": "73ce7c3c-7696-49e4-a95e-1b35b3a84fbb", "value": 128900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764815000, "uuid": "9d13ce62-c5b4-4749-b948-eab5d5a4fa4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764815000, "uuid": "34d76bbe-4bee-4874-adca-bd87fcab5556", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f92aa80-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816738, "uuid": "3bfe8f13-857c-4b7f-870a-36e579b2f0f3", "comment": "Malware payload (Mirai)", "value": "1cf8343228714080263d31debcfbb4b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816738, "uuid": "6ef9953f-4dbd-42f1-a82f-9852f58f0afd", "comment": "Malware payload (Mirai)", "value": "aea2a773ed45a13ff8fa55ba72f3dc64e7401b5e26f6129d8406cf78c3fa9334", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816738, "uuid": "33287e27-3976-4349-97dc-ebd09d38d2a2", "comment": "Malware payload (Mirai)", "value": "6f6cf07019a41bcc8d3b397785646d925cf0b13b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816738, "uuid": "4bcbc237-fd6f-4b97-8a93-184d46aa15e8", "comment": "Malware payload (Mirai)", "value": "e8873e452bd7ec198b5026865d089e42a8fc3ee728a9d5b28e6cda2da0882a30138f2e4678134158d90b23e9e74bb3b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816738, "uuid": "58829cf0-91ff-4f2b-ad37-83989b79da8e", "value": "T128836CC49687D9F5CD06467561B3EB338637F437222AEA83D3D89A23FC529419A072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816738, "uuid": "1eaf7c12-c504-4e3f-adbf-5b50ca1557b0", "value": "1536:6lATE58h0hGZuf/H04AZBCyajO1sL6M3hLYufoGXb9hRWoBh1gcASCX:6liE58h0hquf/H04AZBCRa1sL62UJYbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816738, "uuid": "42c9d98f-009e-40ad-a52d-1cb32b331209", "value": 84272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816738, "uuid": "906fefaa-9fa5-484e-83f4-dbfb3ea8a4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816738, "uuid": "9e172f2e-00cb-4a74-a9b3-a035d54eec33", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8095cd1-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849582, "uuid": "59849493-2d5c-4013-829a-2af2aced7cd8", "comment": "Malware payload (Mirai)", "value": "4674139c288d999bff947d6c667182f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849582, "uuid": "ecd14405-47c1-45f7-9cf9-73355cf22952", "comment": "Malware payload (Mirai)", "value": "aea49127fed0b394f4f6dcd3c538d5e40d3fd7bff6990ca23ee82658e7811f2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849582, "uuid": "6a77e244-3ff6-45bf-8af8-1f3beccd35ef", "comment": "Malware payload (Mirai)", "value": "e7a44ef968b637bf52b05bcc0fff4d72aefc7420", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849582, "uuid": "93e9ed20-c48e-4670-8daa-33a7be65b340", "comment": "Malware payload (Mirai)", "value": "6c4d49c0f36867bb92fae9564be11710abae9f35c2be019431c1ea9b15b42f1c2f5b96b6f5c979c05dcb07c0cd4fcb30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849582, "uuid": "695c88de-3e1b-4d0c-ad75-aa1b8b810b2a", "value": "T10553E83A2B131F63C4CD017205F30336ABBAE65D7CBA8B57E8A06D646F05A9434563ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849582, "uuid": "83babfd1-c6bb-4c8f-901d-2c304b994a97", "value": "768:rIcmIJA8jHH3oh6PBWyWyLsVzQqwwf0WO+E3sfsau4Bb3Bpuxw:kcd3oh6P+VtwwfPHu4oxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849582, "uuid": "c7c4c36f-7a1b-4223-a44d-7cae4a8719cc", "value": 65553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849582, "uuid": "84420a39-91b1-4350-8f17-8cd28b0d02c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849582, "uuid": "608d803c-af3d-475a-a67f-abe9164477ba", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab21bca-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888268, "uuid": "33c8f6b1-c0dd-46cc-b940-eb8a519e3dd6", "comment": "Malware payload", "value": "9bd512df762ff5bc4c28dc8c2bca2a26", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888268, "uuid": "f501bbf6-d963-4b98-89f4-b4a5736fdf84", "comment": "Malware payload", "value": "aeaa8f299a5a40081bbe77e37279d8a4fce6190ee0c8027d88b86347b48d83bd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888268, "uuid": "8ba8f683-018b-4ad8-9d38-c1d310f2ce13", "comment": "Malware payload", "value": "52e11bdf7ab329a6562ebfb25a079f41f8849693", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888268, "uuid": "fefc950c-e19d-4e32-b2a4-203684d01b9d", "comment": "Malware payload", "value": "dd026a008ec12d1a32e3dad143d4276d631e438600ac1b57b9bdb4d8c06fc240398a526c7b042f042170212e938abc17", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888268, "uuid": "a3fe8098-9919-4735-a69d-4cf966e91fbe", "value": "T1FA111CAF2D6355D0C29CCA4078F3ED02B259C28A15DC3B1866CF8735C49AD04BD2BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888268, "uuid": "a407501c-419e-4679-9c50-3475c60e8827", "value": "12:78ZTlMqnZelMqnZJlMqnZpVlMqnZXWRlMqnZHlMqnZ7RlMqnZ7WlMqnZ75lMqs:e34VpBeb7dE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888268, "uuid": "1f1e2a33-7f27-4dae-a072-7b7296684a11", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888268, "uuid": "b16ba0a1-65df-4bbd-8afe-e1037142b48f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888268, "uuid": "0b4657a5-dfd0-463e-8e5c-840b922e4c4a", "value": "router.faith-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66da36e5-d0c8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764821958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821958, "uuid": "7277f01a-c896-4d9d-97eb-f904740ba3f4", "comment": "Malware payload (Mirai)", "value": "3bfa4cd8731f1b056b71129331546c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821958, "uuid": "ee693c1b-1d8e-485f-9aaa-2a5588531784", "comment": "Malware payload (Mirai)", "value": "afa9c7063567b316b506dfb09a7f2f91f50e994f6db08104fed65c5ae14ba405", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821958, "uuid": "2aa97c46-3e6a-44b3-909d-c58c5062c451", "comment": "Malware payload (Mirai)", "value": "c647d43e340bb63df9091fa4c91ba331d36c4ce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821958, "uuid": "c3061c22-7280-406d-bb4f-3a1cc0166837", "comment": "Malware payload (Mirai)", "value": "237a0f528a1443ef85429e911af191d17fa75a03df0e69c7567b0207293113ace8a1736f340013a97cebc5ab5fc6261a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821958, "uuid": "56ee7545-e592-4b58-96e9-e91dec8c707b", "value": "T1612302601B402863D6F0EA76C25740FA6BFA2FD4ECFBF1915A160A6577C2E47B4DC086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821958, "uuid": "ca2f6475-22f5-460d-8858-276925238f11", "value": "768:vUgmD0oaqozKVwAYE5gbaE/SL+uqbCqzIsIGfZvqTHncV2cquk4IqD3Ur:5mD/azsmbaE/MqzIsFByAdVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764821958, "uuid": "99fc901a-947d-4a31-a57d-973bfeadfc0d", "value": 48464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764821958, "uuid": "ccc23928-36f1-44fd-a467-be78d8cbb9ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821958, "uuid": "55b108c2-4593-49d6-9492-a26ac31c6644", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cacc7d-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764834194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834194, "uuid": "f00e71fa-5775-4439-a899-d26064d83b9a", "comment": "Malware payload (AgentTesla)", "value": "5d8dd284097966b39206455794ba7f5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834194, "uuid": "e85cc81b-7775-4de6-8813-d3ec85eb0b37", "comment": "Malware payload (AgentTesla)", "value": "b090f3ae561ee5d2d0aa4077b080e6df3e9a389c5d88ea92f6bbe52740b15ab0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834194, "uuid": "4700e92d-4324-4d99-b0ce-ccae2b676fba", "comment": "Malware payload (AgentTesla)", "value": "6f8612e52d9499696a7c90742ad9dcfb94580d5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834194, "uuid": "8188e0a3-e690-44bf-945e-39e4cc6c8f0a", "comment": "Malware payload (AgentTesla)", "value": "38b69d98544292777b8ac0964ac660dacf23d3e487a5fe8470e789f3b0e9f2f8b9845f73fb1c8e0f5131c7dfb67b5b37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834194, "uuid": "8cb6fea9-642f-426a-8471-5efbbfa46b79", "value": "T10705339F879859CC303A6D37F1BD144AA6F3D3760F9E2636C87783C916D660682C68C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834194, "uuid": "929ae1f9-323b-4a3e-8579-3ede13ab8f4b", "value": "24576:G1ZDFinYeruULsiFzhgLaFosr4B/V5iIDX6z+V64:GrwYez3gLSok43j6KA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834194, "uuid": "ef59ba6b-fbc2-4bc4-90bf-a92aedd2ae9c", "value": 832120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834194, "uuid": "d46ca239-3d78-4295-9b31-7af1101dac7e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834194, "uuid": "2636ac50-dda6-415c-96c5-5644c9556d21", "value": "LOI for Telex Release Customized CN - SHGS03139847.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e110b4a-d154-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764882073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882073, "uuid": "5fcc80b2-227e-4234-a328-f6ddf55881a1", "comment": "Malware payload (Formbook)", "value": "974858e99bf815107813cec49c795bfd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882073, "uuid": "9d9cb413-f5aa-425e-9f89-37288062a881", "comment": "Malware payload (Formbook)", "value": "b09c80681d134a2d076c491793044e8865a34acfefbc86ac8b66e739a585c5e1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882073, "uuid": "a8bef4e7-271a-4978-8c69-bfb92fda2de1", "comment": "Malware payload (Formbook)", "value": "bf2a2567a59641bea298788c2ab3f30a4b0e2210", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882073, "uuid": "6d241079-503f-48a5-9701-2e1482ed1db6", "comment": "Malware payload (Formbook)", "value": "619474b1eb1d693503e4b2dc9c7edd46f5b1d61d6cc131034fed0440781deec056b859728a7fab78dad6a79901984c4e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882073, "uuid": "bc5479e9-0b4b-44e2-b6af-d4a568e447c0", "value": "T16C6523509DBE7F5B45EC173A209F6F4D58E58BC98080BAE272DE69E20F797C4C207425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882073, "uuid": "dba183b4-20b7-4251-ad32-2e38421b1b53", "value": "24576:1bJ0biKD+5xhabn2E8UVAALHtUsD3foM5Vo836zqEfwc8lEeEknpVBX7Ulu4:1bpW7hLbfLVo83KdulhRku4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764882073, "uuid": "43c15c89-7ee0-4ef9-a4be-e6dd010cb895", "value": 1420071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764882073, "uuid": "e89146b2-254f-4e89-8bad-0dd5a28c1a29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882073, "uuid": "915f62a6-cb43-4466-be24-5d12e8dd6b32", "value": "Encrypted_Script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6e5676-d0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1764833703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833703, "uuid": "da6a03d4-acda-4b09-969c-91352e56bc87", "comment": "Malware payload (MassLogger)", "value": "9b6c48b68c0615115922932157f4da2d", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833703, "uuid": "bc04d728-b0ed-49e9-ab5a-3fb581b4cf65", "comment": "Malware payload (MassLogger)", "value": "b0f8191d1759ae813352bea2d7c8dee158c57c7c3b529c241b453c488480da9c", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833703, "uuid": "b4cd3c6c-145a-47f0-9d9e-5ac7c7d9f99f", "comment": "Malware payload (MassLogger)", "value": "b529e1e5f8254b1a5e2698d680a609e9ecf04fa1", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833703, "uuid": "098a5085-dd37-4860-aa4f-25c6579049da", "comment": "Malware payload (MassLogger)", "value": "b4f7c8f8bf3092563a0e9635c0029bad6b6060b7d05eef6edfbb7efd756254bbe8a2155d066dc3a0e7d627192ba6868d", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833703, "uuid": "0b6274de-ce4e-4efe-bdb6-378765094ce3", "value": "T1F255E59D4421ADD3A054FEF0F540EF978CDB5794122B47121FE5A8AD2212887FFAB2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833703, "uuid": "edcb73dc-ab82-4795-81e5-ab7d1575d998", "value": "6144:cKIHNqPcVUj83ikVQECDZoqAVbKCoVf/kcE3k5T+rJcS+RX4n5LO9hS5AiELWEGk:4VW0QjmIsJ7jg9wDmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833703, "uuid": "4e3686e2-00c3-49e3-9771-72536ba8c3cf", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833703, "uuid": "817e65bc-bf25-492c-b22d-9ce5a4a27a57", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833703, "uuid": "8920d82b-c312-483d-8fe6-313ae31030a9", "value": "QUOTE 005.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a563f009-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834518, "uuid": "f8f0beb4-12c5-4df1-946b-9414b012294b", "comment": "Malware payload (Mirai)", "value": "c305ed53b2c6a6a155053c652e47702f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834518, "uuid": "68bf2bcf-e0c9-4401-9427-fbaceb00fa78", "comment": "Malware payload (Mirai)", "value": "b242f78c4e18df615ae98f5636a20ca8738bfa28ccf24f947ccb311205c8936f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834518, "uuid": "ce44e96b-fb57-4103-87fc-2d12a31c0ec8", "comment": "Malware payload (Mirai)", "value": "1049b4f1c99c049b623976d2b0f636b7f73393b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834518, "uuid": "4f225264-1334-4317-8261-5aa51f0b179e", "comment": "Malware payload (Mirai)", "value": "f08c2dcb106885633e940801c40e995ee59dd365888e505ae8eda9dcb024cd06ad119afe7f1d55067537abc9d969b297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834518, "uuid": "b5640dda-2a31-4879-8ea3-e758006e6b44", "value": "T16D431854BC929A22C6E4277BFA2E418C731563ECD1EE3202DC292FF4768582F0D6B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834518, "uuid": "11c0a665-d4df-4eb1-9af5-bcd61d3e6ee4", "value": "1536:wXe9WaJ9833g2c90d9IcjNI62xPYB71/5sL1:wXYWyCc90TIQp2xyR6L1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834518, "uuid": "28434611-c7ef-4378-9f63-502736be1bfc", "value": 56144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834518, "uuid": "8f89c3b5-f6e6-4527-a789-45cd0e8fd2b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834518, "uuid": "9c9d3194-f52f-4e19-8f90-ef526dbdff1a", "value": "DEMONS.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279f209a-d134-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868238, "uuid": "25c5000d-9dd7-4521-a08a-37ddf69a1362", "comment": "Malware payload (Mirai)", "value": "be04d16f832c5d09deaf25a0a8a18abd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868238, "uuid": "8191ab6d-599b-4556-a683-91067c04ef4e", "comment": "Malware payload (Mirai)", "value": "b2e395a95a56ae6438a966155357d12408e9d82110cdaa5af678b46658e56665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868238, "uuid": "076a0f26-1366-4b20-8c47-4fcbc7d5855c", "comment": "Malware payload (Mirai)", "value": "254c6931083ac36894bcaddfeafe73ef8b85ad49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868238, "uuid": "09fca90d-e2f8-4bd0-8a15-0ac144d8d409", "comment": "Malware payload (Mirai)", "value": "d231198a560be8f4bbedff00947ddc596206cc152b6ad1633f22b8ff01b082dbd8695583fc9e23aed9a3430221d60578", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868238, "uuid": "b8914c6c-7275-4467-9cea-843716e778b0", "value": "T10B6301586B6AFAD0ED3025388DD40784AF62D7A856D630A31394CD18F6D67136FFBC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868238, "uuid": "5d3d10c9-c340-4306-896d-85a8b4a03d51", "value": "1536:j4YeCK8lpEyEBafotAe1w8dhjXLSsVC11BuDK:jzeCK8HlfyAepLjLkUDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868238, "uuid": "c9d3b6a3-8ade-4df9-9845-2962490750b3", "value": 68800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868238, "uuid": "ff48e840-d6b3-44a9-b27b-02756ef49277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868238, "uuid": "160ba80c-622f-4932-a783-cde4a8eb080c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d4b5af-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806743, "uuid": "661dee57-124d-4f9f-8513-e9c5d2b9e987", "comment": "Malware payload (Mirai)", "value": "4e12e39afd7dfcb54aee4f835921ee7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806743, "uuid": "785a59e7-5200-45bb-8d20-4e0cc3f0fc04", "comment": "Malware payload (Mirai)", "value": "b32c984ce5e6bdbd12439e0f6bdf31e4b7b609b5034f5d5c729a199625dcec2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806743, "uuid": "e17714a8-5632-4dc5-aa41-fa1abbeece1c", "comment": "Malware payload (Mirai)", "value": "4c8961daff7029d72e65514aff86d6212f53eb4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806743, "uuid": "4f9fc85d-fbeb-4e6f-8bab-337a8fea4ef0", "comment": "Malware payload (Mirai)", "value": "6f35f955e1045f56281a94668e544c3956b641b54ead8b0ec72944f7c314172b26b505806b45d1af3aa107c22f321786", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806743, "uuid": "1901ab34-52ed-4ec8-bb16-338ce5f114fc", "value": "T16F73F819BF610F77EC6BCC370AA92B0529CC954B22E57B367934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806743, "uuid": "60eec159-0e8c-4b9f-a359-0e8c61772473", "value": "1536:7J5dbFB4x92nKoIea98M26ofWU+UZ9CYXzdJa10N:7J5dxBu9uKo7IUXd4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806743, "uuid": "49c8d451-e3a8-4a80-b46f-6ddb72f3b89c", "value": 77320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806743, "uuid": "bcc8ed82-b989-4b58-9fc8-cd746e69c47e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806743, "uuid": "9958b02a-b292-400e-9a72-1a8a5af06e40", "value": "uYtea.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91327a4-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834176, "uuid": "b97d7d68-cf3b-45a3-b3fe-ff91cf581774", "comment": "Malware payload (Stealc)", "value": "9e31feb8779066652d53f6acdf95811f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834176, "uuid": "e71121e0-07d7-46b0-9dd0-34e6d3ca740a", "comment": "Malware payload (Stealc)", "value": "b38e57dc8a718b9b9ecb84b8ad7c8fc11c5028e7b9f0eafc1591d5b58c9de9c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834176, "uuid": "71bddb94-5e78-4857-b4e7-2dea9b859c48", "comment": "Malware payload (Stealc)", "value": "fffd1e3b2f9b4b5056b780918554e07d2ebc438f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834176, "uuid": "0f865cf8-6890-40c6-b3d1-a2ee13e0938c", "comment": "Malware payload (Stealc)", "value": "cb4dd2c6d4c4b2b7a01717287d48530d0c28326b8307ffbae7b38691ed1aeacaa8def4230b1d8fb43ab3d87b4a40a7f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834176, "uuid": "46b82f9b-33bd-4984-9cdb-2fc83d3f5859", "value": "T179058D1EE7B523F9D0ABC274CA428582E7B278455770974F03E14AA62F376A05D3FB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834176, "uuid": "b722afec-c438-44ee-a676-09c74f5c2f20", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834176, "uuid": "a944fa84-a12e-472c-9cb7-bbe5d0988e22", "value": "12288:OGLVpIo/cBJ9InRPehbyv8plnEn/uv3YZtF15kjHD:OkkBJinRP6bw8TEn/y35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834176, "uuid": "2ebab661-16d9-4e81-a7b0-8bfc72354f5f", "value": 797952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834176, "uuid": "1a596d70-5a3d-4df9-8a38-221d3de8d37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834176, "uuid": "4fcc530e-97ab-4074-a2aa-b17992602045", "value": "99xc5vk6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dddfbb3-d0e1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764832788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764832788, "uuid": "c75f22e5-e9e5-4647-8d77-abd2f0da0129", "comment": "Malware payload", "value": "1e8507e0a857287855c62fe6aa57dce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764832788, "uuid": "507a6df2-f8f3-404a-b928-7a40481c875e", "comment": "Malware payload", "value": "b3ecf242cc0e928d18c7fcff7c0ec44a04b8f6a63bbb85f2120d68d47cca29bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764832788, "uuid": "4dab5d98-d26e-4ba6-8068-fdfef682eb7d", "comment": "Malware payload", "value": "f2b317904ff5ab84e0aeca3f649bf7623088fa1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764832788, "uuid": "f2ba7b03-91fc-44e7-ac1f-2923f3a7cd25", "comment": "Malware payload", "value": "3ff8fe79dc678c27f62ec452e8c3e689b49b60ac8d0ea60d205e38630757ca83b3b5ba368bdada6c2da17663d8b30829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764832788, "uuid": "76db211c-ce01-42ab-8f95-b818a3248ae7", "value": "T153349D0672ED01E8D1BBE23C99A25A02F7B67826473197DF2350427A0F777E0AE79711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764832788, "uuid": "3a11acfe-3a99-4208-a7e9-1412e6f2c003", "value": "a8308de57fce070f4cb88c7f43bf4b27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764832788, "uuid": "d1e99b73-0176-4fdd-887b-be5d241c09c5", "value": "6144:RBKjK2LFzZNfIULtHkHEiCt8yIbmkHEiCt4:RMjnNfdkHEiCa4kHEiCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764832788, "uuid": "f78cc018-b46f-41a2-978a-4511694aef09", "value": 252372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764832788, "uuid": "b91665a8-0dae-47df-8fa6-78275e2fade3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764832788, "uuid": "3f71d129-4f19-4ee1-86f2-acde7ba5926a", "value": "b3ecf242cc0e928d18c7fcff7c0ec44a04b8f6a63bbb85f2120d68d47cca29bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a33f67-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883052, "uuid": "745657ad-6b5a-4842-bf45-2f1cfe150f55", "comment": "Malware payload (Mirai)", "value": "9265a0e76c998ebd7ffb6fc8348bdc4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883052, "uuid": "223dbff3-2852-46b4-8eec-bd580aa803e6", "comment": "Malware payload (Mirai)", "value": "b3f5d6f349c123f71787e5c68203f6f287932a971fec2f99dc7815cb17e9abfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883052, "uuid": "02275b80-1299-4ef2-81d7-b0c444b8f5d8", "comment": "Malware payload (Mirai)", "value": "babad6490859c2bd367159ca7024afdcc375aebc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883052, "uuid": "a39b60a5-29e5-47aa-b512-4fd088d4ac8c", "comment": "Malware payload (Mirai)", "value": "87f27a0c2eece5879bbe4899c9fcea6b1b126b00d413b55c6be5e069d82195aa8cde7608be92fe827a40625ff3be2384", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883052, "uuid": "93463b09-bc93-4837-a276-7527f757c680", "value": "T1E483122403584E1EF2052C3BB6AC9E8B56360674D537F078B9C21A2CBFA778DA1753E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883052, "uuid": "90a67eab-12b8-420b-ba6a-90f60115e834", "value": "1536:5n/+K1I5tQn7gSi5CNyEeOt+E/+VPIF5Sq3ex2ULkhQRWvG0wM3zc:5/+sI3Qn7+5CbtJ/CIJQLkaUvGvM3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883052, "uuid": "8a2df158-5f41-4ca7-9fe6-12d677ba7958", "value": 82272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883052, "uuid": "ba53e867-598d-4edc-9b2c-46bad8502502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883052, "uuid": "8b970ed7-66f5-415a-b616-8ca48e40c57f", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fd9ae5-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764870537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870537, "uuid": "24e2d5c3-e3b1-48ed-ac2c-3559bab83313", "comment": "Malware payload (Stealc)", "value": "84fe2906c98105c84e29703595452107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870537, "uuid": "19fadee0-657d-4721-890e-57cd36ce42c1", "comment": "Malware payload (Stealc)", "value": "b51eee6f26e042a399e84d9127579003c7bca1cd78a7f0ffe20a5ef4cd41b8f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870537, "uuid": "b4cf3cec-7133-4f95-8402-56fce555f8db", "comment": "Malware payload (Stealc)", "value": "bfa92c55a841e9af6a2d54272e0f53ba3b68584c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870537, "uuid": "e7bef591-c449-43aa-b918-be3862c7efc1", "comment": "Malware payload (Stealc)", "value": "5ab2d2f8e0aae0b07f76e310d0ae79aac25c0f4f55ad82f6fcdc92f09fe099e9d406c0bb900acf27a3aaa633b2bab399", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870537, "uuid": "156be7bd-42b0-4bdd-b9d9-e10776275566", "value": "T140251266FB43B8D9CAE649B18D6B00F326125C971B541B77B0F4BA3518C122B7B33939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870537, "uuid": "77e63f97-8d70-4982-8155-ac1278a59a2b", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870537, "uuid": "dea7892d-d511-451f-b98b-ad4d85f3e160", "value": "24576:eOdg2vTNajkp2rmHGUnvrkFXYUE7/21KK66RDvUYEo8xw:e2g2v8jurgFhE7/qEo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870537, "uuid": "854e8be8-79ff-44bf-8a8e-55272cfd6e6b", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870537, "uuid": "3afb349e-d7dc-4a03-9f4c-ead4c02cf4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870537, "uuid": "1bf776ab-acf5-44fd-bae7-8e5b154b5be8", "value": "standard_graph_data.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2632e8-d0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764839737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839737, "uuid": "6eada0ff-ba78-43de-b62a-35e3a5cb294e", "comment": "Malware payload (Mirai)", "value": "83cfac84e008cef852f8d3072f581861", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839737, "uuid": "5308bf6f-fa0d-4d45-80cd-1d2a6a72cfde", "comment": "Malware payload (Mirai)", "value": "b5a5716774d101b567e753e265329a096e276e99f6930a8ddbbb37543191ad07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839737, "uuid": "bd1081dc-4336-40ff-8f91-ec06cef559c9", "comment": "Malware payload (Mirai)", "value": "3b35d3c498f791b55814209410d1a88c4d09b903", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839737, "uuid": "25ce5bde-99b9-44b3-852a-4a3af9ef5824", "comment": "Malware payload (Mirai)", "value": "d72f848bede72be4fb4b172dd322a80fa3f357e9afa3d8851d4e28029b5d7d48e29774a80130eecfc469dd90bb4e487a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839737, "uuid": "76b36b73-1423-4990-9a36-f4537ff770b5", "value": "T125B3F855F480CA66C6D1277AFB9E528C332317B8D3DD3106CE14AB3467EBA5A0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839737, "uuid": "f3c3b9ac-a9d8-4c3e-bf20-d2d1566b5e97", "value": "3072:91uFTA0idfPOhQkJo94fw251SZicwfIJO4:91OcTOxTfw25DFAJO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764839737, "uuid": "9ccbb565-b07b-4a4e-9f25-255e5fe9ed58", "value": 107908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764839737, "uuid": "974997c7-fa09-40b4-bd9c-1ceda3f0793f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839737, "uuid": "e652fedf-f951-44ba-9710-f2b766b0ec17", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca43402-d168-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764890848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890848, "uuid": "5bafb14c-2429-44bd-b791-f46b664ac5d1", "comment": "Malware payload (Mirai)", "value": "b80a5b557bc108aa69502b1bc220f5b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890848, "uuid": "4ce06869-90ad-4d2f-91d2-6abc006b8269", "comment": "Malware payload (Mirai)", "value": "b5aff27502187e841763ff681cf081d735f719a7c06b1dbb79d4a34bd494d850", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890848, "uuid": "23063b4a-6f98-4e00-a5ba-f578a00600ea", "comment": "Malware payload (Mirai)", "value": "7e49884638e1093aed153b3c96e6a619c71a1d6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890848, "uuid": "2eb8630c-b6d1-480b-a174-3b81505ad118", "comment": "Malware payload (Mirai)", "value": "8b27671710d38c7e83fa2e49f75a2b718794272be0e459d55692b5beff35c5d3d408cdf14996e06cc0ca1e10fcbe2881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890848, "uuid": "f57e950a-db4d-4e27-8087-21373727e455", "value": "T18D531881BC919A16C6E422BBFA6F418D332623E8D1DF7217DC215F157B8A82F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890848, "uuid": "01a6e0dd-3ee2-431e-a117-a8df3233da8d", "value": "1536:5hOM5GNS2AuyybrSiHh8++fA1t/YOH0tu:5hOM5GaiB8++fWtt0tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764890848, "uuid": "0195eae0-c101-4175-88b0-69eb2a3532d0", "value": 61384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764890848, "uuid": "3f583ac8-73bb-474b-b63d-74848294ea47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890848, "uuid": "0651447e-15f7-41ae-a3e5-0479d0b962ef", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72e4230-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806712, "uuid": "6bba26c7-d1de-4f50-b963-fcaa1763c5a8", "comment": "Malware payload (Mirai)", "value": "219b5e7652e3426d447e18fab33a10d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806712, "uuid": "c9b3709f-ebb5-44e5-8bf5-5b0ede991306", "comment": "Malware payload (Mirai)", "value": "b5c1d3bcce0af884022072407f05ae211b0ed79769417b449403017823dcfd79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806712, "uuid": "4548f74a-4f27-4bdc-adba-35e7dca90326", "comment": "Malware payload (Mirai)", "value": "cf8d3d422bbc2f49ae717a4f05ce8e20c2bad9dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806712, "uuid": "14a93025-772d-4f22-bc88-9c58baf7f3f9", "comment": "Malware payload (Mirai)", "value": "5bec17b8826d89dbba4113a97c3d1d7f22037f69f3d34f6cdba0b8f7feec084cace3b82d899575fb68a5d99a02b266c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806712, "uuid": "1d597a77-b3ec-464a-a09d-9be6e3a2153d", "value": "T1BB434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806712, "uuid": "f79b0393-7112-4080-bb9a-e5bf936f5f3d", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmcKDj5gk9vWnTI4eBH+4sToQLDLFv:Yn/EsW5qhSh6amTlWnU4GH+dNLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806712, "uuid": "8eff39b9-513f-4819-9102-4c40ca1aecf7", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806712, "uuid": "79fbfcbf-6825-44c3-95b6-2e2dd29ba61a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806712, "uuid": "a3e74301-18cd-45f8-8c01-a5e8ac9f4bde", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b4f43c-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834163, "uuid": "1c5ab905-f936-4250-9a01-d67c6b090291", "comment": "Malware payload", "value": "c0132e1f8a0ab7e210c235247f4f4f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834163, "uuid": "05d33f60-e8f1-4db9-a274-de0ef8913526", "comment": "Malware payload", "value": "b6163a271a1fde1364251c7dd62b6e47c404a58fd437264d82d51216037f6747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834163, "uuid": "1f5b5f1c-3e87-4b92-9249-5fea86802430", "comment": "Malware payload", "value": "10470aac7ec33dc7f7ad7577cb2a73c40e52a631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834163, "uuid": "a8857f02-75dd-48d0-8480-f84625ad7d8e", "comment": "Malware payload", "value": "eb105e5f55c29dba64fef8da161f1fc8cde403ec071d534cdd2927431a9dac9ab37c9c6a1012ef1359eca3c57257d4f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834163, "uuid": "b68d7510-ba62-4995-9f7f-78bc2aa9fc40", "value": "T14F264817AD92CEC6C09AD239F8A2219276B0BC040FB5A7D30E51B6752D376CC5C76F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834163, "uuid": "fc419899-16dc-436f-b947-a9de5daf87df", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834163, "uuid": "37316f0e-7836-429d-ba1c-b2487351c8be", "value": "49152:4Do49OKAfagwNrAbzZCuB1ouge53V7SDPHV3pPqwq3FnoIGylncuS/Rq2MqDo5pJ:4dvR05P5xj181e8IGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834163, "uuid": "3e335f3d-47d8-46c2-923d-12b08689bacc", "value": 4564632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834163, "uuid": "2f95221a-7123-4b97-8597-6369cc1bb39f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834163, "uuid": "f2bd3a83-1de9-4ed1-b4b2-3f53045cef0c", "value": "djddpqocqcnuigcmyupp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ae1772-d0eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764836874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836874, "uuid": "cb8991c4-09a4-4811-b8a3-fa985a3ac047", "comment": "Malware payload (Mirai)", "value": "e3cfddfb88fbdbceeefbabc0d813ad9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836874, "uuid": "91b5933e-2e65-45fc-b1f5-e5119cd0a32d", "comment": "Malware payload (Mirai)", "value": "b633b860ea5757cc3cedefc28bbb85159a964ede9535c2dfc34cdc16273a5063", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836874, "uuid": "f2df8793-3937-41fb-8578-1132ca264fb2", "comment": "Malware payload (Mirai)", "value": "573052536ef1671fd06e34d7e4960a888d6896fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836874, "uuid": "83e7f9f8-b238-4101-80b6-6d755be8d916", "comment": "Malware payload (Mirai)", "value": "0e1560625330cbc7aa0a4e5e35ebb93d30ef8c89e6cd79036bc4ddf78c9d0c6e33139ed9d02f36480f4090a62b37abf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836874, "uuid": "3f3ec06f-2bf5-42d7-8873-bb0c3c028fd2", "value": "T1C67362393E61BBFEE66C82304BF36F70C351219276919345E26DDA085FB128C5C9E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836874, "uuid": "22c35414-5e33-483a-87ea-e8a7a66afc62", "value": "1536:7R0DuDkLMWrPlmhQ3tEcNkieTFAkvVz2w6btXHlnw91osVGnB:qN1nO1TV6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764836874, "uuid": "3f25fac2-1b2b-4b46-afdd-f12ffd009f29", "value": 79644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764836874, "uuid": "6df0a60c-3f2e-46d7-87f2-2533315a932a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836874, "uuid": "d08d2e19-0bf8-4867-8f16-a4cd50faf273", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873197a1-d0e9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764836186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836186, "uuid": "47620acd-4ef9-49bf-942a-fb96b258ae8e", "comment": "Malware payload", "value": "6d32d3fe1ab530371f22fec971cad55c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836186, "uuid": "fea3ae4a-b4b1-4297-8d85-5203d1a3ba64", "comment": "Malware payload", "value": "b6ad0b8a6caa9ab7e5df55bb29d3720225a3d5292ec6d54fada0a4153fb2f02d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836186, "uuid": "b11111fe-e4de-4dd4-9d8e-d5d8c160430a", "comment": "Malware payload", "value": "1e07b5f16f71bca5ad8e6e57f63ff249540bc533", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836186, "uuid": "d4aef7b6-c6d0-44bf-93eb-7fe39100ba08", "comment": "Malware payload", "value": "13844f82a4fb64ce782acab0c5e291cbeff5e7daf99cb6e00ce9abea1cf6b6fc2cc016abf4111a19df3fd7e205cc1b94", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836186, "uuid": "328a53f7-3c6a-4b1e-b460-2589e60d5342", "value": "T1174633D1E252A1F7EE68CBB58F9F3157123A0E36B4A2F1A94D1ADF86034C34D8459C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836186, "uuid": "33023f1e-c79b-4905-9728-e8b9e29e30fd", "value": "98304:8B7k7XV0m9QLI2GhJmBm+oaxRMOSZ0HvmnvylCMvlCnu5+9yVRqeOXC:8BkbV0FLshUFopOY0Hvgylpt+Pygy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764836186, "uuid": "a934e4e7-dddc-4751-9125-f420cbfe68ce", "value": 5540135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764836186, "uuid": "b02bc0f3-114d-4aba-8bbe-89fcb8b35759", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836186, "uuid": "00c39a82-bd64-416c-a7b7-870fc2cc46f6", "value": "tango8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fe0f89-d112-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764853895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853895, "uuid": "8b7ea44d-72ba-4892-be94-b06ac98ce063", "comment": "Malware payload (Gafgyt)", "value": "00e0e16154c7f07d0f16e0226c614c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853895, "uuid": "ba1d89b5-209d-4a50-accb-6b1fce93fb33", "comment": "Malware payload (Gafgyt)", "value": "b6bf594139135f9c6293b38482992cc5838da5f3a08c80a45746b7bf99226f50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853895, "uuid": "129317b1-f886-4ff4-98a0-6a49e6875f75", "comment": "Malware payload (Gafgyt)", "value": "629ae67f72e09ac4d57b03a56cd3be8ca9a38f95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853895, "uuid": "30f0be5c-ce7f-456e-82af-56d4fab09e25", "comment": "Malware payload (Gafgyt)", "value": "e76c742bfe789c5de80691e2103568d1dc9a1aaf283dfa6bf454f3172f8c2ec0a64653e7f564e8f1ee3bf339562308ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764853895, "uuid": "78cfd977-df02-43f3-84db-588ce41e5fd1", "value": "T13F43293726A6C9AEC49753F52AD7E6219423B83D1B33A007B3D87D2A9F278D41D1D306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764853895, "uuid": "c048f85e-a142-4394-8ada-75366bcf8274", "value": "768:JVTrJLH+xG+KQa+i86VayQ5dnBpH35db0xzcROgwcNqySE+/eVtoaNzw4urC:rrJb9Qa+i86VayiBpJZrROgXqlj/serC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764853895, "uuid": "60b23ee3-7d43-4ad7-9679-cfe6bd336177", "value": 56277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764853895, "uuid": "8cf3ff87-62f8-4a29-a966-15c60ee75a86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764853895, "uuid": "b85505f9-20c7-4851-be08-47d3a546c185", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17242b1-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764829063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829063, "uuid": "73169bda-d4af-4816-bd08-1978b2fcb5d5", "comment": "Malware payload (Gafgyt)", "value": "5672999d6c7627e057fc6877db619077", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829063, "uuid": "28e484cf-1d88-446e-9a42-021ad98127b9", "comment": "Malware payload (Gafgyt)", "value": "b75b9aaeafe27dc7f23502b4c1c29775234638c6caf2fe0b2253d09820404585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829063, "uuid": "5cef4372-df4d-4c23-bc6d-39f338ca6af7", "comment": "Malware payload (Gafgyt)", "value": "4bdc5950351e12c406aac35f012eb3dde9f52e36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829063, "uuid": "9759fddb-921d-4f31-9f15-68af74c30d18", "comment": "Malware payload (Gafgyt)", "value": "e0aeeea7bf504d6c2638670b5a99d22aff402f8705e3d0491430bf57482f09f2b8db22cfd3ddae244634187e96a56913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829063, "uuid": "681987ac-bd43-42c8-9a97-492059d0f5d2", "value": "T1A4632A026741CAB3D0831AFA06E79B250633F83A1E16DF56F32D7CF45B15188B62B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829063, "uuid": "df7dd057-8f18-4a8e-911e-cf46fea697ce", "value": "1536:GqVYPCfxThjUdOn4JymPWBSgSh1MtNnr/NbHBDSDmd+l2OZ/fufYEZ:GqUC5ThgdikrEHM1I5rVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829063, "uuid": "dcbd40c1-dc74-493c-9976-ced5442f5c5c", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829063, "uuid": "e39794fc-87e6-4b51-bbfe-65e8345c0a7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829063, "uuid": "7b527d8e-95a8-4d15-b182-049ba4d9fd2f", "value": "bootingworld.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c56dde-d0e9-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1764835999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835999, "uuid": "6b049dbb-26a6-4e06-8278-1f65e12b4dae", "comment": "Malware payload (GoToResolve)", "value": "f84af97972dfac6ff21439492e57135a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835999, "uuid": "d1a92026-22d6-4ab3-b310-fb26d2a1e052", "comment": "Malware payload (GoToResolve)", "value": "b7603b111999cf8ec98d164f3d4ec72743e2c0cee6d4fb981b669d87c5267030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835999, "uuid": "4d1e7262-c7ac-47fe-9266-dabcec1904fe", "comment": "Malware payload (GoToResolve)", "value": "0bc6a5c414fa23d44f247d6c23e0e6d8dd56c9cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835999, "uuid": "cb6974aa-d61f-4e86-9a84-73fda0cdb5f6", "comment": "Malware payload (GoToResolve)", "value": "7d4ac5de6469ee5259253c019d2d1475e265fe9eabfac5efc77fbdb636afe9e1c0e09b383bae016cc417946523573a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764835999, "uuid": "96ac86db-470f-4a80-a939-c53d14062027", "value": "T1F13733317156C171D48711F1AD28AFFAC2ACAD35877948CB73D85F2A9B709C26B32A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764835999, "uuid": "d9e3b5f7-6eaa-4d79-8daa-90dbfa190707", "value": "5077e3f17a4376dcf6421ee6917bf4aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764835999, "uuid": "323370cd-fc9d-487b-a8e3-bfa3a98de3bc", "value": "393216:YAwoMOd/9DYp3Q7xwvcqMcfuIp6HIaW947I3Xon91m/FHVP+zTLy3qOZXMdtW6hH:4oN/98pg7x62In947T8ZkHe3q6F6hljl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764835999, "uuid": "e3891cba-3dfd-4019-a971-13a8c852d77d", "value": 24473624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764835999, "uuid": "198df8db-e2c8-4bef-b0fb-d52350dc717c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764835999, "uuid": "a7c2cecf-eec8-4f05-b77d-ed3e01ca0e5f", "value": "MicrosoftTeamsSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b420535d-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834114, "uuid": "2e8725d3-8d08-4637-ae2e-1452584a2820", "comment": "Malware payload", "value": "a62742800f52eca973a4f65b05f5fc1e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834114, "uuid": "9fe13171-0bae-42d6-b8a7-2cea10eb6684", "comment": "Malware payload", "value": "b85fa5b0ed219adef3d648c32442bc11394e03850962ce1d796006a0642d3728", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834114, "uuid": "39b7d616-764b-494f-9ea6-45ebd084a4ea", "comment": "Malware payload", "value": "e595972f00a7de5d5131e69224e4c16580c9239c", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834114, "uuid": "b179a6f8-3a03-4717-9c80-8e7e5d1b1570", "comment": "Malware payload", "value": "a99c250cae59553f75a0ad1ac56923f003e1d50a9bd4659cf16d85154f728a86d8fca4dae28c4374d680a7e2c0e945a1", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834114, "uuid": "2b452893-d192-44b2-914a-bce8ae7d2811", "value": "T1E1265B02B870D5A4C09AE138E861D1927F21BCD8173237E71F767A720D767D4DA7A3A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834114, "uuid": "337a88cc-06ae-4437-8f6e-5b2f50936df6", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834114, "uuid": "b64a90e3-5dcd-44c2-8b39-b72eed7f376a", "value": "49152:QYsiwDeJSp0ekbW45bHajKI2CaUP9tp35/9Eg+zYGW2:8Pj29m5/MpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834114, "uuid": "e52f7a24-eff9-419a-8a32-f01cb4c29987", "value": 4540928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834114, "uuid": "2d2977f6-1099-4897-aa2e-0cc7e366bcec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834114, "uuid": "2951de53-e922-4bd0-be88-69299bf8bf94", "value": "b85fa5b0ed219adef3d648c32442bc11394e03850962ce1d796006a0642d3728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d4121b-d0e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1764835272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835272, "uuid": "318802a8-5348-4630-8674-bcc204747a91", "comment": "Malware payload (Coper)", "value": "78b1933b1499db4c552a02af2c202f70", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835272, "uuid": "39200d18-25fd-4544-bd47-e13b154503b5", "comment": "Malware payload (Coper)", "value": "b89c57f8781f121938b50631295f96ddf25f18616dcfb4862a7a87a61f0bf7ad", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835272, "uuid": "cce2b65d-a792-4233-8c23-120ef7ac1ed3", "comment": "Malware payload (Coper)", "value": "265ee4e5a322b6d82b1539cd11f277246a116dce", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764835272, "uuid": "5d4f1ae4-8c60-47af-a653-bd74b551414b", "comment": "Malware payload (Coper)", "value": "eba244825d78cf4daff2cb23f94b71bd125d4205ba8b9ffe9496283243be0ff1382340012e62e5dea7adb878542d4d16", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764835272, "uuid": "b78ed699-0c6d-40a2-a020-37c106e28b1d", "value": "T190451202B79C8616E4FE5B780D5596E0A638BD50CF06135B2A01B30D1DF2799EE32FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764835272, "uuid": "6253bf80-db82-4fa1-97fd-2a17f54f5be8", "value": "24576:OO+UxnSsjm4BbaB7HMX7s2I1iy5ZC0UyBomBIgGO3gRD1RA8fVUzqN8jiC1:OOt1jZVaB7oI115ZNBaOw51RvVoqN8jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764835272, "uuid": "363d17fc-b6f4-43c0-a1d3-f5e82673f2ae", "value": 1168619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764835272, "uuid": "4131808a-d610-4a47-8490-81f062f61de0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764835272, "uuid": "b6cad926-fbda-40dd-afc9-d4c9ecc0b0d4", "value": "9W.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f57f96d-d0e6-11f0-a129-42010a9c0007", "comment": "Malware payload (OctoRAT)", "timestamp": 1764834938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834938, "uuid": "ccd43038-21d5-4f19-915d-3a20cbe76d19", "comment": "Malware payload (OctoRAT)", "value": "69905105c88d17248aa705855c89c6c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834938, "uuid": "0da1bab6-b9e6-4414-b3e5-4914675ff839", "comment": "Malware payload (OctoRAT)", "value": "b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834938, "uuid": "7307ef71-0278-4707-9cb7-abe7374abf1c", "comment": "Malware payload (OctoRAT)", "value": "1e6fb29143f1d27dd1f750adda38bb9f6cef7301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834938, "uuid": "30e51d49-9cf8-47f7-b97a-d9bf3af015d4", "comment": "Malware payload (OctoRAT)", "value": "739a80b22afcccf705ec5fa00b3210b2216fe1dfe72305bcfa75d7e92b921c7b2a7bf80929bcf5f0ceaf48b6695acf3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834938, "uuid": "f1717ea0-97c0-4ff6-ac7f-2c3284b07867", "value": "T10A342349AEDC91B1CEE91FBEC8BB08B14294CE6C06DD9194EF21E1157F413E4990DA3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834938, "uuid": "1054a290-6287-403d-9207-b082543c6cad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834938, "uuid": "364e1f3e-e351-47c2-b49d-400f706aa08d", "value": "6144:XKZ2rzyd3lb5MrlJv0/a9M2sCQYl6Wc5QX:aZ2rg3grl1V9MpCQOTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834938, "uuid": "318b4423-e087-4375-928d-191a65579438", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834938, "uuid": "8413cfe0-8081-456f-8e00-2206c5f87b43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834938, "uuid": "0bac463d-b1c2-4f92-9952-85de336aacd3", "value": "b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d528fac9-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764834169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834169, "uuid": "a98d9c34-de04-4a1c-a7e9-2825d4b93bde", "comment": "Malware payload (DonutLoader)", "value": "be116a620711d611a47d75f02c30c98b", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834169, "uuid": "466a7fae-6663-486c-a986-84a75f54c587", "comment": "Malware payload (DonutLoader)", "value": "b95e69a846b41f56eb8e746b56dc85a98da5ed989411579bcda5af0b959f07e1", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834169, "uuid": "3dd93454-0560-4639-b20f-000f34d4c035", "comment": "Malware payload (DonutLoader)", "value": "847384bd35994ef6c1cfe2891e6d0aef9679343f", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834169, "uuid": "72baf2ec-f6c2-42b5-8f7a-f8bd1e110f50", "comment": "Malware payload (DonutLoader)", "value": "ca3af12242dbaa638161e83dc47ed0211fb5dd34dd3b99dffccfcac2efc9146003bb95729419d8bebda30e48b5ca36ab", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834169, "uuid": "a4247a33-bcef-40ce-bb43-b89ff40f81bd", "value": "T1FC646C15AAA4107DF177C378C9424946E6B2BCC647F0A6CF1390CBA6AB27ED0953E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834169, "uuid": "6dd3119c-a22f-451d-b6c6-0a4b9918ecc6", "value": "53e19d5243b4f25d48df742c8d94ac9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834169, "uuid": "84cc32a2-160f-4b5e-89ff-7dd7ed114040", "value": "6144:ffRbGY6EDNNAuHe28Pl2ncxlF64YZJR2OG:f5ZyBP4cxlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834169, "uuid": "68e2ec3a-8da6-4df5-92bb-a22ed86dc536", "value": 317920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834169, "uuid": "285a37c8-e53d-4b4e-8f4b-8ca4861baa85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834169, "uuid": "6137158f-0206-4915-95eb-b98fe2aeeba7", "value": "rcmgr9l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc6e2c1-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888277, "uuid": "da0a94ab-5431-4541-8e37-50d89e8ab03e", "comment": "Malware payload", "value": "c3f339467c30fb7a28a7df42ab446801", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888277, "uuid": "d8fcd8c9-1fe3-47ba-812c-cebfe69b3d72", "comment": "Malware payload", "value": "b9aebc51d143ec2185a3669480f910fdc79446328a957506b87caf9e02b45aa5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888277, "uuid": "5f2a5e35-1e97-4ac9-ac0b-229461b8956a", "comment": "Malware payload", "value": "18e771bec2a51337abbca663e30141adcabc4580", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888277, "uuid": "f765ffc1-909f-4e91-bc41-374c5d64b8b0", "comment": "Malware payload", "value": "a2e573e82b37a1e70477b43ea68a1f490855e5e7b4eacb7580e705e28f5336b381c9415ed50f997c4c6b4f7a5f9a9b9b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888277, "uuid": "ffd77208-e920-4400-9170-4a0d2ce5ae18", "value": "T1FC11F95E24029564D51BCA1EF873F602A317DA8150E77F284FDA8772C0DD9147E0AED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888277, "uuid": "b46aeeb5-61f8-4eb4-9feb-b391bde516a3", "value": "12:78ZF51Z051Zj51ZpH51ZXW751ZR51Z7751Z7851Z7z5HC:eF5v05vj5vpH5vC5vR5v775v45v/5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888277, "uuid": "e458782c-699e-4aa1-af72-fcb3223859d8", "value": 990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888277, "uuid": "0aefd5aa-a6f5-4705-9956-f022a50ebec9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888277, "uuid": "05f913ce-9b0a-44de-a775-273ed12d2e7a", "value": "router.draytek-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6233e8ca-d0f5-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1764841278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764841278, "uuid": "4ef85c59-f013-425c-b9b2-251d5bd086b6", "comment": "Malware payload (GenesisStealer)", "value": "7b46b9465f195598b522b83ee04ab823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764841278, "uuid": "edbaca06-fc6c-4014-89ff-a4cd41cc9cbb", "comment": "Malware payload (GenesisStealer)", "value": "b9d0951bbd62ad86da613fa3fcb939228305094bdc4462d06f8fd3f57e7a9b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764841278, "uuid": "f5b8a7d4-7e6d-468c-a6f9-2ad97d8915a6", "comment": "Malware payload (GenesisStealer)", "value": "0ac0e423f6376006329f9971835cffae5629bbee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764841278, "uuid": "d2728249-ff40-44f2-87c1-58f07b1c6888", "comment": "Malware payload (GenesisStealer)", "value": "e1ef70a3770aea34404c288fadc7602630f078f3cefcaf3c16012a7d92c0cbc018d0edd04d1ea79aec8668fa5cf7568d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764841278, "uuid": "c055e1b2-b5ab-4394-9fc8-ff3f93039166", "value": "T1931833357B548DBACE8EF2B9D3F576E415A668432D9C737B2A02048B40D8E04F9663D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764841278, "uuid": "5901c293-f9bf-4b04-86b7-1ff2a2622a58", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764841278, "uuid": "3ac75235-9eb9-4cae-95b0-98f13cbeed82", "value": "1572864:3S+BWMFDe45kEpElO6hDRVOSAyAfHaGv311/YeS/OUGg/5LvEa8ZcL:3zBFle45xpElxhDRVhAyAfH33v/Vhe53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764841278, "uuid": "2395d841-611d-429c-96df-ee623fd58e94", "value": 87894538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764841278, "uuid": "591aceaf-b92f-449f-827e-c8f364754846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764841278, "uuid": "09a78746-2ae4-4d2d-976e-6eef5672847d", "value": "RPReplaysextapeleak3_12_2025_exclusifleak2025.mp4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578989c8-d0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1764833529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833529, "uuid": "043f7a25-eff5-4f9b-b52a-06831c17e7e9", "comment": "Malware payload (PhantomStealer)", "value": "a14c5616174b98e547f19db5b626182f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833529, "uuid": "4ffbb37f-9f2e-4e9b-a445-f631ab18dafa", "comment": "Malware payload (PhantomStealer)", "value": "b9d83f15dade0ac5d00b5da94b7a95f40498cbc7c585136f9b98ec9a833f82ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833529, "uuid": "7d3684af-b319-4661-8a7d-ba6a83bf0493", "comment": "Malware payload (PhantomStealer)", "value": "2723d23462bd4d5da8ead535a5f0465756cff0d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833529, "uuid": "79670cf4-ec11-4c41-91a6-ce2063a5276a", "comment": "Malware payload (PhantomStealer)", "value": "a0ab66f78dc4ec7aa0e8d7d1bf0776664ea4f082e5a958fe3b8d97e14d5734af3e16c55969ce37e73fbd121c94aabd9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833529, "uuid": "8b80cd1e-1cfa-454e-8607-8cd8b84365a9", "value": "T15EF4DF68B3F84A01F1FF5B7194B19951AB34B513A961E71E15C080CC1EB2B919F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833529, "uuid": "e0942916-3a6b-435d-94c2-e0d530514ed8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833529, "uuid": "e64e2022-1f2b-41f2-92ea-5510caf349b7", "value": "12288:w9N7l/7kqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabdLdlLUwi:w9/kqjVnlqud+/2P+ATAS/JYellLUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833529, "uuid": "462e3616-023d-41f5-a358-9c41941f884b", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833529, "uuid": "7c68a0d0-7fe1-4ba3-96bf-3b121f083dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833529, "uuid": "4949df72-861d-4cb3-a5c0-ac7c116366ab", "value": "485383f932025_order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc769029-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829403, "uuid": "a4332e59-b604-4bd0-ba95-a25ec4177971", "comment": "Malware payload (Mirai)", "value": "96412c7cad2fd77472592933cc2b71c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829403, "uuid": "b54c4fb3-4ecc-4ce3-bb00-058fffcb3fc2", "comment": "Malware payload (Mirai)", "value": "ba4b9f33281362f895f049ee8a7f285294d369f0c8313db1ec57241fca965381", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829403, "uuid": "d02fa9e2-564c-495e-8bf2-d7877288c8e4", "comment": "Malware payload (Mirai)", "value": "4981ae52cf3ddb712478e417390026e9700faede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829403, "uuid": "4e267a8e-3fbc-486f-9574-82f94299981b", "comment": "Malware payload (Mirai)", "value": "b414ce5b9f413ffeec429aa04d0f49e7a468fd5cab464e7c7500ce027454482ce4fe9a05a9801db3330fefcf141b9464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829403, "uuid": "8ed2c380-229b-44f3-99ca-ce17ede050f8", "value": "T101832A47B981D0FEC499D03847BF7537C923B4BE1239B29B63D4AE262D09EE01B19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829403, "uuid": "f9f24aa6-794a-4e1a-a4fc-9df35e9c49cc", "value": "1536:Mqbd7IdAcsgBY+s1SmLkCkj6Rv3U8GbdGrAyvQUol:Td74AcsgBu1NkCdRvAbdGrXQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829403, "uuid": "6c2fa90b-aa24-4f2d-bd38-3536347f8c0f", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829403, "uuid": "d305327c-1817-4547-a947-dd08e869feaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829403, "uuid": "08e4ab92-a0f5-4eb7-81c8-f02ae58b7997", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20613f6f-d12e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764865649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865649, "uuid": "1b13bdb1-864e-4ecd-8a48-2d518e035a2f", "comment": "Malware payload (Mirai)", "value": "b3500b8760b045d3f3df09cb84329ef7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865649, "uuid": "76c8db76-8f16-492c-8c4d-02487fc3c1e5", "comment": "Malware payload (Mirai)", "value": "ba5486b281ccda1ad9ed94d8b42b45a2e836a5a394a064f83de313e8549f47ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865649, "uuid": "4ea94b45-15d3-4a1e-9226-0005c204f751", "comment": "Malware payload (Mirai)", "value": "9ddcfe4205c734d9adeee2f819a56293babab2c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865649, "uuid": "20b41f33-d298-422c-b435-a86564cf09b4", "comment": "Malware payload (Mirai)", "value": "a6dbb89b61d55f0f331bbddf8dca768a8e2d1a596fb8d9cb851ada6a2e8cf15bb56192688d3f964cc267233eef542bb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865649, "uuid": "65217513-c1a4-4632-9dbf-179cbeb3d478", "value": "T132733B12B3F8172FC0B0A57880B72B137FE95A9A0960E68FBD754D8ADD532D406277E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865649, "uuid": "0cfd8d26-3a60-432d-9b36-c3feb00a7a5e", "value": "1536:Co3qYd7ctGN7n9SuVAWEOj59rPD/LSUzjLjlLiwe40QD2tBMLLJlFpUge6exI7:Co3qYegBlqOrPD/LSUzjLjlGwPm+LnGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764865649, "uuid": "d0d07e78-fb42-4f55-b240-059a5a709822", "value": 77228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764865649, "uuid": "8731a3f1-4310-4db9-b669-ffbf1bfa2df7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865649, "uuid": "40ab7819-7976-481e-baa3-d63f96c655b0", "value": "Polar.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c7d4eb-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834189, "uuid": "222fda78-df68-41b3-a023-7b5a767e6ea3", "comment": "Malware payload (Stealc)", "value": "f9acd6db655d44a50515a8ef95929d12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834189, "uuid": "51262ffc-2506-4f23-9b59-f16077e29943", "comment": "Malware payload (Stealc)", "value": "bb03d725eb8e8ac7008cf50bff4c15eef50559c6a0bf3ff57680f97cc9c1b0bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834189, "uuid": "5ec74286-e3db-452d-a986-2b91a7d9a45d", "comment": "Malware payload (Stealc)", "value": "ee3b33ed0e6d1ea87be3506d342784f8d1ae55e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834189, "uuid": "3cd9609c-cb10-4466-8fd0-92c54399cbd9", "comment": "Malware payload (Stealc)", "value": "7d5893504f9dab68212f76d610970ea1f410a5c5d4a4e6c15ba15ea08c8cdeeeb7cfe6be5b13d90588c753aa3934652e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834189, "uuid": "59d3e732-91ff-42a3-a593-76a9da98fab0", "value": "T1C3059D1AA7A513FAD0ABC234CA428542E7B37C556770E38F03E156B61F376A05E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834189, "uuid": "4db63d15-8801-4030-9461-b1e904539993", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834189, "uuid": "42d817ff-6105-46c8-a007-f8b96e84c385", "value": "12288:eGLVpIo/cBJ9InRPehbyv8plnEq0Zpv3YZtF15kjHqs:ekkBJinRP6bw8TEHh3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834189, "uuid": "249262cb-87c8-4038-ae4c-3e66851e9556", "value": 797952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834189, "uuid": "53d39689-0d34-4c01-9167-dcd8d3fae1bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834189, "uuid": "26bcd490-59b5-4239-b229-ca8626da827a", "value": "l03t9xk0i.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14c330f-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806728, "uuid": "0f908f5c-7f73-4556-9fff-8c7f04fe67de", "comment": "Malware payload (Mirai)", "value": "aa02c0d95385a331c33a96d289ad47d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806728, "uuid": "c8557be7-8815-4d3b-8b65-c254d749ffd5", "comment": "Malware payload (Mirai)", "value": "bb7070eefda2e6c11c3b09bb7d1e998ca11bfce2dcf41dcefa1369b5d48c6fef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806728, "uuid": "5af3e17e-bc25-40bf-83a5-14d861350bd8", "comment": "Malware payload (Mirai)", "value": "db8d07a17c1f92c7dfb8d5aa38b1a153a31d1166", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806728, "uuid": "8ceb7643-cd36-4a4d-a7bb-343c0c88aa5e", "comment": "Malware payload (Mirai)", "value": "eb2a14162c4348cd53afb56a66de2f385320d41ad6675429b22597b9f22477f7205cbaa991c915df452be361fa0309a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806728, "uuid": "a9614c12-3073-4c92-8600-45dde5beaed8", "value": "T175331A51B8C26627C2D013BAF6AE968E373073E8D2CF3227DD611B113A8512F0DA7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806728, "uuid": "576cc8ca-1d97-4fdb-85a3-0b354e860601", "value": "768:Mtn+Pi2RhlZoIip1jIs44nHsX7+qP06Fz20AVOstYSSF4Xgt2FgNJwJZY10Ux:MX2R3ZNiwaAFz20eOaYSSFGJa100", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806728, "uuid": "fe11f7b2-45dd-4246-8869-9c2dee7821e3", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806728, "uuid": "7cdd5ba0-5c61-4a54-aacb-4bebb203998d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806728, "uuid": "99c47612-7ea0-4712-bd5f-5c171a027719", "value": "uYtea.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f3bfd0-d161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764887903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887903, "uuid": "b2e17ef4-5a2a-45c6-8ce0-07a9d469aeb1", "comment": "Malware payload (Mirai)", "value": "131f4fa9b1adc3cca34e1062d4e3fb3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887903, "uuid": "fa9f19c5-68e4-43ff-bab2-90e449f349a1", "comment": "Malware payload (Mirai)", "value": "bb77b0a07a310a47af7ef0463f79ec19fd8aa6dbb887aa69e35f30bdc6346ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887903, "uuid": "fc1a7baf-8bdc-48bc-a4d0-fdab5d77ebcb", "comment": "Malware payload (Mirai)", "value": "b7b79f6b41b2cde4dad8a8b7269eea5e11d43751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887903, "uuid": "b163e477-660e-4e54-b931-d3090ada5790", "comment": "Malware payload (Mirai)", "value": "f92e48d01777b73291b7781b6245128b0a9e18bf2941c29ec6c69b6ad10c60506377e62c7fb661f669dc14b78de43ec3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887903, "uuid": "3769c71b-45b6-4c8a-8268-791c4610772d", "value": "T11B833C02F69284BEC49AC4F5C25FD527FA317C8512143A6E7790B7326EB2F216B0D693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887903, "uuid": "c8b4524d-c8a4-4e14-b014-e9d1d446be28", "value": "1536:42bcc9SAwfV9036TMaSOlscsdIQoLHxpBVorYnPxd:6X0Tazsv4d+Op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887903, "uuid": "cd91696c-9adc-439f-9f75-c584dd697bb0", "value": 88224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887903, "uuid": "354c8281-bf55-4af7-93e6-1d4a7d4325f0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887903, "uuid": "9f08ba90-7ce8-4265-9529-8699e0b32eaf", "value": "frost.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e6fe26-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764872904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872904, "uuid": "6376d880-0615-44c1-a491-312d0c0a2e70", "comment": "Malware payload (Mirai)", "value": "f9909e061449741d442ecdef442c8d6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872904, "uuid": "b654690c-8377-4c74-9686-0349fd0b47ed", "comment": "Malware payload (Mirai)", "value": "bba350be469aea182fd0d59017ffa6aa95f1c0665f4d14c1ec9ec8f90252f989", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872904, "uuid": "fd7c9604-c99d-4233-af86-0f655cb16b47", "comment": "Malware payload (Mirai)", "value": "09d364d1623a437d111374eaf49c927b4f8c7e43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872904, "uuid": "2899ea32-a18c-4595-9b08-7ed5c41911a9", "comment": "Malware payload (Mirai)", "value": "d4f7e998ddd63ea2d2c8e6d7e141719128d0af57fcf4bd8da8833a593a7e66b419b9ce7d575f48b6663329f731cd08ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872904, "uuid": "3e808ca9-6c3d-4142-998b-d4a37865299a", "value": "T1CA04D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872904, "uuid": "56400111-e0a2-4f22-8fdb-c9a3adf0596a", "value": "3072:ueEksFM+wX5OHaVR8H3NaMZOTTMJxt9U+7fKbvE:ueEnO+wXbVWdaMATwJHy+uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872904, "uuid": "c75c3f2c-cc43-45c2-b42d-c2bb1b900c88", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872904, "uuid": "6894d045-02a9-49bf-bb4c-40911ee47fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872904, "uuid": "5e206c2e-9632-47e3-b4a5-f589f078ee0a", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff194623-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764834669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834669, "uuid": "dc3f442d-b089-4f30-b9b1-e8bd4d05f189", "comment": "Malware payload (DonutLoader)", "value": "17b5184697aa315084eabb7d7d414733", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834669, "uuid": "10811ae1-a728-4482-91a4-8b0cfbfdbf91", "comment": "Malware payload (DonutLoader)", "value": "bc64c13545032d1db5f783a9972eace89449a6c331ae86e45edf25f2c3e20ec3", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834669, "uuid": "4409caa5-5c18-4805-929a-b56f83c95114", "comment": "Malware payload (DonutLoader)", "value": "dcbe8c1b7cf2cf97b11bcf0c213b1405d06f4b56", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834669, "uuid": "2366bd57-7ff3-41f9-84fb-c170a2ce9e55", "comment": "Malware payload (DonutLoader)", "value": "858c52653b718555270969f0203efcee8b75264fd46719a2382011677a51f15b8629dd22b989b491c7111bcfa77aa823", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834669, "uuid": "96c799d5-3572-4b51-992b-e59696b9dd67", "value": "T11FF36C5773A820F9E077C17989920A06E372B87657619BEF03A0477A1F376D09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834669, "uuid": "d2a6e90b-cd92-496d-8d04-f4b02c349a13", "value": "efeb5d2e785b956a774e5a38aa6509fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834669, "uuid": "37ffb188-fd82-476d-a795-3e8bdc1da5af", "value": "3072:uDNnXHDSLs+FF+gXWrzDwFakFPixQO/VH7H/1JSA:uDNXHD+zdAqaYSHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834669, "uuid": "439a172e-fb6b-43cf-a8aa-5b12527ff21d", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834669, "uuid": "76850ebe-21b8-4923-ae48-18ea88cc0e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834669, "uuid": "4d2ec8b3-2f0d-4dd0-a251-d715f610fa20", "value": "FiVEMod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ef74cd-d11d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764858704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858704, "uuid": "ddf26a64-a7c8-4f3c-b33e-c148db2fdf48", "comment": "Malware payload (AsyncRAT)", "value": "7f52fe52dd644fca6b55cd6f91b0515b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858704, "uuid": "fa971abb-39af-45fa-a16d-6ce3064b3264", "comment": "Malware payload (AsyncRAT)", "value": "bc790079efa258b16a7860e1ac26ca1d803c3107452cd9c8e0a9d6fceaba24a3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858704, "uuid": "e23cdfd7-8752-4522-89a4-a9fc222f96dc", "comment": "Malware payload (AsyncRAT)", "value": "3aca781daf10274ecbb8253be865696702ede1a6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858704, "uuid": "a78dd779-468d-48ff-a55b-f81982b6bc0b", "comment": "Malware payload (AsyncRAT)", "value": "07836ca4a85c38035bccf1c14b552ce5341662a9b1005aff0067fb4bc3ac58171192b82bd2a1686ab481e572bd26751f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858704, "uuid": "31a06faa-ede7-4f50-aa5f-9222b50c6461", "value": "T111256C7BB1219FECD0CBC5B924E396E12F307C340AB6128652CA131B5E7AC542E5D99F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858704, "uuid": "b0f42612-5b3e-4830-8dd6-8370495b0443", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858704, "uuid": "aad1a0ec-5291-494f-a114-1f1f4658ef07", "value": "12288:j0UZ8/andWqdpPqstx0NglawxokOaMxi9avDzPWjHyvYQHd+c4vxi7diDx18yMNJ:sstbokJMxqavDzWLyvt487diDx1NG0iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764858704, "uuid": "d6f4e64d-bc92-40ce-969d-6d504a2437eb", "value": 1011136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764858704, "uuid": "173c94e2-cf99-4c74-9cb1-5b21f05ae367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858704, "uuid": "54c6a9e4-a317-4fa1-8758-f8d67e7e3b71", "value": "64th Service V23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c9e0d9-d0bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764817930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817930, "uuid": "1135d5be-88cd-4a5d-8516-2745273bcc45", "comment": "Malware payload (Mirai)", "value": "acd9a9911bf49dfda6fd48cd3c7780a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817930, "uuid": "d1c957b3-5925-4f5f-836f-5a8c4286c6ce", "comment": "Malware payload (Mirai)", "value": "bc89a443a2047209f395323007cf7fde930321afc2cb4355b2a0dfed40c057ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817930, "uuid": "ef8a1489-eb66-4329-830c-bb30ee878940", "comment": "Malware payload (Mirai)", "value": "a36550435e94fd22525aa4d43fd1a217f2e61d63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817930, "uuid": "347e61f3-5154-4ca2-a5ee-434dabbea5ce", "comment": "Malware payload (Mirai)", "value": "87fedf4bdcc679659eb50ecfbc2519e25b567c5a1a508478694e242379c853d49ef5ed373e532069dc1d958c1a6f295b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817930, "uuid": "7660f303-b618-4b50-b155-e787d05c57cc", "value": "T1AF435CC599D3D9F8DC260A712077EB738A76E87E2018CB93DBE86432AE52603D51735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817930, "uuid": "4ff1d8af-e9d7-48e9-a567-4873ecf6844c", "value": "768:+Dj3isVB3f72f8MDy4BFvIxhqEI07/EyYeM1npyUf5xxPRoxa5O31kUcX86tSmM4:+DNBv7Q8Mu4BFQxqpLPnOWyyUcbtSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764817930, "uuid": "fd1df43d-43cd-40a2-bcd8-e5f89bd92fae", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764817930, "uuid": "c3ace7da-03f4-4160-9a58-941cb4b7b409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817930, "uuid": "149191f1-249a-40dd-8da7-24c00aed5e65", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd02e85-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816762, "uuid": "98b145e9-32b2-47a2-b6fd-090f68afac98", "comment": "Malware payload (Mirai)", "value": "16ba0224032da2bf89d6e80a0a791d8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816762, "uuid": "8ab5a376-c1c0-4277-9ef9-06b1bf46c840", "comment": "Malware payload (Mirai)", "value": "bc93a084cbce9e1c72d7ff7b4fcbe4958d181f61fe11fbfdafeeb16028b87d0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816762, "uuid": "4403a129-2eee-4c7f-a429-93f0714ee34a", "comment": "Malware payload (Mirai)", "value": "585de2c97c221ffeda16a671b7dc4c04369e5b43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816762, "uuid": "31d1412a-96bb-4032-a8de-8774035aa447", "comment": "Malware payload (Mirai)", "value": "27db4e7ffc8a0ca26974123ccee56cde1461942dbde6f7a77776cfbcf88e1184bdfa4dfc43af86af581bec4474532a72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816762, "uuid": "5b4a0241-e4e7-4a44-b4fb-03ac596c7328", "value": "T1AED3F646BF210FF7EC9FCD370AEA1705248C951A22E97B35B530C828F69B25B15E3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816762, "uuid": "59f90f7a-254f-493c-9d35-52b8545a4700", "value": "1536:QyNqViP5Y6IeeremuWpQ3DGiFjbOr6Jl7xy6GVjZ67MtmSNAtE:QydY66remuWpQzGsgH6CjzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816762, "uuid": "6671d7be-3f78-4641-be2a-daa16f41e907", "value": 130240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816762, "uuid": "2c35d841-948b-4e9b-8588-5ae9ac4ea281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816762, "uuid": "6ff29aa6-f1b0-491d-9822-f78ff8a7cead", "value": "UnHAnaAW.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d85821-d167-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764890105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890105, "uuid": "897f8a80-fd9f-44a8-945a-42434a3585ef", "comment": "Malware payload (CoinMiner)", "value": "91e370f7cf6ebff92abd28b1414afbdb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890105, "uuid": "9ec7f3d7-07a8-405e-8fa2-4c5507819777", "comment": "Malware payload (CoinMiner)", "value": "bca26771b9c277eb8babfaf06af7dae3f8b063b1b91b090691bf69d265dc0ff8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890105, "uuid": "97ccb315-4979-427f-aefd-faeff11360b1", "comment": "Malware payload (CoinMiner)", "value": "83e95acf5769015f0caad7b11a884bd3157d51b9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764890105, "uuid": "bb1c5bb9-e5a8-48ea-add5-23d2f9c2ffc2", "comment": "Malware payload (CoinMiner)", "value": "eb33514872319f51d2626f99f7325ae617054b6a9b060adcb7916227d8be3549a175606826cd46ffde16650f22f53e24", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890105, "uuid": "8f7314cd-1fc1-4e19-a6bc-bdaee407aebc", "value": "T179F523277573F46BD4494D79C03ADA5812BCFEA8A1EE236810D59E3DBAF0973C015BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890105, "uuid": "1ab582c8-99c5-485e-ab38-3667bacd5bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890105, "uuid": "5feef01c-d93c-4874-8134-f74142076899", "value": "98304:ZLkNx3e2oPHHY89aqYoHewlj3E2FdRPjHx8mhGUcHt84E:mNsPHeo7ljU2FdNHxrToQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764890105, "uuid": "e691156e-658b-4f99-93e1-b7040f5f23b1", "value": 3552768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764890105, "uuid": "2cf3f85f-6b52-4575-9781-9a40fa745b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764890105, "uuid": "d6e8c26d-34ab-4dd7-b985-e7caae69fb20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d20912a-d0d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Hailbot)", "timestamp": 1764828492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828492, "uuid": "826107d5-9a88-4bf1-9fbe-fe9e4285052c", "comment": "Malware payload (Hailbot)", "value": "e3a15791103d04ba4e889d00552ac58a", "object_relation": "md5", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828492, "uuid": "c34a61a4-afbb-4118-9175-238a7ab39b11", "comment": "Malware payload (Hailbot)", "value": "bd10e476c99be9da71757f887c74279353939b532757182e8cc6f0e387ba2573", "object_relation": "sha256", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828492, "uuid": "b626cdcf-30f1-4533-b27a-d907b6a468d6", "comment": "Malware payload (Hailbot)", "value": "e5913e55673dd212b30831cce8b2aaab6077c738", "object_relation": "sha1", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828492, "uuid": "e79c1546-be5f-4cfe-8b6e-f805a77f5684", "comment": "Malware payload (Hailbot)", "value": "13bc7ff4deba92c62938f073bffcb038ea94a9562fb6b6c0951622dd979626bee0748be2fd4446c3fe64ab378cc56651", "object_relation": "sha3-384", "Tag": [ { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828492, "uuid": "3fbe6079-f782-4b45-b2bf-5083d5a594c0", "value": "T100D097EA2467003BCD48CFABD37310E3358AB092A82072CA3133C312DE6C3A07F0A184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828492, "uuid": "98cd540e-723d-405c-96ec-17e9324c965c", "value": "6:hx6eGrl49KGKwz8JnoafaI9uN5tKKuNYRmJLn:nP9MJoaCEuN5tRuNYRmtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764828492, "uuid": "129107f2-ead1-4dd3-a4c6-70bb75f05dd2", "value": 248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764828492, "uuid": "b7f07bd7-da70-46ab-871b-83c0a4b07934", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828492, "uuid": "82611cbe-5580-422d-87e9-a2b6e1d116b2", "value": "ssh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d052138e-d0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764839744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839744, "uuid": "b7534a86-f2fa-4569-85bd-ff2feedab735", "comment": "Malware payload (Mirai)", "value": "b9422b31442f6f069d746b023018d4ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839744, "uuid": "462c0b31-ebb0-47c3-8fc7-d9f1a975fe7e", "comment": "Malware payload (Mirai)", "value": "bec2c0bc441a2bfa00c23d9b29a14f47ce595b16b8323261829b6998077fd736", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839744, "uuid": "9e9ef747-b8d4-4a33-83c7-b5fb8b69baf2", "comment": "Malware payload (Mirai)", "value": "0168d0b8a78fe265c619e777a1d8dc4bcced20a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839744, "uuid": "e9c3d7be-590e-421e-b1bc-a9d6ab92637b", "comment": "Malware payload (Mirai)", "value": "ab985f82eec6fb34dba50e07c0e3597e98481b5e67c6254aaeeff501580143f2fab6ed4ee968b7c948be0d7906d07e47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839744, "uuid": "bbcf457e-5bfb-4372-af61-76dbee97930f", "value": "T1F424C50AAB610EFBE8AFCD3706E91B0125CC641722A93F357674D528F54B54B1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839744, "uuid": "9102caf4-fc5f-4ca5-8bb7-c7103e04250e", "value": "3072:kdzYy+mPyyew+5Ns5l/mJDAt6YYWkFHy5ZPd3L7mbPY3ueB8LxvbitZ:VvCR+NskAt6YMy5Z177mbPY+Ekjit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764839744, "uuid": "a27c5ba8-d109-4ba2-b60b-bc714de81bde", "value": 215268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764839744, "uuid": "1eb84a0e-46e1-46ce-b6ed-92e93c9b19e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839744, "uuid": "11a5d39d-2eb4-4576-b0f3-b042ef56b154", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2887e6e-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883100, "uuid": "8488e0dd-36d4-4307-8b74-c75d73b17510", "comment": "Malware payload (Mirai)", "value": "a26c3914aee9644c68a310283c51d4aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883100, "uuid": "3551a16b-0b66-48a4-b391-649434789dd8", "comment": "Malware payload (Mirai)", "value": "bed85d14ef5d06d114ccb164443e41d7a22c05341f6bc8e0604193d6fa6396a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883100, "uuid": "4002dd85-b61a-45ab-bbde-6ba711c31c26", "comment": "Malware payload (Mirai)", "value": "06a5f68fd0c88c8dce09d1a4fa7240bb32f90776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883100, "uuid": "4b51b465-4d2b-45b9-aad4-a7ed463566dd", "comment": "Malware payload (Mirai)", "value": "4aed8c4baff11c52a8e19105d24bf1b3177a49e3cae11f483d2370328fcc95454d8ecbe7038d550a48b4737132894105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883100, "uuid": "003869b6-3b0e-4290-9bd7-0acd4bcf1302", "value": "T10A247D81F643E1F6DC420575206FAF364E33957E603BDE42E7ACDA32AC1564292267EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883100, "uuid": "6de9b1f9-aadc-4a86-9534-0613da200760", "value": "6144:6CIpAgm4Gikn3Tj+zZAue4US+/ExqMqcbW:6CITm4GiknOZnKqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883100, "uuid": "321dda83-6552-4bcf-881b-7abdbdaf00bb", "value": 212232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883100, "uuid": "fb8925dd-7eb7-4dc9-ab77-8fc2c5c06448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883100, "uuid": "d4c52a99-463f-440e-bd9d-39d8f243805e", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b390a81-d0dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764830475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830475, "uuid": "d2719138-209a-429c-8e91-ed315f5c056a", "comment": "Malware payload (Mirai)", "value": "5d44fad506b1d3c9b5faee8a841b55a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830475, "uuid": "77f1e946-af14-41ed-af0b-03b4078b19cb", "comment": "Malware payload (Mirai)", "value": "bee4797d9b740104916ee35b6f8affc363971cc85da1aa97146e25c3aa84dfc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830475, "uuid": "013cd16f-0d23-4ef9-9e98-22bec34e46a0", "comment": "Malware payload (Mirai)", "value": "d94bf6cde5696717af0387b15b85bc313872c1c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764830475, "uuid": "a9cead9c-6424-4599-a06d-98328aab5db8", "comment": "Malware payload (Mirai)", "value": "2575f74f10a25a4bc7c50c501b15f24952cbcb689b5bcdb6ad892d4208d230a1faf30f49c7160373ae7e36d391b0a5a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830475, "uuid": "b1d852bc-9483-4b62-97df-727cac9a499e", "value": "T1CE445BC7F803C9BDFC0BD676482F0909B530A36105536A37B397BD66AC3A0D65963D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830475, "uuid": "6873634c-3467-4d04-ad91-8c98c776bc55", "value": "3072:dPu3V71l6WARUQUoTcJS7qZgYYKAWySaFXVhMeX8HsqEyO2/iGVsjbiXLy/xzku3:s3V7T6W+MBySuXfMC8a2/isLkxArYaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764830475, "uuid": "87a47922-55e7-4b74-b6f0-0d775b4cdd6e", "value": 267680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764830475, "uuid": "48bb2e10-5ac7-4cba-ac7e-bd2c904adf8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764830475, "uuid": "dc1937aa-21d4-4381-b18a-6c18fcf3bdd1", "value": "ecco.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e03fc3-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764834623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834623, "uuid": "13add5c5-5a1b-4ce4-a2ac-8e292ab220eb", "comment": "Malware payload (DonutLoader)", "value": "9d30dae891064d02db909a35fb1ae1b3", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834623, "uuid": "ebc8362c-ad8d-4658-9a64-92f2072b78a6", "comment": "Malware payload (DonutLoader)", "value": "bf9bb4e96fcb905e1a90c89388bf931829282ec8dffab7f7adeaff850940eab0", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834623, "uuid": "d8cbd24b-952f-40d7-b09b-99eddb5ffcea", "comment": "Malware payload (DonutLoader)", "value": "ddb9041ff5f4d5a17be4c01a51a2957c4d555f77", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834623, "uuid": "635dd567-75c7-4e67-b886-60a2d856c20d", "comment": "Malware payload (DonutLoader)", "value": "202125e90d2873eabe4a8c5f96d9d307923c73378dac18dc90ea7860f47dc21c658437e19ba4ca672443690493c9b05b", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834623, "uuid": "3c7fdd5f-41d2-462c-952d-d9b6177c821f", "value": "T19A548D15BAA810FEE977C17CC9428906EB72BC464761E7CF13904AA62F277D09D3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834623, "uuid": "780a16ed-8145-4e85-acea-0be8ea6949a3", "value": "53e19d5243b4f25d48df742c8d94ac9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834623, "uuid": "9e91ba36-03f3-4de5-8214-3eccea4716d1", "value": "3072:ofRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OlmCxFUq:ofRbGY6EDNNAuHe28Pl2ncxldRR2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834623, "uuid": "cf5f1254-3eb3-4830-a5f0-eb92f8a9b966", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834623, "uuid": "30d67829-5bc5-4723-9226-df1ab5f7a210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834623, "uuid": "854710dd-efa4-4615-8e49-cff017003f9f", "value": "EasyWay Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c04ff8-d0e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764833600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833600, "uuid": "0b238540-b1f8-4805-99a2-def0ea6ef024", "comment": "Malware payload (Formbook)", "value": "c21f86ac794dcd6e3b03c5e41e6b6cd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833600, "uuid": "3ad1baba-2295-4783-bdc8-3cff50ccff99", "comment": "Malware payload (Formbook)", "value": "bfe8597cf704cb576063e7883146c8af4f384521ddc1ecb059d91d58480bc265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833600, "uuid": "9f88294b-518b-451e-9e63-759b6f71e193", "comment": "Malware payload (Formbook)", "value": "aa35f7241b5518223cbb5ba8f33e735833725e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833600, "uuid": "c7f8a257-40d9-4f0c-8e69-7203db961ded", "comment": "Malware payload (Formbook)", "value": "4d03d1f114593e4622d9b119dcd8c972dbb23cf67faaf721e5dcd7c6910bb25df0080e328e64d85191b09a543bce0460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833600, "uuid": "89899982-c1fa-4cf0-a8bf-d1e1415819fd", "value": "T11BF412107569D917DAF752F408B2F23083BB6EAE7412D3D18EEDAE9B74E9B101510A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833600, "uuid": "8185dfe5-3875-4f20-82e6-71cac71e3209", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833600, "uuid": "a6f4a071-7938-4473-849e-2df85252de3e", "value": "12288:yPdiov8xzHu94dzCFnaDRUiiNoIrC1lwiUGjW/6pwf/+06Ldfz+Pv+igh8kovga2:yPdioEYmGFziimIrONjW/Dfm06lyOFqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833600, "uuid": "aa440cff-f874-491f-a679-d9368c55af4e", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833600, "uuid": "c9095ef5-e3f8-45a0-8eba-4808966628ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833600, "uuid": "0dae5cf2-d217-43f2-b7fd-77e4c7fa796a", "value": "Request Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c3ce01-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807035, "uuid": "f08188e3-6dc5-4bde-ace7-3f3b18e1eab6", "comment": "Malware payload (Mirai)", "value": "cba2757581890f7e1279292444fc1dc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807035, "uuid": "72ee9450-d6c1-4918-8d5b-8066f536235b", "comment": "Malware payload (Mirai)", "value": "bffb99821e0586bc026a5b27baa9c48123887c553aafdd31857a58e9ba352528", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807035, "uuid": "91f62dc1-e7eb-4894-bb7d-0b83f89e64f8", "comment": "Malware payload (Mirai)", "value": "5bf628533e60a7ca277980eda9ea4947d2338335", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807035, "uuid": "f7c21ac8-8ff1-4ee5-b859-2ccb0db74934", "comment": "Malware payload (Mirai)", "value": "cd3be2b972d5d55f6660ebcd38036cb10a81a422247a58a6b224e1f27407092d2109ef6ee2c46a5bd207b12bf7719ee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807035, "uuid": "0b59da35-27ec-4557-aceb-0ab8df1bc8af", "value": "T1E7431917F94685FDC089C234177EBA3AE92331FE1229B26A67D4FB263DC6D611E09D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807035, "uuid": "abcf2009-8a2c-4225-b470-e021c71c2715", "value": "1536:1XIY73si3qEToSRhINVQ/K6C8u50pfEHwNLW:2Y7H6ETRhIc/Kn5qEHw1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807035, "uuid": "ff964c52-a46a-431e-8e35-de26fca29fe0", "value": 58480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807035, "uuid": "568eaeaf-01ea-4ceb-b2ff-82429837913d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807035, "uuid": "0fcfc2d4-ae13-421f-991f-1d8d37ad4495", "value": "uYtea.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a910a705-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807037, "uuid": "78ff7d78-5931-400f-97ca-6e3c2221f6d7", "comment": "Malware payload (Mirai)", "value": "dc1d0a53bb72a64a5b84047411292c8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807037, "uuid": "3f84371b-e0bc-4559-9dcd-5723899d8d6c", "comment": "Malware payload (Mirai)", "value": "c0fb75e87b4858f58624d81cd59919647ff6bdd5c8d6632d4acebe02126cd7f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807037, "uuid": "52aafb46-5d39-4d6c-a66d-7b1222b89be3", "comment": "Malware payload (Mirai)", "value": "31e7349e6aba551316be58ee41a8564e89a1eeaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807037, "uuid": "6b05cb5c-6130-4aa5-8e0f-ec157976ca0d", "comment": "Malware payload (Mirai)", "value": "28103602511f70ffc5d593bdfb4e0b4061075d6e9f6356d536d69f1ccd274320df098d044af1b98e3a0946d21bdb1673", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807037, "uuid": "18e05f6c-a306-4bc3-8269-78a3441d28d4", "value": "T1B5631B95F8818A21C5D5137DF92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807037, "uuid": "58734200-15c7-4522-92f2-78b07bdf39c3", "value": "1536:hgnAkIP7B9stYVenVQmPct8URqOSQHMgimu2aa7LLJa10ft:ZP19st6en6mPcEku2aa7LL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807037, "uuid": "d5c542ab-497b-4893-b7a9-872f6cb3fee2", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807037, "uuid": "f2817db5-ff92-4d59-bdcc-83652487d332", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807037, "uuid": "998d094d-16c1-423d-b39b-c06abd78646e", "value": "uYtea.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6d6565-d0cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764824945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764824945, "uuid": "3996d8f7-35d3-48b8-8f42-68a75246ccd1", "comment": "Malware payload (Mirai)", "value": "fbc810fcc2d5f66b651b0266d06fb4a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764824945, "uuid": "a19f8d43-c29f-4a03-9074-c80582a16e17", "comment": "Malware payload (Mirai)", "value": "c13c619bb3beb9caa94910facaaa8b7947f06e475277a0cab0f0729e6e56df0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764824945, "uuid": "7e27a1d0-0e4d-4990-8372-5fa35cba12c8", "comment": "Malware payload (Mirai)", "value": "e47152bacb502cac93311caacc25fa8bca24f24b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764824945, "uuid": "d9236c4b-9e0c-489c-9c94-d4b4ab52c9b2", "comment": "Malware payload (Mirai)", "value": "72b0bf27f0f64179a777fb30af494801db7a829e7e4c51ec4664dd7f57d044989870502a51f1452aeb47c6ad8b83b389", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764824945, "uuid": "6dca76c2-24c1-4786-94bd-23ee6ba26f1c", "value": "T1DFF2E18619784108C57E117A0C67BD8D88A089B8C5BE85F24BD8F823E907FDC756879E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764824945, "uuid": "55f99508-3f0d-452b-9540-8ce71d85dc92", "value": "768:vCkGi0D/4BfI7dZnRh7/IN0BIesyoXKot5V4oEAIpUMnbcuyD7UHQRjL:vBGbyqhXrTBrQX4oEyMnouy8Hy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764824945, "uuid": "65a83d99-90b0-42be-a92a-4948c5380ad0", "value": 34912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764824945, "uuid": "c71c50e0-c5ee-45b0-bd3e-577c56fd3fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764824945, "uuid": "bce9b0b4-21f1-44b6-83c1-ae3e40301c82", "value": "ub8ehJSePAfc9FYqZIT6.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2a6e4b-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764880865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880865, "uuid": "2775d120-4b53-4308-9292-d109d4aaef33", "comment": "Malware payload (Mirai)", "value": "f522df837fdbca5bcda3edb0224d07bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880865, "uuid": "73b08399-78e5-4f32-807b-c9aacba593bd", "comment": "Malware payload (Mirai)", "value": "c17656f7f99a95ce8ca3394c6551f638035ee5e46f699dd6692fb87704ec2b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880865, "uuid": "c89a9d12-ae39-44d3-9118-04b135d8a6a0", "comment": "Malware payload (Mirai)", "value": "8f83b6362da0d8d13df3da1b66e18c91849898ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880865, "uuid": "2eef4f60-4c99-4805-a4f5-9afbec8aebf5", "comment": "Malware payload (Mirai)", "value": "f2ba2210528da1de7aef8b0657e8045c25c9e71683bab47e6fc165751294c1628f60c90b9494281ea7b1ae3c8089a2df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880865, "uuid": "2c64e271-a120-4baf-a5a6-76c67d629fee", "value": "T1D4237CB198FAADD4D148C674A9248A780B53E402C6472EF95A4AC356504FFFCF62D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880865, "uuid": "db6d50df-e63f-4b07-b503-be615afa6c54", "value": "768:UaKtUwth8ANVYhxneqCBvV9grHnl/fLiMd7/qBDCIm4owE4JCriAm:UaUUwtO1MErHlXB/qBDewBJCri1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880865, "uuid": "b895a848-48b8-46c9-a3e4-4f40535fec8c", "value": 48784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880865, "uuid": "996bd964-5462-4ccf-9f35-93ffaf4fc7d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880865, "uuid": "286e2b60-8af0-4367-8665-a339432a6393", "value": "DEMONS.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c721d5-d117-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764856121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856121, "uuid": "6c803f8f-0438-4a9e-9de2-03dc480a2fff", "comment": "Malware payload (ConnectWise)", "value": "d6f9b4f573a344a14c5f59388162a132", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856121, "uuid": "24eca525-c0b4-4af0-81c7-4fbd4caa12ea", "comment": "Malware payload (ConnectWise)", "value": "c2839f89110a4945e8228e51bb1179f7fb8dc577d5ffd568516e0848b9044540", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856121, "uuid": "47f467c5-2358-4cd1-9364-d304127e7e35", "comment": "Malware payload (ConnectWise)", "value": "b6fd04ccf24cc565d29ae54e2343b3b96b897cb7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856121, "uuid": "2835e9b4-3658-4d6e-957f-db4cd075c2b4", "comment": "Malware payload (ConnectWise)", "value": "b6a57f6ea19179e0cd8876c9d20b524fd41f3c54ba2ecfe8744bd479cda542ffe6be7d007c0a38497845782888a44798", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856121, "uuid": "fd90a56a-6830-4a26-b66a-6e35d19b289c", "value": "T1CAA6233662E4C026E2B71E39E9794AF25939BC468913C15F533C794E6871E81E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856121, "uuid": "1ca519fe-12f1-40b8-9545-e47720ad6597", "value": "196608:v+kLGB1E+Z3/R+kLGB13+kLGB1Q+kLGB1:2kqB2FkqB4kqB7kqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856121, "uuid": "fbcb3cab-0c7f-498f-bfe3-347f124754ed", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856121, "uuid": "bd6e10de-0c09-4578-bf95-78922f3494a8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856121, "uuid": "8ad583f3-d93c-40ae-91f7-c1d4946edacc", "value": "13VipInvite1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4640a4f0-d13c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764871725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871725, "uuid": "ba3cff26-babf-4422-91e1-89c6cd638c9f", "comment": "Malware payload (Mirai)", "value": "25f9c968ec9ce7f1d05c8a1cb5b64337", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871725, "uuid": "15c08da7-a675-4f47-9979-013985b238ae", "comment": "Malware payload (Mirai)", "value": "c3498748d4529d34c54b4f00cf321b17010aa524e990e430cd99fd147130f40a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871725, "uuid": "0fb1baa9-9839-4e42-a241-c2fe76ee20fd", "comment": "Malware payload (Mirai)", "value": "acc720b34d96b23876909514cb01d0bfe087eadd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871725, "uuid": "8f1951cb-6542-437e-8005-0472a0226315", "comment": "Malware payload (Mirai)", "value": "88485b6703dfade5fb96b0c75960a2c4e4a7153b6ff31f0d46a67ef29af824fe2d487717e74bea9f6a73a2a9dae53e58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871725, "uuid": "9b9481a9-c356-4ebf-8042-66c4ab02ef3c", "value": "T1CA23F19A5CD2435DCEA5403344E9ABED3E04C9AD8A6219D31EA03D7FD052F6A95CE390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871725, "uuid": "4015d2c8-7a63-4ce1-9eb6-67444d0bf05a", "value": "768:2MJF12asZhmYcjJFWEi+8EEQG4bcTr0YJEXKJctlwTV2LSueh+hDpdLJKLWWXyZk:2/jZhmQfEPGr0HKOYhNutKLWWXyZUNOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871725, "uuid": "159a1966-9cb7-4150-8f3f-1ba096175093", "value": 48248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871725, "uuid": "fea4b62b-adb3-4964-8f2a-9b27b0513627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871725, "uuid": "003fe5be-a065-4006-b2c2-2ce03e118030", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742c7a64-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764831000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831000, "uuid": "dc9592a7-d64d-4e15-9c61-fbc877d93401", "comment": "Malware payload (RemcosRAT)", "value": "2702687002c84382d69c3e9942b484d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831000, "uuid": "f9b0d584-ba33-4963-acea-c2b925bcbd22", "comment": "Malware payload (RemcosRAT)", "value": "c3baf753f45454f23d2665ab0921e1087cc40c17f2a82f0a086a31425146d930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831000, "uuid": "6eedd775-d48c-47f7-86e5-6872a8090b6d", "comment": "Malware payload (RemcosRAT)", "value": "19175d02f8a385973d1417d227a487be65359450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831000, "uuid": "2ad98b4a-276b-4c02-94f5-f0caf26c5245", "comment": "Malware payload (RemcosRAT)", "value": "c33f56554ec94c274441c479f3c6cf820e9fb0802464195dbdb82c07a32366fc376388a0216bb1bf1e607ee3318beb9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831000, "uuid": "c812784a-ad1b-44db-988a-71fe07e57031", "value": "T1DF941225FB61C477C0A2073119B6FB7A3BFAEC3652A5091307607B5DBDE43876A0E182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831000, "uuid": "2f2ee972-14dd-4492-b075-0fc795b7bfc9", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831000, "uuid": "1292797e-a862-4f8d-894a-c6ee75de25b8", "value": "12288:IbYSM13bjtdTLbEVayaZSEB2DCYpMS2GUm/:IbYSMdnttQalkg2DRM190", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831000, "uuid": "3e55fc29-fa1b-4bbe-817c-cb6e7c4ae00d", "value": 409000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831000, "uuid": "19d48c52-31a7-4dc5-9482-9cb120b3a8bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831000, "uuid": "357e1d81-760c-4f7b-91f2-ace6889047c7", "value": "MAESTRO_BANKSLIP_BWE0623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a11232-d136-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869437, "uuid": "c062f606-6652-4d0f-96db-84392c5d0c11", "comment": "Malware payload (Mirai)", "value": "3f2fdcf235129501b4e734013fdd4315", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869437, "uuid": "0d1edc76-1855-4586-9630-58e79aa3a45d", "comment": "Malware payload (Mirai)", "value": "c47c7645b1242d42193bf15b84639d3254e69827b6d05ea1bd687839951bf890", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869437, "uuid": "b947e1e6-c0be-4193-81c9-188265330a4c", "comment": "Malware payload (Mirai)", "value": "6498039366ccb3d5803b00843cf371f2122bbf08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869437, "uuid": "2f5aed0b-a5c1-4a34-9d94-ff128691aaeb", "comment": "Malware payload (Mirai)", "value": "5e563e50308de2306feeab7d1289d92e09a763a84d426eebc07e553c27fa9ed7ebf357913fd254197ab5416bcfba1aff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869437, "uuid": "a2467444-b3b9-485b-879b-e109e2fa3daf", "value": "T194A32A56F8828B22C5D512BEFA1E118D331317B8E3DE72129E205F2077C696B0E7BD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869437, "uuid": "861b203a-aa65-44a8-b7ee-a56a7eaf1de2", "value": "1536:dHnma2wfW/bfiGdLqHjC3PU45GjIZiY+garvVYTfuQr5MsQiAw60pZor7kw58YJz:8FwfKfVdLLh4Y+garvmyw1pZorwwKoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869437, "uuid": "82be9a2d-94c6-446c-93bf-ed3bbc08bd88", "value": 101092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869437, "uuid": "d3d30f23-a382-4989-ab61-3d4cfcca0f97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869437, "uuid": "7644fbe0-0cb5-4f4d-98f7-ae73ecf16356", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d27bd53-d0e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764836142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836142, "uuid": "caca7c1c-5993-4c1d-8ecc-01d1a65a0506", "comment": "Malware payload (Mirai)", "value": "54c56d302f06625aa0dfe966bd4d066f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836142, "uuid": "4e26e1da-ad00-47d6-96d3-4063ffc62d33", "comment": "Malware payload (Mirai)", "value": "c49b1434eeaf080d1b7636f4254f6cfacc7a4c282b3111bfb2341b4afbb24131", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836142, "uuid": "c1206cc0-25ce-4402-bd7e-68e8b7e3dc42", "comment": "Malware payload (Mirai)", "value": "f61758aa60213421b79e07bc89c1a0fa4f58b967", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836142, "uuid": "96f64346-6d68-473f-ac80-e2b8c984f2f7", "comment": "Malware payload (Mirai)", "value": "cc3803ff2aecde75277be80b499c86aa7a144d7278c146ac51a8dff2afe2072b05d2a08f5799b8ea182f357a3ce1ec3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836142, "uuid": "b8f9eb0f-07f4-4e9f-b633-e0eae85d18b1", "value": "T1312329017982DABBE44317F182E78B211631F93E2B528D0AE35D7CB4EB1B184B25376D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836142, "uuid": "e7c40933-9f5c-494f-90bb-5d2c785161ac", "value": "768:2F5E/Z38p5XmrDZWrvLHys+a4PZJLOGgvrBNIue3:2F3reYrjHyha2/NgvHe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764836142, "uuid": "7cb67029-7593-4f4a-b0cf-9fe2e4f46012", "value": 49361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764836142, "uuid": "c80946f1-219a-4c05-a761-bb1b0483e04b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836142, "uuid": "62d9d2f4-0ac6-4c29-a8d3-a8e32af2cf94", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b61e01-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883055, "uuid": "a4529a58-ace3-416f-a521-a04c0def4a75", "comment": "Malware payload (Mirai)", "value": "4b88e02331241edc4c95270026d0c4ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883055, "uuid": "1af4ab14-0341-4af6-a74e-5710933f658b", "comment": "Malware payload (Mirai)", "value": "c4a13c52795a52494bdc3d7e8d611dfadbc766649761d97088ecf3804a2b253e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883055, "uuid": "4e2f7351-64b1-487e-b567-17fb3a447386", "comment": "Malware payload (Mirai)", "value": "e660e3a4b2801c26970c4d5993469a545e6690c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883055, "uuid": "39dd4535-c924-4d42-8134-a272e341533b", "comment": "Malware payload (Mirai)", "value": "7f47310040cc59787e9d29269011297b2c2e95216f1b92b34ca39bc5091dcf705260ed58b28f61b9baf65039f632c69e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883055, "uuid": "29d1181f-81f3-4a1a-a966-95fe7ef31ce4", "value": "T13F446CC7F803C9BDFC0BC676482F0A09B970635104535A37B397BE6AAD3A0D65927D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883055, "uuid": "46917fa7-f009-44d6-b3ff-3e7a4e68a103", "value": "6144:9im4SGXMwrbeNyCVvy4jadJutBL5H7kaE:9i4aXdUPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883055, "uuid": "110d818e-7bcc-4eaf-b3a0-c6368df013b7", "value": 265824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883055, "uuid": "b994cc55-8c58-4e43-ae67-2abcc7825acd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883055, "uuid": "e3e2be26-7dce-4275-b3f2-6b0dd85f426f", "value": "ecco.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a229a40b-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883046, "uuid": "df741fd5-6650-47fe-a327-041238bafa15", "comment": "Malware payload (Mirai)", "value": "4c110495914dd939de44195a2d496888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883046, "uuid": "9d04d875-cd11-4f07-a176-e8c4d10bfc44", "comment": "Malware payload (Mirai)", "value": "c5ab8140a2729c7fa879e4cc26e116ea2ed1b350a92f3cde78bff55dde485e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883046, "uuid": "917919bd-b1e4-4d07-8f3e-27294751339d", "comment": "Malware payload (Mirai)", "value": "d12ec21a99521ce43008fd63044cfc2d52014fa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883046, "uuid": "d51507ee-7517-46b7-9239-4b64832c72e0", "comment": "Malware payload (Mirai)", "value": "db3680cf9334cba7ecd9f8c4d4f017ee21afd4f4c2568bf765b7798faa542cd4e01d6c6d7d84ee8e47bceb98d91079ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883046, "uuid": "15bdab6a-88fa-4c12-a5e7-5edd5f3b51d2", "value": "T1FB830213676D5E7CC42D803D8C321149F9748987D58A6E2BA0BEBFDD9A2A54C731D2F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883046, "uuid": "d4e342e1-453a-4d84-a592-b3ddc5245c85", "value": "1536:jVM0syAIQ/zWq7OIwIvAOQtRy2M6WGHKLdS4hKYFCm1ii6WJA3oi4zat:eyfc1J2RNM6WGHEdJDFyEAP4+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883046, "uuid": "bce5173c-6850-405d-8631-27cc2a1975e0", "value": 86048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883046, "uuid": "d9250e64-d08f-4725-b9a5-e6a698d3f34c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883046, "uuid": "84e51f47-257a-4890-99ee-51b9ef6548a3", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba99bd3-d134-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868244, "uuid": "ac5206ad-41d6-4a4e-9aaf-745a50fb6322", "comment": "Malware payload (Mirai)", "value": "283a049b42375e023a263f80c72492ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868244, "uuid": "6ade97af-e6b8-4c66-8aea-9d7f67efb28f", "comment": "Malware payload (Mirai)", "value": "c5f9a88d8ab060c8fedbb93c6f905b158740f04ae4453e8716b9c418f99be15e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868244, "uuid": "0c953d69-ac2f-4084-9af6-701527dd0f1b", "comment": "Malware payload (Mirai)", "value": "64f0ca6d178a8eb89c46883691eef1ebb2b15b74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868244, "uuid": "fba616ef-3cb4-4a9d-8500-1736787d0ae9", "comment": "Malware payload (Mirai)", "value": "80891b3c3fda1c55dacbc263fa8222df20c36f13c7d66fbc0f4986b5ce1145dd39086c1128b1586eb81d72ecf2ce6abf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868244, "uuid": "c6862d8a-d90e-428c-bb47-4e206d75ee3e", "value": "T15213F18796A1E3ADD2ED50FE629C288B57C29558318CF1DB698011392A39F103B6EFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868244, "uuid": "c44e95d3-2c9b-4b30-af7c-14d0d5c4debc", "value": "768:K1vN4xLQwhaIc6MYAEtyvTIENtSGQeutvF4HHKEs2GnbcuyD7UHQRjR:K2aLuty5QPGKN2Gnouy8Hyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868244, "uuid": "a31e5266-5b26-4d49-a9bb-114b0314f2d7", "value": 41668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868244, "uuid": "3ed5f45d-a198-40a8-8351-a2aa07c16d06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868244, "uuid": "d10ec9a0-55a5-48c2-8904-5edaddfb28a1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2b4b3f-d0df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764831738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831738, "uuid": "b87e38f9-4af3-4af7-9e99-1dda7bf0d26c", "comment": "Malware payload", "value": "403e1d993b7c21f152fe5efde6f5c738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831738, "uuid": "a101f8b9-ae8c-44e0-9cb2-340c4e276325", "comment": "Malware payload", "value": "c66c56f76280f84de12243a0ae2e7d7c6355bb9c209813b0e816aed19fd8f740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831738, "uuid": "b8acc036-2341-44f9-af6c-6369faaa9567", "comment": "Malware payload", "value": "1d95581a130dd59a394d3216118eeee92b5ebfd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831738, "uuid": "495f884a-2f2f-4b16-854e-7897ecd217cc", "comment": "Malware payload", "value": "0b1bbef13e49e42d99376783ef93bf9caecd80fc1ff435da5a847f0d8371e9f13a57c33cbe04b5b3800ed26f4d0c8716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831738, "uuid": "7db689e2-c59e-4d2e-ab8e-0570989c7e4a", "value": "T135E4AE1077A0C477C9A202311876ABBB9BFAE97966664F0303503F5DBDB36C28A1F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831738, "uuid": "fd5ab9fc-966e-4b90-a839-1935ef06ac46", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831738, "uuid": "f15a32be-f80b-4e91-b77d-bbf71c76afc4", "value": "768:x7ra/Tl+hs3E/jU0dugZ0T2Xtz+lHQW40Zz0D3jHUpi1GounzWlC/LPfw3+Ep:M/T2X/jN2vxZz0DTHUpouzWYguEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831738, "uuid": "10876894-501a-491b-9187-a6342846be49", "value": 684656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831738, "uuid": "a52f40e3-4956-4816-8719-0fa30156b710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831738, "uuid": "918b5f85-660b-43da-a3e9-f4cd9a72380d", "value": "rpoeoha6s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784b9d6d-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764873097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873097, "uuid": "68b8a167-57e5-408a-bbe0-62bd97d56752", "comment": "Malware payload", "value": "4ea2f05f61afe20ce1d0779b8df0bdd0", "object_relation": "md5", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873097, "uuid": "aa8d7a6c-14a4-4a01-8c51-6b097c1a8370", "comment": "Malware payload", "value": "c6a83d4a310f3dbeaef1f73bfcbfc96d37856f2dbd32bbd1aa994ff7af15113c", "object_relation": "sha256", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873097, "uuid": "fa7b0a8f-28c7-45ca-acba-4213d02584eb", "comment": "Malware payload", "value": "61fc78cdad2a537771215ebdca03a6955b53ebf0", "object_relation": "sha1", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873097, "uuid": "2dcabaf5-9219-4b80-b70c-e681418800bd", "comment": "Malware payload", "value": "d015bfa2c29447a68a476aa9528eb323bf5b448c33d244da3c1c478a1966d6683584cfe8f2f158e020b34c85ac5cef44", "object_relation": "sha3-384", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873097, "uuid": "9889d05f-e804-4624-a55e-7cad06979dd7", "value": "T1E2B47D9DE6A407F9D1EAD678CD024507E772BC464771A64F03E08EA61F236A09E3FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873097, "uuid": "436ec582-990e-40a0-ad6a-87cfecbb811b", "value": "767ff3ea6fe2972cdfaf27b2138dd49f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873097, "uuid": "319c1ff0-ba80-458e-988d-bef63b97bd16", "value": "12288:nyap35Kbei2whY2zSikbcetqCD2v0hXCa3+:yap35PSq2Hk9gy2MXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764873097, "uuid": "2be2ff0f-3843-4dd2-959d-fadea1f8f6f1", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764873097, "uuid": "7cbfce5e-3340-459a-9110-65a25a400ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873097, "uuid": "e1252855-71c5-4137-8ee1-18ad4a1f2b7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ea6be5-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834110, "uuid": "1e3e46c2-8d39-4cc8-ba0b-63071f52b1ae", "comment": "Malware payload", "value": "1319e9e86d55a609ac8376f226da895e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834110, "uuid": "69c5aea2-b5f5-440e-9232-3edcb1f39ffa", "comment": "Malware payload", "value": "c74c0dfa0a29731a24dd705900c0b07a9097907a2c02c9ec9c183d1b0aaec9fc", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834110, "uuid": "532f2e23-3caa-4891-9b57-c6c0762576eb", "comment": "Malware payload", "value": "9d3dda0fa9e9255727dcdc1c095a0158c1c9b2db", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834110, "uuid": "040126eb-9b4f-4009-9610-5d4235507272", "comment": "Malware payload", "value": "fc6f16c11a29f1d9747e0d81ff30c56f6987672d83a13a2b834bc6e16276e2f90b5ef6e0fb17dcdaf4061b81a452dd30", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834110, "uuid": "f5ac32f0-2356-4eef-9a47-48de4d8ad7f3", "value": "T1CF75F707F2927FE2C24D1776C6E7540043E696D62A23E20E779923793DC27EB4E46287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834110, "uuid": "81deb74a-607f-421b-9678-62f91783fd47", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834110, "uuid": "642726a0-18f6-448a-b53f-3b6e0e95e544", "value": "24576:ntSZyUkfivgRvWcYAFPlqzn5NqICrX8eciFuyhuv:A8ccY+P8zn5NaXNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834110, "uuid": "6fe756e7-fe3e-4dbc-a1ee-537c91ef505f", "value": 1698304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834110, "uuid": "90838bea-8427-4d34-a806-3fb02396623e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834110, "uuid": "98de0104-b35e-4a90-a803-d2e1dfb86dbf", "value": "c74c0dfa0a29731a24dd705900c0b07a9097907a2c02c9ec9c183d1b0aaec9fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0437530c-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764872903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872903, "uuid": "8108930e-04ff-48f6-b16b-5e986a29ec26", "comment": "Malware payload (Mirai)", "value": "f175be616296d8593705d52798c45943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872903, "uuid": "19e327ca-3b76-4d37-8705-de33d85571aa", "comment": "Malware payload (Mirai)", "value": "c74fc11a05325fda0a5da305eec6ff8c172fc98a6dbb9c66b6880dd01a371959", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872903, "uuid": "8ac2bf83-a523-47b4-b04b-eb0e2d288afb", "comment": "Malware payload (Mirai)", "value": "37e82e4c8ffdbd77da6ecb4d1262402355f60929", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872903, "uuid": "0bbda5a6-3216-44c9-9a16-38a4f5a26a22", "comment": "Malware payload (Mirai)", "value": "5e2727b5cc7a15e7a9941cdf8c00ad4937228345c5539ae1c31b1cbfbf3556a84091acaa99dbd3cc7446ce406bbae756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872903, "uuid": "d2f25dee-53d4-497c-8307-387368a0e657", "value": "T15423F2D2B3BDB7B8DD7590F24E289C4135B51463FB273E9A01DE88BD9170A9D1440F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872903, "uuid": "4fe35882-31df-40f4-aaaf-8bc4a2f4b2c5", "value": "768:vVtYiwdU9i6ma9pH4+fqWQQPYcx5/WqPbcP/QyUKDc9+x0kKv6w2uYk3dKBdx0WZ:vVtociyN4+Cnu1eqPwHQac9+x0Nv6EYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872903, "uuid": "a8b4e109-4bd4-4931-87df-0a072a4ac409", "value": 47468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872903, "uuid": "1bc8206c-146c-4810-841a-30c941b03ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872903, "uuid": "82a6ab00-2be1-47ef-ac1d-455d04e35b0e", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c15a14-d0b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764814943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764814943, "uuid": "0505d5e9-4d2f-411b-8dc8-fd825e4fce13", "comment": "Malware payload (Mirai)", "value": "62f9185f76163bae5b7acc2a3ae16db8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764814943, "uuid": "f03263a0-61e6-4f5e-ad5c-3f2da6561728", "comment": "Malware payload (Mirai)", "value": "c78671b22a890c1ba1dbddb516ac0a19b51f96c952249db60085b06bd98c88d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764814943, "uuid": "8e852eb2-6a2d-4f3a-a9ad-dbf613b22437", "comment": "Malware payload (Mirai)", "value": "fdbb9790228df9a6c928ecc53159f887c265495b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764814943, "uuid": "007dabc2-8bc6-4943-9578-201c37355dbe", "comment": "Malware payload (Mirai)", "value": "15123c9fec0a624a56c17df09a0d4194b289985c69af8cf46ec90dd337bf967cd95416c6ffc90ef7412fe5907dffc8f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764814943, "uuid": "ca29e022-3c71-457b-b456-feee53c7d157", "value": "T13833026DDF937C36AF322E73C9B9504FA116AF29859B32A7132A0B5016E24C03FE41D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764814943, "uuid": "d8ab624e-7f7c-46d3-94d0-2f9cb051542d", "value": "1536:CO5t+h93nnVdbVf5zUwnLluKjklzj8zBLF8:C0K93jVn/Ilzj8tLF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764814943, "uuid": "b902692d-92cf-4f08-89f5-3963aadd1286", "value": 52532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764814943, "uuid": "00b70754-a353-4fc6-b6f2-43dde178f330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764814943, "uuid": "da65f839-bd92-4aec-8508-4eaa331c9e6d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30aa6c3a-d164-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888869, "uuid": "f1d76ea8-8d24-4f98-beb6-de5b008799d8", "comment": "Malware payload", "value": "f6c69ed5ce5cf4e1ba4bd626201ba3df", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888869, "uuid": "2329fd22-7a3b-46e4-bcb4-308509d8fc96", "comment": "Malware payload", "value": "c78e1581513098a3cf064f3daf13198e6890433dc337c3765c9dd81065affeb5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888869, "uuid": "fdd70ae9-2418-42f3-ad44-0ae15d4cb843", "comment": "Malware payload", "value": "79beb746009c6c092a24bcfb022725dec9a6a620", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888869, "uuid": "407ef2a1-b47a-433e-b785-f7e9e4bbd666", "comment": "Malware payload", "value": "126399a5cdd12bdcc4c84c5fb64f3543e4c728dabd0172219f8d6618eeeebb7f671edb90b32ce5a0d24ffe5becc3a66b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888869, "uuid": "38a4a962-7234-4088-89ce-098daa303a80", "value": "T1D4E0C22FC50380BB60068989BEBEA994B50E32AA478E0628697C516788F5C98A04513A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888869, "uuid": "5ccc2546-d365-491b-9e4c-fe10051a01a9", "value": "6:/QE0aN4f/3NRVYrmJ3F5kJVKE6LsVKE6NiVVNDV2uVf6vSf9h:/Q8wlRzSg5sguTh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888869, "uuid": "3e741cc4-3677-4ef9-87f8-641a35a5fe99", "value": 295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888869, "uuid": "f51d23c2-ab7b-4694-a015-bbabf37e987b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888869, "uuid": "cc85c2ce-56fb-4c84-8410-01d0a8b56b6a", "value": "go.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17e9c45-d150-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764880468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880468, "uuid": "ac4b4edf-aa39-4c31-b017-aa515f537188", "comment": "Malware payload (NetSupport)", "value": "5061438f995eb7e0accf5c07fe17a982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880468, "uuid": "82598fcd-5b47-4676-bcd7-c98ef26f200c", "comment": "Malware payload (NetSupport)", "value": "c7cefe78fa66d76523beb05969fc5df2eff2db1512249bbcf9fd8fb2220723de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880468, "uuid": "d6f661ca-b7d2-4527-8339-0701076d5289", "comment": "Malware payload (NetSupport)", "value": "8669b75f72f984e5f71e8881338bfb7567651950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880468, "uuid": "e382144a-42ec-4929-aa36-2b393848ead8", "comment": "Malware payload (NetSupport)", "value": "28104e8943baaa5f3b6bd86f536b3e574ff7302bc50fc2f84047563e3155da14a53791bad5116b37061eadf8ec863834", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880468, "uuid": "49a137e3-7790-455a-a2b5-8e7ef4f6b0f0", "value": "T135963357B2AC03EEF9A59238B5B18471C269BF171B25C583B2E4DD6E0D232CC16363D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880468, "uuid": "5d2095d2-2045-45fb-8691-8ad53de28426", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880468, "uuid": "fe632485-3c73-4d82-9a4e-7cff9c0f2167", "value": "196608:0Cugl7UMTurHmoFP/XRL94GG2NTsj+lOnOM:0CuauCAXH4GZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880468, "uuid": "5d6ffeea-d031-4dbf-92ba-608ca3174dd6", "value": 8790440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880468, "uuid": "f58630c9-5355-4028-b836-a7b34384ad5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880468, "uuid": "76b602c2-00e8-4163-8cf0-2aa065869f7e", "value": "Goodyear_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20775b0-d15a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764884764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764884764, "uuid": "36335e79-d596-4ffd-88e1-58e7062bfd34", "comment": "Malware payload", "value": "503aab303b6021fc9212117e7a861857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764884764, "uuid": "f698f360-69e0-48c1-a2c7-dced1db750df", "comment": "Malware payload", "value": "c896595965acfb25fd953291b465f383b9322cbf074f8f97cf1337f54c1c552e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764884764, "uuid": "4e71e993-7acb-4b55-9e8c-38a97d9a1c9d", "comment": "Malware payload", "value": "a987ae3bb24c149674cb9473a031a8d3507995bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764884764, "uuid": "8fcd3766-290f-47aa-9c58-d8e29c047310", "comment": "Malware payload", "value": "0ae055054c46161b0cf0dbe32dc9337a127eb77b778c74dce67f7830784bf370ddb981c2570f2cefaadefa998c93b5a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764884764, "uuid": "8a0d4eac-4463-4509-aa36-2a1105846460", "value": "T12DA47D6AA75800F9D1A7C178CA438D42E772784547B1ABCF03A49AB62F377D44E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764884764, "uuid": "ea407706-06cd-47f9-bd9d-3e07b4f84549", "value": "4417249db25f76aa5ea9cf43e19a38de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764884764, "uuid": "b9228419-d5f8-4250-b91b-b75e98ce1a75", "value": "6144:mNd1xyuPedB1jcNQm/X52Hdg7ydrnkSwtxzmUVyqxPO4KpgrMRZacY5N6zwVYvgo:mpVY83od4tdzPsjpdZaJNcvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764884764, "uuid": "83460b89-3ee4-4b2f-b281-d734bac7e65a", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764884764, "uuid": "55a5c078-e793-4f59-912d-438d71a1571b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764884764, "uuid": "e3b34325-6dff-41f8-8f1a-086c90b153e2", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.43711.9068.5190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9dacd1a-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764834580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834580, "uuid": "4a4d5ee4-5a48-4b05-8836-78efabb58abf", "comment": "Malware payload (DonutLoader)", "value": "660fdb72e7f2180de5e127a0c792a643", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834580, "uuid": "c7444f2e-9444-4ded-bb6f-051c8075ab8a", "comment": "Malware payload (DonutLoader)", "value": "c8e91467da116d7804f7c56a8255548c33966a23856a2fecf7b719fdc6f85a6e", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834580, "uuid": "8a952dd3-930a-4665-b656-968ab67b5f35", "comment": "Malware payload (DonutLoader)", "value": "5dc2f43e0a8fbfedbede610d179ab8a4876c1006", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834580, "uuid": "d9f5f29c-d96e-45a1-9637-ad1d1d6ac49e", "comment": "Malware payload (DonutLoader)", "value": "017e5ac83c1fc47f5dd47af8050741f46d0228af0c771b527b93595f44c31e28597af3601af1ce5e2fa1df739612ca95", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834580, "uuid": "4d5787e1-16e3-412a-b74e-841cd89b6b3d", "value": "T1FE645C15BEA510BAF167C178C9528906FEB2BCC647F0A6CF13B0CB962B276D0953E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834580, "uuid": "67774e3a-6b14-4425-a05a-de634ae288ad", "value": "53e19d5243b4f25d48df742c8d94ac9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834580, "uuid": "dd2e3eb7-1deb-4f62-b1f0-5171daa110a7", "value": "6144:RfRbGY6EDNNAuHe28Pl2ncxlpbecvR2OG:R5ZyBP4cxlpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834580, "uuid": "135d87ee-14c6-45fd-bf52-b8bd2592f423", "value": 317920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834580, "uuid": "e44f726a-ef95-43b0-8172-aad64aa49d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834580, "uuid": "ad569224-7b18-4bc0-ac93-249854547d45", "value": "ptyynntzw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8e8572-d151-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764880864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880864, "uuid": "8ba46a9f-c260-4b87-821f-377db5170223", "comment": "Malware payload (ACRStealer)", "value": "0a728f3c423c957839b9fb8ec69008b5", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880864, "uuid": "e70d61e9-eaf8-4ce3-9baf-ce913b3be0bc", "comment": "Malware payload (ACRStealer)", "value": "ca375f6f3a65b4c475506fcc8f8141e5491a5de75d74bcd7cf3a5b924f92f26d", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880864, "uuid": "e22245b7-b034-46a4-988c-145744440c4b", "comment": "Malware payload (ACRStealer)", "value": "8d77f2c09324d35769b7072c910c2abd8999a542", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880864, "uuid": "c6e15eda-aeda-4d4c-94f9-76c986138b69", "comment": "Malware payload (ACRStealer)", "value": "10d482cd8584bbd1e84779e06bc41d79e9b9cd23cca9dc6c40d420b694d5487cff344f12deb410d92f8f6e2fbae2ea05", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880864, "uuid": "d9a33414-9b61-475b-a7b0-0ef0506ee040", "value": "T196372B9732E49328D17ECE398D7E4B509A32BCA63B39C2EF1250325A1F755D0AD39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880864, "uuid": "1d5eecab-861e-485f-8872-f203cefb9b38", "value": "0d1fc06116855204673aa7e0fcf13949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880864, "uuid": "3a9ed2ce-2291-45e5-a7fd-3fc111997bf8", "value": "196608:OrqoIqOnqhrVL8gQz8LeHHVY+j9G+ZNjF:OrqT9qHfsnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880864, "uuid": "b57f668c-027d-411b-b549-727e71e37768", "value": 24267248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880864, "uuid": "d3cd149a-0d33-4787-beff-0e51c54979d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880864, "uuid": "a226cc78-9521-4569-8562-87f4ba632465", "value": "0a728f3c423c957839b9fb8ec69008b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4619fa31-d0bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764816749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816749, "uuid": "2f19466e-fb34-41ac-8610-3b2b72076204", "comment": "Malware payload (Mirai)", "value": "d847acb2075538c8cbcbd9bdeaf0022f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816749, "uuid": "1b5b98b8-af7d-4f86-b2a6-7e6c3491b021", "comment": "Malware payload (Mirai)", "value": "caee8f57230d475e8077965fafacfcd358f356d7d2b5f5fad5b821a33cbc5b35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816749, "uuid": "44852552-62cc-4ced-a13a-f072bc4f8a55", "comment": "Malware payload (Mirai)", "value": "2b2ccb5ca081a862a65fe0cfa226be30e1aea335", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764816749, "uuid": "aa15062b-fad9-46ff-bd15-27493ae01c41", "comment": "Malware payload (Mirai)", "value": "a90c95e14806d79cf7cce90256e2e91b60411e0fe833f93e7a64123765d906d5ff33a0b5bec0275c443df619cf79196c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816749, "uuid": "c37e1cbb-a0e8-4aa5-9f49-aa254d6f130a", "value": "T18EC3C80D3F219FBCF7A8923507B78E269259338637E1D181E15CDA016EA038E645FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816749, "uuid": "98b29cc7-1a88-4d68-b480-172357389f2d", "value": "3072:KlxLIzz7CkDvBigUl8T6TW2KRadWCSgAABsu:KlxLIzzukDvBxWXTRKYBtwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764816749, "uuid": "7223e77c-42ba-4d64-bc7e-16e285e5f711", "value": 126144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764816749, "uuid": "80776312-53f7-458a-bb2c-72f75d6ea354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764816749, "uuid": "a8ccbc48-2ebd-4093-8aec-2be26f659605", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71379115-d0ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764837867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837867, "uuid": "91f0fc81-53e4-4987-8793-2a18e89088eb", "comment": "Malware payload (Mirai)", "value": "84d1f44ff7182a926a9830dac8a0acc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837867, "uuid": "9052cb38-b9d0-40cb-a07a-ca47d1f1c517", "comment": "Malware payload (Mirai)", "value": "cb377f1873a7bb241e1b5cd5c98fad75a83c7dd74c7f249b29a70784cde19741", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837867, "uuid": "71a078a8-1629-4ae8-a352-9e588d6b89ad", "comment": "Malware payload (Mirai)", "value": "e65c0959ce3168fd72223d7ab0fd9f65bfcc06a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764837867, "uuid": "0eb0e6ee-c400-400d-8bf4-8de3cd840063", "comment": "Malware payload (Mirai)", "value": "c95404fc6c56579975162a70683679fc8dc74416f41207cafd2847501dddaef996b25dc0a68a2d3d4c9f02799904cb93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837867, "uuid": "969b0ea7-6ff4-430f-9463-695900e14bcb", "value": "T19C43199BBB2C0B97C4DB56F02CF737F08B69B95112950185A60EFEC40763BB06816F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837867, "uuid": "f23bff42-2c21-41c9-94a2-801deb9803c1", "value": "768:0HJmQR8yJ5DyWUz8RX6M2dudnMYz1LmWp/gznIXVwqVjAhhdZBauVw:mJmQRwD8x6DdudnMOEWJwnIlmPVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764837867, "uuid": "87d5c8f3-6a21-48aa-a193-f11dac7f9bca", "value": 57398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764837867, "uuid": "e4302937-a68d-4ea0-aca2-58b6bac9fd0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764837867, "uuid": "8830f211-7a84-4218-b5d2-418f99802a3e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3138d98-d0fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mozi)", "timestamp": 1764844903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844903, "uuid": "ed4e41fc-7a34-416f-9869-a89950b2bc88", "comment": "Malware payload (Mozi)", "value": "c668b2ff3a83a0ed0e1374d6cede6630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844903, "uuid": "8c5297ef-abbb-42d4-a1d9-a78cfb1362b1", "comment": "Malware payload (Mozi)", "value": "cb5c5d9258952910faaba3f81e0860b6f717fde8bba543c3aa2f80655e17e87b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844903, "uuid": "521215b9-471b-4f37-8782-5842a42d9c24", "comment": "Malware payload (Mozi)", "value": "627cc38cd8738ca92154da28da3e405786f01133", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844903, "uuid": "e69848ca-dbbf-4b51-85a5-4df110f4f319", "comment": "Malware payload (Mozi)", "value": "513d1cee9d3e61dd1bbfe0a97445a624b0ed8b06065120fcdd0e67eaed1c690b70a441bbcc4138ffde907884fa294958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844903, "uuid": "a29877b9-225c-4ee1-b00b-5eec242cf439", "value": "T1E314128BEF36DC1ECF001EB226DA5B9E9C6D756B41CBF0A4B9C1818F13A01C97D52215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844903, "uuid": "98c5d6e7-08f4-4953-8f10-6664d187a8d1", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio:p3lOYoaja8xzx/0wsxzSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764844903, "uuid": "7a313b63-8abc-44cb-a165-dab49664c151", "value": 199736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764844903, "uuid": "7f68f24b-6fe7-4ca9-a8f5-4a255ae8cfc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844903, "uuid": "346bfec7-51d4-463a-991c-e3c23cf89ecd", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1aa13a1-d161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764887904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887904, "uuid": "e44fdef7-6155-4c4d-82df-5f7c2824f081", "comment": "Malware payload (Mirai)", "value": "db9499f9cf370726690f295c6cff4367", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887904, "uuid": "82276e0e-cca0-48d5-9645-92c6ca0f3c76", "comment": "Malware payload (Mirai)", "value": "cb988ee37b049e1c665607a2e09ec3f8c24f9002b7981aea69fd04ef37d6b7ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887904, "uuid": "45ea5153-1f3d-4929-8f75-b684e366016b", "comment": "Malware payload (Mirai)", "value": "a7957d96f4d8c5e801106281e85afd889d369850", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887904, "uuid": "c8ab8412-a51c-4988-bc7c-c89cb349bf71", "comment": "Malware payload (Mirai)", "value": "33eca43bd9dd77f4a762acf4a6ba84c42b0adc89f4d405e058eb15f088b156cdbe55852c451ff2a005545855f65daca8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887904, "uuid": "3fbcd476-d85b-4228-b093-e26861e62e74", "value": "T1E8D307577720DF63C21CC1300AB3C75666FA2AE12AD29445B26CDF186E3135A691FEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887904, "uuid": "0431c98b-2b46-400a-98d7-db02da97a45f", "value": "3072:iwfSKdddJBRLYDM0i3dP0eUoGxNsbCfyBGq0pnIja:vdYDM0aB69sbCfFZnua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887904, "uuid": "a2152e6a-efe2-4ede-b442-b9affd7cb04e", "value": 140928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887904, "uuid": "ffb904f4-3120-4303-9e8c-d56a333daf3c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887904, "uuid": "8b13d391-22e3-4b8c-a843-526d7ca8b123", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26497775-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764870383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870383, "uuid": "b93b8a83-c2b1-45c8-bcf9-3b73ecec0df2", "comment": "Malware payload (Mirai)", "value": "1b9d9e0ba0da215e1cd7316e0c74c557", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870383, "uuid": "0686234e-6b49-437a-99ac-43eb72a95a45", "comment": "Malware payload (Mirai)", "value": "cbdd3e60db726e90cb06865ee2ac61a9a2107a4b536de6aaeba24174d4640fd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870383, "uuid": "be8ec1cb-d569-4188-9f8f-2ee0a9dfa66c", "comment": "Malware payload (Mirai)", "value": "3a493c6dbd6f91d356baf5fad588645513680a17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870383, "uuid": "7f940e36-98e0-426c-9afd-5b26b5ba7b72", "comment": "Malware payload (Mirai)", "value": "ff89f77ccc1f5c4e95e1fe605e7606f1b3c0c1d466b45e0a20f049c1752318ff031f19c46544b6ed55e70b3bec6a8043", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870383, "uuid": "00455d4c-32d5-4c60-948f-c0ef6a16fffe", "value": "T14513F1A8C1905EABC9AFD4B0ED7935417AB21F9671B6DF93714AFD009F0250E12C1ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870383, "uuid": "6083e67c-2bc9-468f-bc5e-eba9bce73eb0", "value": "768:S3R6OSO/wfEg+0LHJtp22AbGI7f2XhS9L1Sdd4Ux9+vLm5A7cJf4uVcqgw095:pOoAa0f2k9ojx9+K5Ey4u+qgw095", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870383, "uuid": "466ceb8d-3fbe-4bc6-bc7e-3adf4c8cf4c4", "value": 42236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870383, "uuid": "76c19c72-23d6-4cfd-88eb-f6c9ae400f06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870383, "uuid": "e0812cc0-f6d2-4d07-8377-96a62195f078", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fba115-d154-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764882170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882170, "uuid": "72fec402-4a22-43c2-a769-f39cc6905eed", "comment": "Malware payload (ConnectWise)", "value": "ae1e240eec90a5c03fd7d95924df180c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882170, "uuid": "3eae6683-0845-4d8d-b75e-fc76ee6a465a", "comment": "Malware payload (ConnectWise)", "value": "cc6308aa4ca887e4e1ef3ad504f881df61ee5eb096cc6642b24d3c3e21089c9b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882170, "uuid": "71242794-84e3-41cf-8767-375c71584196", "comment": "Malware payload (ConnectWise)", "value": "2b647c02e12b6c7635f10a54fe32875ac8de4d79", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882170, "uuid": "afa6f8d2-4fb6-4a1e-8f45-baa255390d17", "comment": "Malware payload (ConnectWise)", "value": "252183b00e751d0d5be334f5cd7ac60425eb5c49080cc153159811113ffd7ec9629b063df9fd9cb18536a38013dfc3fe", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882170, "uuid": "8a8c8716-c7a9-41f6-b49b-b79ffe8f6ebd", "value": "T1EBD62322AAFD8598F4F39F34F97A99A5857AFC248D62C01F2315780E1972B418673373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882170, "uuid": "20a4e2bc-0fb7-4a03-8135-b5570de866ee", "value": "393216:ucVPOBdAcVPO1cVPOncVPOwcVPOLcVPO6cVPOG:ucVmBdAcVm1cVmncVmwcVmLcVm6cVmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764882170, "uuid": "0a731538-901f-4bd6-921c-d9e7ff369c2f", "value": 13516800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764882170, "uuid": "4769a415-c44b-454e-8884-6b7f85d7cb16", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882170, "uuid": "04e744f5-5162-4e14-b60c-70324ae7d77c", "value": "pochtalyon.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7100c5-d141-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764873834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873834, "uuid": "95e648e9-1693-4bfd-98e5-20ddd714fbf7", "comment": "Malware payload (Mirai)", "value": "9f26db3b86563a281030d0ccbc40d891", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873834, "uuid": "4f07f329-7615-4366-ba9f-491895df15bb", "comment": "Malware payload (Mirai)", "value": "cd0edf1cab5ad5844a0cb0b26c4dafaaacb3ef81694e41422bfe488b15017b56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873834, "uuid": "7f6c0c6a-a164-4792-bb48-442941c54c83", "comment": "Malware payload (Mirai)", "value": "e6a26a9fbe02e45aaba6fa8038f5d73d4015e662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873834, "uuid": "ef165142-c4bf-4c83-b8b7-dc233f370c9a", "comment": "Malware payload (Mirai)", "value": "b12c35e016bb29294b402561599262a8164967726e559b7aa5e1b98218b67ce04ff95e323a4d3646be3148be7583317d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873834, "uuid": "8c665e1c-27be-4cce-97cd-a3c710c8ee97", "value": "T1CCE30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873834, "uuid": "cd34bf90-d806-4abe-9ecb-dad47c23f9cb", "value": "3072:pUkePnwUPX1JJXJUwbY+a9scgTbOCm3DoVRpL:pUH44jJXuwbjaPr/3DoVRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764873834, "uuid": "5dc24704-c5a3-438e-ba74-cf86d109e9e1", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764873834, "uuid": "ba69b671-3ee5-47f6-abe9-6de140552006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873834, "uuid": "4329d5ac-9309-45a4-9c88-971c053b630e", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d4bbf4-d145-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875484, "uuid": "ea737611-b170-4746-b3c2-a36a08107850", "comment": "Malware payload (BlihanStealer)", "value": "1d794231ab49e76fe880650f9f9b2495", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875484, "uuid": "d753c1f5-f7ae-4149-b929-33bfe126ce8b", "comment": "Malware payload (BlihanStealer)", "value": "cda5c0301401d6221ca5b52e1b09027cd93f7bb6d137e65124a32b993c8e29ae", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875484, "uuid": "8853b419-8bea-40fc-80c1-55d3eddd3fe6", "comment": "Malware payload (BlihanStealer)", "value": "11f09309998099f7bdf920b3488ca0cf5b93c5e6", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875484, "uuid": "a5cf6f58-bbb0-46d0-ac47-c8f86147c9f7", "comment": "Malware payload (BlihanStealer)", "value": "9b9dfdb3220ba8ec5d96b8c97604d70f3b91d24dad13f4f66a17312b3e5d63c3a0e1656f6adcfddce8b15db25ed749ee", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875484, "uuid": "84089de7-3f82-4e84-a5b0-3706c79fe2c3", "value": "T118837C13A9C3C9B6C892253206B9D37D92ABBD091EFDA3438B9DDC1D2352144EE1E743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875484, "uuid": "5195f2c3-ca99-47a8-8d94-a9613348796f", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875484, "uuid": "26471862-2bc2-43ff-bf1b-08ff4b926c7b", "value": "1536:YAowfUJFgjT284U+w2EwRz6OlvaeEpIaCtwUaSvcmGCCCCCHCChCHCCCdg1WCiNE:YAowyFgjTiUkEwt6OlvaeEpIaCtwUaSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875484, "uuid": "53c6eac8-f9e6-4625-b934-6f6575762369", "value": 81396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875484, "uuid": "b3b607ba-ff46-4ae4-b2b5-66cbc55e71c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875484, "uuid": "6a6c45c6-6846-49d8-aa3a-d2e395bf7f92", "value": "microsofthelp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645e6ba7-d12b-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1764864474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764864474, "uuid": "75768cbd-dbf5-47f6-97aa-4b73553b98ed", "comment": "Malware payload (BlankGrabber)", "value": "8a3dd4eb5b605d2085d7bb5a974e71f6", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764864474, "uuid": "9639e5f7-281e-43f7-ac9c-fed78e69e9b6", "comment": "Malware payload (BlankGrabber)", "value": "cdfc27bf4b4b59ba35789b0a9e907c098f7bdff1c6d15434e78d66d916530754", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764864474, "uuid": "c33b624a-c0c7-431f-b5cd-0bcdbb6de76a", "comment": "Malware payload (BlankGrabber)", "value": "d356b8408b04518c580cebac2ef34c670d4a340e", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764864474, "uuid": "2d20bc88-999d-4ead-898b-0aed85a22ad3", "comment": "Malware payload (BlankGrabber)", "value": "44e35683530b5a30c58e37e16cc6e1adec6eec4a12a708ee3d49f32f56f5417cf261cd76d8849888f44b12e6cbb8c57a", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764864474, "uuid": "c03c3722-8add-47de-b53a-e0bb59e63466", "value": "T12C08336140D93CD6E07E947B55B288649A31CC56071983A7C6BBB6822EF3F83B43D787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764864474, "uuid": "a559389f-7ca6-43eb-bddd-59668caf2378", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764864474, "uuid": "1cb718fe-0498-4252-b648-2a6959342ec5", "value": "1572864:GjqEL/s/8+VPyAiF5R7mP9daWnp+AJvZlxq7OW7/Eoc2PCW+eb:0p/s/fV0lm/lIAJvZlk7p/nhPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764864474, "uuid": "7b227036-c7c7-46ee-b408-0b0399192de6", "value": 79076206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764864474, "uuid": "8fb974ad-2080-4c4d-80ca-c69de069f87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764864474, "uuid": "9245036f-aa6f-4313-8f89-583683307659", "value": "483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242bb9b5-d156-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764882835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882835, "uuid": "499ed442-5bd5-48a5-8157-f53788d4fa9e", "comment": "Malware payload", "value": "5914de5093f47d5198fc7b3b81669799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882835, "uuid": "c57166b4-aef4-443a-82e5-0695339f955c", "comment": "Malware payload", "value": "ce417002415b0ba9c25c97d9f85928dad6f0980dcf428b46a24c8d776a58ec60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882835, "uuid": "dbdfb7f7-f4ad-4ed6-8521-318b2b60fe1a", "comment": "Malware payload", "value": "395f57cd81e423ef807ed73f89788aef07a3eb7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882835, "uuid": "a2153001-3619-4e70-a969-502493079dc1", "comment": "Malware payload", "value": "6c7b0b4c16fc6fc1842e49a30c58c3d73d978cdbf33bd91134517fb21c8f42fa0e03da50409e2dad7e2462d3a80dae6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882835, "uuid": "4dccbf22-2a59-4d46-9c7b-b888c65ce6e5", "value": "T155761882B9914A6AC15BF238AD70621077317D1943313BDB6EE716B50CFABC4273EB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882835, "uuid": "95d83233-a69b-4947-b201-0671fda1b385", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882835, "uuid": "5e72c396-52ae-41cc-a1e6-1d21054f723d", "value": "49152:RqjfF323pSuRYyg+QZOj2K1BC9BWPtgGg5mF2VQqXLm1QjbtzCCWBmH5fC90nGGl:Q23wZOaitgxsF2VQqXLntzjsRcroa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764882835, "uuid": "a962ffd1-d826-4e1a-991d-ada38690fd98", "value": 7813456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764882835, "uuid": "c7b1e838-399d-480e-b29f-184f6a8337ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882835, "uuid": "8dbca53b-bf79-4e44-a9db-ea40e22460e0", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9685a9e6-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764873148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873148, "uuid": "2726827b-9f37-406d-b2a0-2d94e1e3992e", "comment": "Malware payload (Mirai)", "value": "555d9e58706415afbe1d955ba0a53324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873148, "uuid": "78946fe3-6932-4274-9cad-ae407017818a", "comment": "Malware payload (Mirai)", "value": "ce4a318ae886d2ba6f65e8caf8fe6421b5eb15902bf4aa2137946ffae6cc75b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873148, "uuid": "29bd3182-6c85-4b5b-87af-c50a652fe5ff", "comment": "Malware payload (Mirai)", "value": "bf0e1fd876062bb646e12a91b4694c2d937a485b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873148, "uuid": "d48a91f0-9726-45bb-a0a2-60106e25f170", "comment": "Malware payload (Mirai)", "value": "eb13639794c22101c6bcada34b40ec9ee430d7d3654b45d2b90356e9aaa49c1a37c2b80950ce4881498ba73aafe2c971", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873148, "uuid": "8664f9b0-d6ae-4342-8410-d9cf88b16b63", "value": "T1E2B34A0177180F47C5930AB02E3E1BE687FAE9E022E4FA89564FD74A4275E37154AEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873148, "uuid": "53c8cdbc-4f73-430b-bd48-39c582771b20", "value": "1536:Q+pox9sezjXN/D0gfmh5xjZiCa7IpQ8buRGKDsaWBim7e/C8HoyEaEjJnl:Qwogayh5x07EMRzk70Cxy3cJnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764873148, "uuid": "55274dc7-9bb5-4c5d-9efa-e0e85e321d2b", "value": 116492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764873148, "uuid": "6711ee0b-44ff-4151-b2c2-6f4b5f17bc3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873148, "uuid": "5ca42181-4bcf-42e0-a87b-b8c0b42627c2", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474a84e9-d13b-11f0-a129-42010a9c0007", "comment": "Malware payload (Tofsee)", "timestamp": 1764871297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871297, "uuid": "73da9c46-30a6-4474-af6a-2a9dfa226321", "comment": "Malware payload (Tofsee)", "value": "57561f0d2405377b755877a61a7e2358", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871297, "uuid": "9d31cd92-b8b2-4f61-83c3-f5c0314551e9", "comment": "Malware payload (Tofsee)", "value": "ce50b4d9c84e5d113361ed821f86fef6f509a04cfac76f003f25a2aaec49954f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871297, "uuid": "80501621-3199-42ab-9d2f-c8376a69c720", "comment": "Malware payload (Tofsee)", "value": "1cdd08df9e9a380801edfc020bba90f88c76fb12", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871297, "uuid": "895c82c0-ea21-4fe3-9a47-08ff66e242d2", "comment": "Malware payload (Tofsee)", "value": "aeee7625070e7a77148f97870a1ce620e37fdcc0a0ef9f0d7c5c7a01aed9485c11cadfaaadd9e224ab254cdbfbec49f1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871297, "uuid": "6050eeaa-082d-47ce-b697-55e74e5f89ce", "value": "T164260213A67D273DD16965364DFB9A10847FAE609CEA5C73C9E02A0CCF394544EEEE02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871297, "uuid": "7c7cc6fb-e6af-4880-960a-60775198b374", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871297, "uuid": "cf3f64c9-b6ab-418f-9476-033683736026", "value": "98304:lDb8qZSi2s+mwj82fs9/H5Gl+dgTdqao+4ibI61:lDb8qZSZn09/H5G0STHo+Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871297, "uuid": "cb3fa312-ba1a-469c-8840-a24699df2e37", "value": 4778477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871297, "uuid": "32fccdf3-335d-4c25-9d42-61eedfc6a004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871297, "uuid": "f1582be2-ff8f-4de6-922b-4fd60f86cc98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efdf7bc-d125-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764861995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861995, "uuid": "256d87f7-e574-4c9d-b624-c33fef857181", "comment": "Malware payload (Joker)", "value": "0bb2eed3f769e72660b04f9853f8fdb0", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861995, "uuid": "8c2f944d-5954-4c9e-9461-65d5424148fc", "comment": "Malware payload (Joker)", "value": "ce69d862022d103503897b9f1c0d730e871924767ea08efa076d43699b7968e7", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861995, "uuid": "b5bd6d0c-645f-4124-a144-ca71c110c5b3", "comment": "Malware payload (Joker)", "value": "9486ffcaa3fed58a7890f4273f12bb349f527630", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861995, "uuid": "d2c277c1-a0bb-4288-88b1-f8a6ec09cb14", "comment": "Malware payload (Joker)", "value": "590b2dc11a00f61a176847d3c6435f4c4a8f54eae4f5cb009b822c3d7082cf77fa54d6562f67d7bf13478db555473cfc", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861995, "uuid": "f96d68cb-f393-4baf-a4ea-1ff1b2a437be", "value": "T1B8170189FF0DE82FDDB7B0384D56232126356C589640AB87E910BA1CB9BB6D44F1B7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861995, "uuid": "6e16ace2-b4ef-4caa-915e-8f17b13495e5", "value": "393216:7+knwT9pFqQSezH7XuLM5JsiGE/QPpbd+CtNKdF/VznAw7XfPnt:aknwhpUszaodGEifEdF/Vzn7XfPnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764861995, "uuid": "66736182-b32b-4f98-955a-3fa090c8fc9b", "value": 20029798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764861995, "uuid": "2040bf16-39da-44fb-8c03-90761ed965c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861995, "uuid": "99bad0d8-7e7d-4bb5-a032-163d41b49c1a", "value": "Reel+Drama_1.1.67.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cd4443-d103-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764847223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764847223, "uuid": "34a1ed2a-d2e1-4388-ab2e-00b46e7f93ea", "comment": "Malware payload (ValleyRAT)", "value": "d92a1c341d11f888f43bdbe81086aa43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764847223, "uuid": "01e2ef05-942f-49fa-a976-baeb5221fbd3", "comment": "Malware payload (ValleyRAT)", "value": "cec28cdad6cfe852ccf9ff9b44d22e8a39a2e5a668970c968634dcd081c8249c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764847223, "uuid": "064ed571-0475-4637-8eb0-fcb274107548", "comment": "Malware payload (ValleyRAT)", "value": "1c50966fde50157675ebaafc97f95ee81f7650e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764847223, "uuid": "3569a4f5-c58e-4435-a553-318624061e28", "comment": "Malware payload (ValleyRAT)", "value": "4e5a83b15da674982d45a1fecc04b81e6274b99d6745e65df25b81d7794e12ea85ece8a4d8fa72c0df668162a341a4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764847223, "uuid": "01177adf-18a1-4b40-bae0-df714d43713f", "value": "T1D4370122794A9173E49162B19D5ABB31017D9C659720C5C3F3C4BE2B18B25C18E3FEBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764847223, "uuid": "f6d0a025-90dc-44f5-81e8-207af94bd955", "value": "4088dfe1893fc3f918b97c40d5535da7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764847223, "uuid": "fd9451dc-a980-40ab-9115-68a285420f6a", "value": "393216:8YQ07BPbe8qL/U634jEBwzlayaNd5m5ssnfLGVsxvwIg3PcPpdJBfEpA0hcBfEpu:QT8L634EwKGfLBx4Ig0rfEVIfEVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764847223, "uuid": "fede1269-8fde-4603-8c31-b33222feb60b", "value": 23889390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764847223, "uuid": "662b0bec-217e-467e-8b19-3fa15669564f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764847223, "uuid": "30b59500-2ca5-446d-bbed-842650349dde", "value": "D92A1C341D11F888F43BDBE81086AA43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9797ce28-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879163, "uuid": "7f1125ea-6f32-4ced-94c3-77dc71cbb5e7", "comment": "Malware payload (Mirai)", "value": "6440a74f8dc3cc7f4284530735a2db9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879163, "uuid": "71d168c8-7c8f-451d-aba4-62789ccaf2cf", "comment": "Malware payload (Mirai)", "value": "cf0eb31763b1f0de7f9aa6b28372a7613a10db4b05c0ebfe60d7ad52abe3a7af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879163, "uuid": "723798d8-929d-4954-99d6-f93a8999508d", "comment": "Malware payload (Mirai)", "value": "91c2f60497802367afe09f316106cf0a3c3954e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879163, "uuid": "f4fd5900-68cf-40b2-986e-9868644fe990", "comment": "Malware payload (Mirai)", "value": "4b0fca1c3f8f3b4c00c3553c6bbda5a1ff76cc55e8ec93d02ff49095d6c7cf90b7b262db4e682b66d172f609554085ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879163, "uuid": "f0a42089-9879-4d9b-b61c-11f3df6e19f4", "value": "T153335A22A97A1E1BC0D0F47A62F78329B2F5070E25A88B5E7D620F4EFF214D0555B2F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879163, "uuid": "8eb18c01-a59d-4900-8f44-2a868d1ef91e", "value": "768:gI4ojWM7N0heq9m3xypZEKyEuwp0Gt9eCgvbKO+hZis2DFmM:f4o3N0heSm3xybEKZuwp1t92YhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879163, "uuid": "3546345a-6b39-4858-bbe6-e6578392fb13", "value": 54748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879163, "uuid": "ab6cc2f0-6941-464c-8caa-fb93e8bf6a43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879163, "uuid": "84effe04-9a01-4c88-a814-cd7bffbf03b3", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e75177-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834172, "uuid": "6e328804-65a7-4a1c-b9aa-33df8783ec0b", "comment": "Malware payload (Mirai)", "value": "c068191b5d233cf9783ea20d33e53a67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834172, "uuid": "8301dce6-70af-4faa-8930-983c43ba9b8e", "comment": "Malware payload (Mirai)", "value": "cf9e440c713a4e61cbff76228bf5f219be075e47a2eff4f1529e7739667350b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834172, "uuid": "f205cf78-1fb0-4fe6-95e9-9b059bf0a4f7", "comment": "Malware payload (Mirai)", "value": "5b018f54972b43bb55232676006e60bf2c11b3c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834172, "uuid": "12cf5d7d-4c0b-4f62-82e5-7496e88d45b4", "comment": "Malware payload (Mirai)", "value": "a72040d9e994fe8374a4471fe05b10111671077b6c5cd9565b1dd873af385204baf1ac1ed266d8b458102d54f830b7ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834172, "uuid": "ae91d8b6-da4d-40bb-9fe5-d112beca9fff", "value": "T104637116BF601FF7E8ABCC3785A95B4A25CC541A31A93B797D34D428B24B25F05E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834172, "uuid": "1b3a3cb9-7db4-4317-9798-78c1e8a110f0", "value": "1536:FJs9gGYlZma+9KRJisXkBg0rruxyDb1Z:FJs+9mLiJMruM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834172, "uuid": "ef59c944-350a-468d-ac14-23a3a94bacc7", "value": 73324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834172, "uuid": "27d547b2-f2e0-4d13-955c-a2eed0d92166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834172, "uuid": "4bf6496c-e860-4072-9299-a32872ca93e8", "value": "DEMONS.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5747f3d-d141-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764874032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874032, "uuid": "529b1bbc-e72b-4439-866b-f3d9edeb2d58", "comment": "Malware payload (Mirai)", "value": "9bc27bbfc00eeb5fd911d4bf7e086c88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874032, "uuid": "da9c521f-9ce3-4608-a876-c85fdd98e160", "comment": "Malware payload (Mirai)", "value": "cffda7a668e9fd56a8b543b1811164967d16894099fbf673fb35604a6fdc813f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874032, "uuid": "84101d8a-8452-4b84-8f10-756d79d8f7f8", "comment": "Malware payload (Mirai)", "value": "ff1e9ad9fc3b25c4ad99dab8d0f5f1f15229ee06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764874032, "uuid": "4f37be62-8c90-49e2-b9a4-29091cb8b2e7", "comment": "Malware payload (Mirai)", "value": "39710cd4af7a812ff08a6e5e94d49f41ceba34f45334a9ade10aa077f611d16ce201e8d8dc3100fda81966e9e4b34500", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874032, "uuid": "7727583e-893b-47ed-9917-bc5c041da389", "value": "T1B306336C971BB613FB815A7C530B67A4D3C50A9F18DE2BD4CBC87201DA394BBB4710A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874032, "uuid": "4df8ea2e-5cb0-4df7-a10e-0dd142fcf87c", "value": "98304:nCFj+p1kbHVz2NfaWAgzLBG/zqv0V+bGfTh5bzc8w+0MII:CFivzSCbGrh1k+0MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764874032, "uuid": "9dc80375-b099-4cdd-86fb-4eaf0c857ed3", "value": 3681484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764874032, "uuid": "f41c8796-ff79-41de-97d4-0dca0ba31ed2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764874032, "uuid": "835b6443-03e6-4027-9323-e3d4eae700e7", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047abf7f-d0bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764817928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817928, "uuid": "6b60331a-21a3-462e-8c04-d85928bfb1c7", "comment": "Malware payload (Mirai)", "value": "ae053676f967b37e06b1b5f3af5df848", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817928, "uuid": "a53c4014-c86b-40f7-a25c-7cb92d9cc89c", "comment": "Malware payload (Mirai)", "value": "d0fd757e7c4b2c100465dd04e701cc8a0cdb63676b1dd3157ff9727953a1b935", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817928, "uuid": "b9e5a0e6-8f19-4e77-a0a9-f7faf595fce6", "comment": "Malware payload (Mirai)", "value": "1e98c865afe9c7e216bb97efe44f16d052651cc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817928, "uuid": "378e1019-b13c-4eb5-8588-118015f10c95", "comment": "Malware payload (Mirai)", "value": "c7760c3a23e73dc03499e93e80128f73da933039244c04cf859e7e6d73e87d7bc297e7c22c9fc3463ae79a777cf67e5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817928, "uuid": "127b8047-789b-4e35-babd-ebd30116f52b", "value": "T1B583094AB981AF11D4D631B9FB9F414933136FB8E3FA3201D9206F61278A9DB0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817928, "uuid": "d01a567b-c3a6-46ef-8e52-b5828590ef70", "value": "1536:udnQjCSaPE/RWCCF3XiSaqSLDn35uaala6iD36HvGPKY7Oa61UpUS:FrjCF3XiSaqSLDn33H3WvGPKNH0US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764817928, "uuid": "85b9663f-741f-455c-a1ae-23eb31cb6365", "value": 82328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764817928, "uuid": "b6f08a98-0fc2-4abe-93f9-6a164add6715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817928, "uuid": "c9c549a7-2931-4c82-a362-49f57540b056", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780010ff-d0ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764838308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764838308, "uuid": "67b9d2b7-3e56-40b5-83ff-528e01792147", "comment": "Malware payload", "value": "5f1556a9a34cbb8fb5ed5a68a075ae08", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764838308, "uuid": "7e967723-f2ec-4a7d-8622-2e40a1763644", "comment": "Malware payload", "value": "d135a3810dcb522d3cce8902024a3387da00c7e1d601ec645e83743b9354f192", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764838308, "uuid": "8d4e552e-476d-4a86-9a6c-7c9a9a053c6a", "comment": "Malware payload", "value": "88064035add4dd869ce8d035e41a4f9d2dcadd9c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764838308, "uuid": "42c33286-b12f-4640-83df-75555d6f940b", "comment": "Malware payload", "value": "b0e9e456708e9cf2c7ba34408cb75c9d47c965fa39076c6662a630e309052e5cedd87fda4f5bf4eb1e0bf6cc8b819666", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764838308, "uuid": "8ce8ed39-20d6-4e3b-b6b2-b080d360981c", "value": "T10ED6128BFF89989AC0F75732C97642A540474C224B83DAC35D6871BC597B6E06F0EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764838308, "uuid": "d3bd8eb5-efa8-4071-89f5-a3e8d2c4e44e", "value": "393216:8OE2cWgY2ndTD52nWM4KQp5Et9cJHe4QM:U2cWgYcd/52nb/Qp5E0HpQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764838308, "uuid": "c22599f1-1ada-48a6-b2c3-547732cdbf12", "value": 13233098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764838308, "uuid": "d5e61273-5e6f-41fe-a0e5-d84a13ff4b2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764838308, "uuid": "cc76c7fd-c667-43d8-a47e-eefc3709166d", "value": "TikTok18+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e7e9c6-d13b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764871350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871350, "uuid": "b8e4ba32-28da-4e32-91cd-3340ab0bc607", "comment": "Malware payload (Mirai)", "value": "69dda44dbb6cdcf9bdf5b0676881719e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871350, "uuid": "acb1ab6b-65c0-4ae3-be84-331cc89730c0", "comment": "Malware payload (Mirai)", "value": "d262875b559bed2c398d08a1db9da6c1ed9bc114f19ce790e5d1eb78db3279be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871350, "uuid": "d30f23c9-755c-473e-8154-1376d5ef44ab", "comment": "Malware payload (Mirai)", "value": "692d922beab1927abeb5da55fae998c29fb1cad7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871350, "uuid": "58057f9d-6d90-48da-88a9-e07f564a9fc4", "comment": "Malware payload (Mirai)", "value": "5946d8b84015af5279576b31cbeaa58554a72708ba23200801a4cd7ad90ce227b7a9fb8f5f659bd00cc414d1c43c8e2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871350, "uuid": "79da9b3f-fede-43b9-99af-5d22b65eaaa1", "value": "T103C32A45FD818A22C5C712BAF92E118E331217E8E3DE72139D149F2177CA62F0EBB955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871350, "uuid": "5590e47b-cafe-4462-8997-9d86c3532657", "value": "3072:eSWgnh64QOJautPuk3QeLqcTpqAla49LmE75NN:e5q6fOJautPuKLqcTAwa10NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871350, "uuid": "78fc8ae1-c3e0-4b60-966e-ad8c14013d57", "value": 128676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871350, "uuid": "61d74e48-32e2-485e-a28d-74ed07d22bbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871350, "uuid": "20a59c87-36cd-441c-969f-fe82328ca286", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ad0c3c-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834165, "uuid": "2e34d5a7-ed8b-4b2c-973a-a5c857b9b096", "comment": "Malware payload (Mirai)", "value": "15a7e5035b98f79d796920c357238289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834165, "uuid": "4d41aaa6-cd72-4a58-9263-e2177f651709", "comment": "Malware payload (Mirai)", "value": "d29424ecc9fa48a9364f2687350e0bbae2abb3e1309d9e432f829b27cc368dbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834165, "uuid": "9321f150-c633-4aea-acc2-a9a20158d0eb", "comment": "Malware payload (Mirai)", "value": "02888ecfa09051d058617795f215dec9dcdf9a7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834165, "uuid": "4d4a28c4-bf61-4ec0-91fc-07715f76fe24", "comment": "Malware payload (Mirai)", "value": "d79570271fca1cefb4061cbcec22758a929162e201e136c11d02e7f7ae8884d877f8bbfb700433bf656ab346b6fafba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834165, "uuid": "28e87242-c568-4781-bb38-eb3830c583b3", "value": "T1B1C33A46FA418B53C4D51B7AFAAF41493322E798D3DB730689186FF43F8666E0E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834165, "uuid": "f7284d9f-9b79-4c34-b894-4089dba61288", "value": "3072:SJkHK8uzHYhlKgZPqRJd7qNl7U1+b2L8M/91ce/:skHK8uz4hlVPqRJd2Nfb2wM/91ce/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834165, "uuid": "eca26017-8d36-4f80-8ea9-b49c4c858c94", "value": 128096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834165, "uuid": "ffe548eb-ee69-4569-aa97-91cd79cdc7e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834165, "uuid": "01ae6f78-0586-48df-ae81-82552682974b", "value": "DEMONS.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86388f3-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829074, "uuid": "fa22a208-e324-494b-93f2-5fe538683ee9", "comment": "Malware payload (Mirai)", "value": "4b6ddb96b4263e77d1c8cce4ba01efc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829074, "uuid": "3f88f945-a27d-4d6a-a5e0-f9dd6547edcf", "comment": "Malware payload (Mirai)", "value": "d37dab6fecca48b02bb5fb70352836c6bc4ab7cbcbe8b459c01c94face8247e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829074, "uuid": "ef43e579-0666-4422-905f-1aff72241265", "comment": "Malware payload (Mirai)", "value": "9de4ff46b9848ce4f405b70eef67af1514d700a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829074, "uuid": "0dfafc4d-cb93-48f4-bfd1-bb3ac4ad6d53", "comment": "Malware payload (Mirai)", "value": "406bd1b88a4ed426796afdcb94d49435a2b70ed37b1027b45830bb2874dc2ede25cb4f218fcd1aec0451f826b642018c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829074, "uuid": "b6bd0a6c-517b-45ba-b5da-ce4edd3df7f5", "value": "T1F49329C6B401DC7EF80FDABB4463690EB631E2511A831B26675BFD53AD321E45923F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829074, "uuid": "b9472a19-fd8b-4346-b363-15d5d4c87f30", "value": "1536:xsdLEbXJld35KM6hRozWD/TJsP8dFWqvl1Pj8b4b29wv5tLBo0zzHlplo9K+tMUa:xjKvhgWD/T/wqvlNLCetdoqOK+tPKRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829074, "uuid": "7a50421a-6fc9-4a4f-bc25-54f98b969e72", "value": 96728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829074, "uuid": "9d22b341-a80c-46ed-9e0b-b6d918a92f34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829074, "uuid": "af132b33-78e5-44e6-b358-1fce0aca711a", "value": "windy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43b6cb4-d0e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Havoc)", "timestamp": 1764832799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764832799, "uuid": "3584719d-ed34-4167-9859-d0635431ff46", "comment": "Malware payload (Havoc)", "value": "7ad366815a8ed80df5068c59eea2f2c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764832799, "uuid": "281a0cb4-d8a8-4dd1-8417-041330ae2d71", "comment": "Malware payload (Havoc)", "value": "d3f3d508a2b35ce83a591d4723d06de6e3b85d6fbc998ff20a7a83cbcda0cf0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764832799, "uuid": "fc07de49-c6a0-48d9-a096-c4f059cd2225", "comment": "Malware payload (Havoc)", "value": "5a0d46ee692c622596bea281605cf39f2a5b4c82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764832799, "uuid": "d5d95ca0-a364-4f51-8f1d-3bdde14e861f", "comment": "Malware payload (Havoc)", "value": "3d517f9556afc1121c037fa8a8c2debc4000dd036221d6abae0bfc357cd4c7477df720c50e3aced49503367349e03ba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764832799, "uuid": "fd9a8d3e-0dab-46d3-8b3e-4f09740d91d6", "value": "T1F6356A07510C1EE6E21F8CF0B60AC597F5A1AF5A373CFDB69B952096CDA37D28825D02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764832799, "uuid": "c3a924ab-1604-4ea5-9308-d2a6daca5ca3", "value": "c0fc141b601ecb442c709aacf81de045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764832799, "uuid": "06a1f4bf-c303-42be-bab4-52c4ffd3a54d", "value": "24576:0TWTA3W4k9KZd3TKPLDAvtugy2sG7Bu0yrk2AUEvY:4Ei9VQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764832799, "uuid": "557b66c9-159b-4d2a-b65c-922a16652061", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764832799, "uuid": "a398b49d-a7cd-49cf-af49-33b642a1f83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764832799, "uuid": "158fb8a2-f386-4aa9-9888-8cd4aea8f41d", "value": "7ad366815a8ed80df5068c59eea2f2c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfd202d-d0cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764823634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823634, "uuid": "71de77b5-98de-42cd-ae2f-1aecdfea8c1d", "comment": "Malware payload (Gafgyt)", "value": "66a75c13d9dcf23a5a7942263db3c84b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823634, "uuid": "b1912e72-7c70-4e37-95a5-d92f838275bf", "comment": "Malware payload (Gafgyt)", "value": "d45961a0b0e771b04c578cd9068f56e694ec41062d85c88651e80b5823572ca7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823634, "uuid": "de7e6d97-f8d5-45ec-a56e-31fefa51c127", "comment": "Malware payload (Gafgyt)", "value": "8675e6745271993551a4347b3861e9f341b32df0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823634, "uuid": "c8fa78f4-ec44-4638-aa45-67146ad02452", "comment": "Malware payload (Gafgyt)", "value": "dfe874316d84c7267039f9f91169b23fe751a29fe3cc99351400771807de0d4e36d16f4e162586b281c60b80fede8cb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823634, "uuid": "91233fca-aed6-49b8-b5b4-fc47ca7520b3", "value": "T1FCC39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823634, "uuid": "3cfef457-f05e-4bc0-9585-988daa5d75a7", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epe+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EI+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764823634, "uuid": "ddd55899-74d1-4c59-8e00-be5a4a2554b3", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764823634, "uuid": "5d681d2b-2992-47a7-8da6-f3f1081d03da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823634, "uuid": "e392359d-fed4-4424-91e3-f293b35c4f8f", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a98d74-d118-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764856188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856188, "uuid": "d06f06fe-219c-4eeb-9e12-63a619b1f59f", "comment": "Malware payload (ConnectWise)", "value": "3510d77f21a03559e97ecb33916fb6d2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856188, "uuid": "ed18ea1e-306f-4946-8959-aedde63bf536", "comment": "Malware payload (ConnectWise)", "value": "d45a27937962287d9421fc3e16e750d24e2d2b569fa80cf2779a2f0b93506f1d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856188, "uuid": "161b6a76-fa18-47d4-9bf1-3db3e0b899fb", "comment": "Malware payload (ConnectWise)", "value": "baba4512fb8a51fd20ab1984aec5f102a5e2fe6d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856188, "uuid": "4672e79b-ea68-4c8b-8c5e-2ef2b35b30c3", "comment": "Malware payload (ConnectWise)", "value": "b14d7bb8c0b294275855f504c222627eca1259b74d3c85ab1c67a3d5afd322e1bd30ba08e168c1312422505e26532614", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856188, "uuid": "e424a308-e0e8-4996-aa9a-f533226453ed", "value": "T19CA6233662E4C026E2B71E39E9794AF25939BC568913C05F533C794E6871E81E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856188, "uuid": "52bc35e6-78e4-4de2-907a-f4b77be4436d", "value": "196608:/+kLGB1m+Z3/f+kLGB13+kLGB1M+kLGB1:mkqBQHkqB4kqB/kqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856188, "uuid": "c277e5a6-8dd0-475a-8ed9-e06fc2a06704", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856188, "uuid": "02ff5920-5bc4-488b-aee5-b47610b36dff", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856188, "uuid": "7fd04f4f-0361-4b4a-9175-fee45dc147cd", "value": "VIPGUESTLIST.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2f39ce-d0bd-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764817221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817221, "uuid": "af1bb1b5-a0d9-4a8c-9804-f2b0f05eacb5", "comment": "Malware payload (AsyncRAT)", "value": "b831621b35508cf92448fdff37bc59e7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817221, "uuid": "fe56683f-080b-4faa-b27c-70f991528f38", "comment": "Malware payload (AsyncRAT)", "value": "d4ac4a98170b7b5606fc03e625be2973bd0f4ad38c653ba4db1558fead88dc0a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817221, "uuid": "d2d825e0-10bc-4456-b14a-1a9e26ddfcba", "comment": "Malware payload (AsyncRAT)", "value": "ce14afcc14de95c1f4073459b88c5a5c85417ad1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764817221, "uuid": "ef0e3d75-2981-413a-9c0d-637ed350b604", "comment": "Malware payload (AsyncRAT)", "value": "9ca971b1fdc8c353edee3ae06a10504881769a03913b4d777c1985152d1120971e713676913b0623d99bb7d82116b275", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817221, "uuid": "4775f33c-736f-4f63-9ae9-a8b743512dd5", "value": "T167B402B07569C923DEAB42F81922F33083B69EBD7822D3C98DED6ECB31E5B501504657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817221, "uuid": "7652da30-0a08-403b-b65e-98e4c9b6d35f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817221, "uuid": "7a3fa966-a4a0-4a1f-84b5-81b7529c17b1", "value": "12288:MPdien8xzHu94dzCFBC1/+g2isc6gbAgpDS2kVSUabxzH:MPdie8YmGFYogTWsAelkVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764817221, "uuid": "5458f227-4725-4337-b8d0-7ffa5197c2e0", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764817221, "uuid": "38eae962-d06a-4473-bf9c-f262ba71b247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764817221, "uuid": "088700cb-1270-49eb-a4f5-1b032b2a4ba6", "value": "95AlUeMWU975V2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71dea90-d124-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764861606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861606, "uuid": "842cf6ce-c869-404d-817e-f4e1309e63db", "comment": "Malware payload (Formbook)", "value": "06b965558e85444bcb3643a29170fb34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861606, "uuid": "61a43a36-5b54-416a-9c40-22d4004fb134", "comment": "Malware payload (Formbook)", "value": "d551f8f0d78d6017bcd4291bc70495e45cb500402d9c45476c7af2324155a93b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861606, "uuid": "bcadedda-14ea-4269-a3f5-576f7cf2b427", "comment": "Malware payload (Formbook)", "value": "3ed380fea2e4e87f81906114819cdde8f9541ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861606, "uuid": "4b9487e1-c45f-43e1-9c9b-86921720bfac", "comment": "Malware payload (Formbook)", "value": "6a59cd98a23ebcf635d594c2a58f10147e4cc1ff85b4266e43cf7e1a867a91a6c19479f75b2d799416951c0682990f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861606, "uuid": "972a1044-034f-4f8e-8b12-00efb380eac4", "value": "T18745BE027391C062FFAB96334F5AF6115ABC79260123AA1F13981DB9FD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861606, "uuid": "d74dd102-1f28-4d59-8b4b-832dd792bdc5", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861606, "uuid": "4d449e3d-08c7-4467-bbb7-1496ce2f43f1", "value": "24576:A5EmXFtKaL4/oFe5T9yyXYfP1ijXdaZXrFx5SSQu6T5fJ/QvND/0C:APVt/LZeJbInQRaZpx5LQp5x/QvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764861606, "uuid": "09c503c5-50d2-4fcd-8f88-be7f57085195", "value": 1229824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764861606, "uuid": "3b9ad61c-8dde-44b2-bacc-53c9bd007c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861606, "uuid": "df566a74-aafd-405a-9e99-1213fe3aed75", "value": "d551f8f0d78d6017bcd4291bc70495e45cb500402d9c45476c7af2324155a93b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b15376f-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849453, "uuid": "88bbcecb-fc4d-4ac0-a742-2cdaffceb927", "comment": "Malware payload (Mirai)", "value": "8fe27e55951c56fbfd7397601e7f8f0a", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849453, "uuid": "266f37a9-238e-4717-bd42-eee7997c5cd7", "comment": "Malware payload (Mirai)", "value": "d5935410d04ca9f8bab51a0174d21abaa53860f06f5f4ed7734132b2109b8bcd", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849453, "uuid": "9126925b-3309-420d-a8ed-65b7d2bf6d29", "comment": "Malware payload (Mirai)", "value": "e0718a10dacc371c13604be5e83bb98eaba73d67", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849453, "uuid": "c26dcad0-e2c5-44f8-87d0-a76ce23925a6", "comment": "Malware payload (Mirai)", "value": "b570d443122c4aa472d4719d90eb6d9ef8de9e3b86fdfae17b044810b5af5bb71b3551d719ec908b0f6c28aa3a7c90e1", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849453, "uuid": "4d3f49ba-8d35-4c5a-8668-08cc3459ad65", "value": "T1D753F58178819A17C5E422BBF96E018D373563F8D1DF3216CD226F6476CA82F0DA7792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849453, "uuid": "0f41635e-aac8-4ce6-8263-9af9a112e51e", "value": "1536:jPcNNq4i/J+EoMvMgGsSAPRXlG9WkHYDd8yd42+:jP6a75PRVG9bHud8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849453, "uuid": "3b237c42-7bd6-4ebf-80a0-bfbba654250b", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849453, "uuid": "489c14aa-8da3-4bb7-983a-1ecd787b0fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849453, "uuid": "34cbb9e0-eabe-4336-8f96-23115597b7fc", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68f4168-d119-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764856854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856854, "uuid": "8c2f92dd-4d12-44eb-bdae-f4d66c4a5ca5", "comment": "Malware payload (AgentTesla)", "value": "1cda8620389ee4a4b2994ad9e98d1042", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856854, "uuid": "7e16104b-dd5a-408a-979f-a5b1a8988f9b", "comment": "Malware payload (AgentTesla)", "value": "d5a65d6dc53a44eef295d2f9908bd7bde73e2457dda3347206d42e7c52ed5a43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856854, "uuid": "20b75e75-c23f-4e00-acb8-97b7d257f657", "comment": "Malware payload (AgentTesla)", "value": "16ae4abe5fe7de2b6bb5f5f9b0c5ca8b0ec21cfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856854, "uuid": "12600780-78ea-4bec-bb0f-e4e38e4b5bdb", "comment": "Malware payload (AgentTesla)", "value": "1407cdde99a2339745d9dfb9a596cfc020980fa2a579d42e74e41eef4f37cbe1f6d80af015b09d4a9f9a7a950798f976", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856854, "uuid": "98368686-cc67-4662-9f8a-198427628f76", "value": "T1F935AE0273C1D062FFAB95334F5AF6115ABC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856854, "uuid": "142487aa-bb91-4084-ab69-b23add4d0164", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856854, "uuid": "430e9e90-3b32-40fd-8619-381a3103e59a", "value": "24576:h5EmXFtKaL4/oFe5T9yyXYfP1MAXDzU0EWmUKxe:hPVt/LZeJbInGizU0EnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856854, "uuid": "bd2278ab-3eb4-4614-9d7a-1425c89b9854", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856854, "uuid": "80dddba5-a9aa-4630-a5f6-706ff78da703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856854, "uuid": "a3aab21e-d7d8-41d3-83e3-40bc76e046dc", "value": "z41factura-9876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05964cca-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764872905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872905, "uuid": "1aa55e72-4d4d-4447-80cd-57b33428f035", "comment": "Malware payload (Mirai)", "value": "b814388a51cb52a1e08a56ecfd5a10a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872905, "uuid": "1457673e-f24a-4f39-a93d-53e3925164e4", "comment": "Malware payload (Mirai)", "value": "d5c2d3844846cfcb0621b781968d29ffc6e2cded5ed7a3434249516cd95e0d38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872905, "uuid": "5391522d-39a4-4d21-b13a-446518d434f5", "comment": "Malware payload (Mirai)", "value": "d441cf4c31b8ea1bd5a489443c3957f9d4546b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872905, "uuid": "28e3ab5d-b96b-439f-90b2-422aabc0f78e", "comment": "Malware payload (Mirai)", "value": "6e794440000a1217b8efac482fe8117a28760cfe980f4e093b1a5721675d90e3ece5803fa2128be7e3c58547a7810376", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872905, "uuid": "5b2f0cc0-bb75-4ab6-81af-616842c8bcfa", "value": "T1DF23F255F5816033D3303D33BDC682D907A22FAA956EBBA008F939647B55E0B56F128B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872905, "uuid": "2a1bac9f-8261-482b-bfc0-96d70aa33308", "value": "768:ZOjYJiXLP/VxiGW9HHiaEvrjkn0bP8XL6wEY74LKvs3UozhQJ:Zt8XLP/Hj8iLrjkn0bU76PYCKiziJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872905, "uuid": "554e6d35-bee4-4ee7-9d23-c4844c57b082", "value": 45996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872905, "uuid": "44213189-39c5-44c2-bbc0-ac8fe892821a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872905, "uuid": "cf144206-5390-488d-b86e-4fd85eaba386", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33743a7-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875451, "uuid": "286ca521-15ec-47d7-b24e-a7ee97a53e63", "comment": "Malware payload (BlihanStealer)", "value": "4f1a74911c50b08f5cc9a9dbaf2cb685", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875451, "uuid": "9df125c7-5fd0-4953-8e47-2a88a4b87da5", "comment": "Malware payload (BlihanStealer)", "value": "d5f5215dfbe21383463c443dbf499807d1433376d6bdcf33c33260a18e6a9214", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875451, "uuid": "951f2ecf-8851-4cfd-b8b3-4e36a3b8def7", "comment": "Malware payload (BlihanStealer)", "value": "3b078a0b9a39cef0c36e35a8284f7cd295be1437", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875451, "uuid": "e0c0554d-1e06-4809-98e6-8ac6aa40cbca", "comment": "Malware payload (BlihanStealer)", "value": "77bfc6e130d74828e775681c784c9f853a1b2bf96d44c52eced03633b0059b89b5c11dfe09a9d2d4ba96e40e005ce3ac", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875451, "uuid": "7340284b-cb9a-42b2-aa70-226b4d1192bf", "value": "T15CC3E60B6FB18CEBD841043A57FAA22D86E7BC440DDCE35697DDCC4634D2918C8AEA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875451, "uuid": "91ce270d-c6b4-4917-81b2-2b9d07787772", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875451, "uuid": "aa0edc54-0f9c-4fcf-8470-fc709114d191", "value": "3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKB:eene", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875451, "uuid": "7c89edb7-f27b-4831-890a-dc07b2944bfe", "value": 128506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875451, "uuid": "454a5af1-b854-4d49-a89b-cbd7178c71e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875451, "uuid": "454ef640-130d-4469-8620-275d901f547e", "value": "6d6bdcf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01fba45-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764834590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834590, "uuid": "2b802702-1857-43d4-8122-5ebe2d4a5f88", "comment": "Malware payload (DonutLoader)", "value": "8d88e23cdbf20bd149b1ce9d34c059e6", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834590, "uuid": "f248b944-0a9c-4ef4-8c0f-369c059ef251", "comment": "Malware payload (DonutLoader)", "value": "d637ebacaa09c25c41dc1c6904a52e97b3739d0067a837180933437daeb1aa2c", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834590, "uuid": "fec4e1a8-7788-4258-81bd-d3ef197d7e81", "comment": "Malware payload (DonutLoader)", "value": "99114cabdfe36e6359bb294a6c20eb2aa3f57c58", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834590, "uuid": "66700670-ebba-4170-8a59-f28d8eb01b6d", "comment": "Malware payload (DonutLoader)", "value": "5140fc9eef3da7ec7459f86efb3000ad6e602440e836952d7cbef2e9644af65f6e6725b994a6c22e19f39cc176f54c47", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834590, "uuid": "0a6cc952-acf3-479c-8c3f-d9b4e77a40dd", "value": "T1B5646C15AAA410BDF377C278CDC27906EAB2BC564360A6CF1390CA962F277DC953E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834590, "uuid": "e4c325fe-beb3-4e11-817a-01c35ec4200b", "value": "53e19d5243b4f25d48df742c8d94ac9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834590, "uuid": "be38da1b-5caf-4b08-bacc-34439de8576b", "value": "3072:jfRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+Ol7kuO8t:jfRbGY6EDNNAuHe28Pl2ncxlwpR2OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834590, "uuid": "3f13255d-b2f8-4f00-b10d-abcacba67274", "value": 317920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834590, "uuid": "b749ba99-23c4-4ed9-88da-ce892ebef2f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834590, "uuid": "4a07fd42-bba9-4544-b6c0-0b4171da17ad", "value": "3c910f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67324df-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764834520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834520, "uuid": "43f2af7c-d0a5-4729-875f-e81bb5acd6d6", "comment": "Malware payload (Mirai)", "value": "b035e92e2aee88881f520a011ed820ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834520, "uuid": "4535c678-1f13-4f4d-b899-7a035ea0884d", "comment": "Malware payload (Mirai)", "value": "d68d64c882bd54e0355eb7f2ecf342790c4d49b80b84b1b110c107929ab4bce0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834520, "uuid": "9d868098-6f64-41ee-8d88-f0c4ea6f07b4", "comment": "Malware payload (Mirai)", "value": "6da232e7ead439cf16fbda86432a82e9271e9aca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834520, "uuid": "746f878e-05cb-4305-b099-cf4f205e8c3d", "comment": "Malware payload (Mirai)", "value": "895e3cc651259e1c6e7a2c551bff6aa00624024593dd008518abc4a01f2e33665190a6fe875c87bb90b8c3600e50fbae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834520, "uuid": "d66590bb-6a10-4fc0-8496-4bdc48fdcdf4", "value": "T15B330796A800BD2CFD5AE6BA81160F1CF5303B6410734737A6B6FC9B5D723A49D1AF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834520, "uuid": "35664404-0483-4996-8fa5-d6c92103777f", "value": "768:zreOjp9lwpL8a2dfJOw40Rcp/u5WeMEvpaqMJTXNa4H86zn:nNjpspQ5p402p25ptaqMJ7NaG80n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834520, "uuid": "a98f7fba-e782-4efe-94c7-dde2b6567e9d", "value": 54632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834520, "uuid": "55b8ebb2-1ea5-4f48-aab7-a26eddd5d1a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834520, "uuid": "190348ad-1eaa-434a-86e6-b73d070b02da", "value": "DEMONS.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648e9592-d0d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764827538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827538, "uuid": "ce0e60e3-0028-4f4c-a6c5-5c35a383583f", "comment": "Malware payload (Mirai)", "value": "2a9ac647af790ab88692dd4982df6a73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827538, "uuid": "2eedeadf-d4f9-457c-8b38-8c1a3cbbcce4", "comment": "Malware payload (Mirai)", "value": "d6ab09449e94476d63556e45eb3526268589950e85e5ef233d6024a73f752bd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827538, "uuid": "4ccb8b66-3d12-4f4f-bd7c-4e0beb1051be", "comment": "Malware payload (Mirai)", "value": "c761046e323dad6160fd0e5a785d2508d247dfce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827538, "uuid": "3318e58e-237b-4410-91d6-b31693a59569", "comment": "Malware payload (Mirai)", "value": "bc69551e82740a15e832796ad9083a58f987c893b6b8e92447025e5d7952610f2027f4e3626710a3bfb0b0061409e295", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827538, "uuid": "13fa4e36-5af2-488b-82eb-1127bbf77b99", "value": "T1C1C30945FC505F13C6C612BBFB5E428D7B2617A8E2EE72039D256F60379B85A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827538, "uuid": "bd01b030-1071-4bee-a570-c47ea608f0d4", "value": "1536:O/OK2ZuMtZp3xIfckGdPB22A/4VCYObVqLQNjn9vhxfXHsl8nwywXP2GkcPMn7Bz:O/fM3l6fcHdPBQ43OBSQN9Tf7sQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764827538, "uuid": "c18a0c48-fc6e-4f5c-9d00-f3ae81cfe24c", "value": 129664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764827538, "uuid": "e9392346-929d-41df-8f11-dc19c291505b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827538, "uuid": "45e0b97b-36db-4194-9a55-387f14517f3b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfa48ae-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807043, "uuid": "65e8f571-0b08-4bae-9ee0-f6a27accd0c4", "comment": "Malware payload (Mirai)", "value": "49e6edf04d6ce83098ab6313c3daf30b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807043, "uuid": "13aa3b04-4905-41b6-9496-b89755d1ba1a", "comment": "Malware payload (Mirai)", "value": "d7112dd3220ccb0b3e757b006acf9b92af466a285bbb0674258bcc9ad463f616", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807043, "uuid": "bc3004c0-f4e6-4ed3-ac4d-9959292e7ed6", "comment": "Malware payload (Mirai)", "value": "afb9cba0bde23981b87d422efdf5112c19548c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807043, "uuid": "a978553c-4376-4511-9bd2-169e5865b8c4", "comment": "Malware payload (Mirai)", "value": "83b00bd1790e8d22835a0ac68734e8d5d85e5ba92df496f4790cbec56811b48cf5d25c5b1f61005d8ffacdf56827711d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807043, "uuid": "59453866-6f5a-4619-821f-f28eb5635d58", "value": "T17713F1A7B5DDA670D82DA37184B79144D63C3C17506A3F1F4A7A70D90FB294837A6E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807043, "uuid": "94067608-3add-43a9-bdb6-1336f39e1a9a", "value": "768:uvfcitCBw7mDfVAANmvc/r9RzMzMc2hJ78ABZbQWQmeQ0jpG3aFzgfEozx0Y7:afdtCGmD2ANqC4zM3JoAHbQWQmeQspfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807043, "uuid": "51500312-e994-4011-9eb0-cb66de02f024", "value": 43508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807043, "uuid": "1a4e80c8-d0fd-43e9-8087-5e28a823271b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807043, "uuid": "7644fc78-e388-4a4c-95a5-0badb8d60c74", "value": "zerobotv9.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ca725c-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764870697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870697, "uuid": "b1417575-4ce6-4c12-933f-c2bc47bd4298", "comment": "Malware payload (Stealc)", "value": "e3896136a6ed7e0d73aa697384e4f1c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870697, "uuid": "d720e96b-19b9-4a3f-895e-0b2bfa5bc1c8", "comment": "Malware payload (Stealc)", "value": "d7588407a02bc7bfcb9e346bd94c4fe1da06a2f25824025cf4bd4422cd101da3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870697, "uuid": "95fca999-82fb-491d-912e-d5d3944c8d7e", "comment": "Malware payload (Stealc)", "value": "f63b1fe56e874187b13f938153ed0526ea5b1961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870697, "uuid": "3344f3fe-f028-4b70-a594-92977a3819f7", "comment": "Malware payload (Stealc)", "value": "d17236dbb1c8c4a0f152cee30f7bf7cad3ab6ecce638765c4b256b53d18c6ef98ba890e3e84ca17070a8ae3ced037da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870697, "uuid": "c98a4f77-48d6-4eb2-9d1e-0d4b320e22d9", "value": "T1E2057C1AE7A623F8D0AB8174CB42C542E7B278055770974F03E256A62F376A05DBFB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870697, "uuid": "9a911c6d-3442-4ec5-b152-f5d9c7d741db", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870697, "uuid": "5bcbb457-a82c-43c8-9d05-c1a14e2c37e6", "value": "12288:eGLVpIo/cBJ9InRPehbyv8plnE5Lyv3YZtF15kjHL:ekkBJinRP6bw8TE5Lm3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870697, "uuid": "7436f9a1-c3bb-485c-8732-d2fe8fdec5e6", "value": 797952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870697, "uuid": "d89a0979-f45b-4810-aafe-99d126be1497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870697, "uuid": "bf3f5dc8-ac2d-4557-865c-7f0e205f9179", "value": "69mcl7d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4444e3f4-d11b-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764857548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857548, "uuid": "8b442e41-1adc-4256-bdcf-b13e2e14c706", "comment": "Malware payload (SalatStealer)", "value": "e8bc8f0a0aabdcee5533f1d0a2d516a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857548, "uuid": "d3ff6625-e253-45d1-93b3-c0ed08c967bb", "comment": "Malware payload (SalatStealer)", "value": "d85719ac7660672f42f6fb44a198998162c148c78d41c427b836a133c790198b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857548, "uuid": "f753ad87-1d87-458e-9ef6-e1d0054800b6", "comment": "Malware payload (SalatStealer)", "value": "1ea87b642538e8c13e03eed00b3188701f85bda4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764857548, "uuid": "1960e2c5-9dca-4949-a4c4-fede39a683c5", "comment": "Malware payload (SalatStealer)", "value": "a6eb2e738a10efe3e8df405c2408a09e685052ca884f9d2167abf4fc45521a26d8f4e1d3504f455313da1c83f1278c2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857548, "uuid": "abe71dba-a157-4888-8140-faf3c73018a8", "value": "T1F1C65A51FA8B54F6E9031831815BB23F63305E048B28DBDBFB547B6EFC77681186A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857548, "uuid": "7ef80579-762e-4f6c-af6d-49f48fada563", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857548, "uuid": "385c863b-d7f4-4d42-8e2f-7e890aa537b7", "value": "49152:/mkYRQJ5ytVzkYjN12iZUe8JUJEXaa99cQEM0D+c58SRNPqIwZDLHnoDbNiTzRE+:HmQfAL11p4q47H3io85rBC+b7Ci2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764857548, "uuid": "4633fa3e-1fd2-4172-87f0-2d42aafda5d4", "value": 11657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764857548, "uuid": "395c75ae-6937-485b-8e55-7e8fb9e53f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764857548, "uuid": "27cbb6be-57f0-474f-b76a-467431467c5d", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb24f0b8-d136-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869371, "uuid": "29bb1fe1-21b5-4404-9ac8-36fa0af8e10a", "comment": "Malware payload (Mirai)", "value": "28ae9b6ac6a0038883479ecbf93368db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869371, "uuid": "876a2874-693c-4d90-928d-22b923a34b45", "comment": "Malware payload (Mirai)", "value": "d908878e906f5b52abb8164538edde7101ac9cda25dfbe289356a2e009b11b7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869371, "uuid": "93eb4c7f-7358-4eaf-a5a5-2a51cca49c72", "comment": "Malware payload (Mirai)", "value": "3d2840065bdf4ef6860b27915ad4c1f9ec65291b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869371, "uuid": "a10b470c-cb11-4d8b-ab8e-9181d5d992e7", "comment": "Malware payload (Mirai)", "value": "eacf88379f68e9b482c177425162034b074125c8fa8a6344e7999f20cd10eaac414a81fdcf97023b33dbc002c1b1cfba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869371, "uuid": "d8f60b36-0afe-436e-a5f3-3b5ef9434b19", "value": "T1B623F128B5036D43C8269977E1BD11CE7A0131BAA6CB3D401D644C3CB6E72A707BE4AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869371, "uuid": "60a4f03a-2538-4771-82c7-7c80c697f3f7", "value": "768:3kXsan8kAZvGKG5jiRNo/BkmehwwrGrWvO38ldkRrSxW2pwRTDE9q3UELfs:3kX78kAZuKujRkme5rhvflIsjpwTL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869371, "uuid": "2e1707bb-d8b3-42b0-acad-9fe9e758baeb", "value": 46112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869371, "uuid": "4c5a6711-f060-4d7b-813f-11dee1e59c12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869371, "uuid": "a9744613-27f6-4869-8f1b-04e6a60e86b8", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d037f8af-d13b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764871527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871527, "uuid": "3f1c5b46-cf3b-4720-8299-935478cb8ed6", "comment": "Malware payload (Mirai)", "value": "dccaac727e23a985dd15db75701e4cdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871527, "uuid": "4d5390b7-64a9-4a05-8e8f-7b1ea1abfb86", "comment": "Malware payload (Mirai)", "value": "d90f981d31b1f6fcdd1928d84452d8793989976a23ea0071bc168da2d9270727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871527, "uuid": "f783868f-e8a8-4568-9e2c-6bc2dbc76114", "comment": "Malware payload (Mirai)", "value": "5f64a43a7a60eb0716537cd67ab6bff8f9ffd509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764871527, "uuid": "b21feb4e-91bd-4338-bd36-5e4ba8042883", "comment": "Malware payload (Mirai)", "value": "8654e114d5e93bca1151ed024057e586f2607525f18b8773750f134bfaed9ae64d077be56781be3a34ff1002f6a5b524", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871527, "uuid": "18ac96fc-9ad5-4d20-a9a0-12f5e059ece1", "value": "T12D13017348A8CB24DA9B00F418BD962A5920D31F5970CC79BEC93444A82DF7E6DB436A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871527, "uuid": "d09ea63c-0f2e-48ca-aa6a-eb37bf51c5a6", "value": "768:hV0BSWM2vSfuRRIajdGsp94kiZBUcTmBGdkN1TUXSjFWiSw8DATfxjN89/dnbcud:hVSSWMFu/xUsp6kiZOcTmB8nXS0iGqOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764871527, "uuid": "a3c59b5c-7948-4430-8ab6-3e0597f4b883", "value": 43528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764871527, "uuid": "4b5530b3-fba6-4f47-ac81-479786ed5380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764871527, "uuid": "65e67125-bb09-439b-b1c2-7169fcd69897", "value": "x86-DEBUG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf87799-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834395, "uuid": "5dccd23d-8970-493e-bc8f-9cb7a91e53a6", "comment": "Malware payload", "value": "25dfa7aa1d87237248f12d5367e2e02a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834395, "uuid": "e00c1e77-c84a-4f3e-b642-f62aa10610a2", "comment": "Malware payload", "value": "d94f580d1f8af948a61133303bce772be79bd7dadf8ef4754c6420602cb2cb26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834395, "uuid": "08a91085-32d3-4807-9f18-ad170cbe6932", "comment": "Malware payload", "value": "e4865e6937af2b84dffe82aeea93e4b556a4be1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834395, "uuid": "3124fbba-749f-4ea9-af36-f0ef0567d120", "comment": "Malware payload", "value": "91471ee03ce18f0dc3cad3cd872ed330fd1ac5996c36a2b2d61e58ddab90216c0cdc94263961ce42a59a887a862bf6bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834395, "uuid": "d609f0d7-10a7-40d0-9438-464f193e3b7c", "value": "T192272221F241C03BD5632A758C5B85DA5535BF611F29A8873AEC2F0C6F78BC17E262D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834395, "uuid": "8a8166c1-90d8-4f7f-b241-445977dd7caa", "value": "9536dfce195f94fad99f3590b71bda91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834395, "uuid": "761e8d65-30fe-41d6-b516-923be09f7b3c", "value": "393216:nZO3ePGQRV20zIzdAw9AaxWyxCejBhO+JP3NV2:9F0dAw9vxWy/jnV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834395, "uuid": "aa3d14d6-a826-4686-9707-e5cdd8403e08", "value": 21961340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834395, "uuid": "17936f4b-d74f-4d46-8db7-4f91b55a545a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834395, "uuid": "abd5da57-2538-40a4-b9e9-ccce7a031dbf", "value": "\u8840\u96e8[\u62c9\u4f38].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc94716e-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888271, "uuid": "c4c750ae-3395-43c2-853b-2eb6cd24e62f", "comment": "Malware payload", "value": "ac0372d9465ae6a538f739e6c72f2d58", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888271, "uuid": "b283c66f-1e7a-4daf-abdd-335d45ec6f9f", "comment": "Malware payload", "value": "d98c138644b114a0e49bc4c495a3ad62219f62512399e7b7683a7b8dd547f862", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888271, "uuid": "67813926-e0a1-4ab5-b5fc-09aadad01fc8", "comment": "Malware payload", "value": "adfa6d80b785f955c0c7cf8ac258a0ced394574d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888271, "uuid": "ff9ef7a1-e822-485f-b36e-7788837b10b9", "comment": "Malware payload", "value": "5d4c9d857278431089952bcb5f2d57e56f65ea29c7a17481c09f463bf5fdf5a5674faf04eea566725fcf850770aa58a9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888271, "uuid": "9a0582f2-a822-4057-991b-32070059482e", "value": "T1491142BE27D4B8A18224C700F42BF131AE54E660C0D07E2646FDE7B9939A44C3605ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888271, "uuid": "a76c4958-ce88-4fe9-811e-2f06a9279641", "value": "12:78ZW1DbuRZz1DbuRZs1DbuRZpI1DbuRZXWE1DbuRZ61DbuRZ7E1DbuRZ771DbuRO:elcTpnSB7rAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888271, "uuid": "03017ef0-5fff-4d85-8ff3-8afd962a8026", "value": 1000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888271, "uuid": "21442858-adc5-48a4-b52c-c433d4747cb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888271, "uuid": "2e13331c-65b0-452a-a778-24a430514f59", "value": "router.totolink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53db6ce2-d109-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764849844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849844, "uuid": "90b18927-f1ab-4127-b87d-109ca423454b", "comment": "Malware payload (QuasarRAT)", "value": "aacbd1ac0a4827602153892c468bf976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849844, "uuid": "5801fab2-f82b-4c0a-acfd-813568e9880c", "comment": "Malware payload (QuasarRAT)", "value": "da04c6a91ab8dcab99b842368c4f1ccd3a54033a69f63bfaf2c6fd0369f7c734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849844, "uuid": "6cc9e21a-3ef5-4622-afbe-50bc2d271ffa", "comment": "Malware payload (QuasarRAT)", "value": "ed0e3b69e03002c4020e770eee2f541c4b943b6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849844, "uuid": "65ead900-498d-49de-b5ed-36103cb547d5", "comment": "Malware payload (QuasarRAT)", "value": "28d0c5bf4fcdcd0113a0aa04cbe9ff6e7d95ecb8cc38a587e0ec9151fe0aa2c62af2c0daa794662f7132eba16b56ec7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849844, "uuid": "023f55f5-f32c-4e1d-b3dd-4ce60c4e81f7", "value": "T11EE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849844, "uuid": "5f81c3bd-eccb-4982-8789-8699eb934b9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849844, "uuid": "eec0faab-9067-4bfc-8d1d-410a7451f5ef", "value": "49152:2v+I22SsaNYfdPBldt698dBcjH1+RJ6JbR3LoGdI3THHB72eh2NT:2vz22SsaNYfdPBldt6+dBcjH1+RJ6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849844, "uuid": "a6098b2d-2fc6-43f5-b59c-2bfb1ef95786", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849844, "uuid": "f3461cfc-5d57-4ed7-b5f5-bcd5d541e70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849844, "uuid": "0385ce63-53c4-4861-b490-be289d5e06f4", "value": "ShellHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed10b3ca-d161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764887896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887896, "uuid": "85e14e5a-d7c7-4c62-af64-437e81b6c39c", "comment": "Malware payload (Mirai)", "value": "83a807820562819f13680eb8c53d9903", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887896, "uuid": "3ff0e8fe-5c7a-4ccc-9404-d7df88313aad", "comment": "Malware payload (Mirai)", "value": "da34c6140760e0e3d2a4f37fedb444947d729e9d6ebd054f3929a46cf6fa35c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887896, "uuid": "cdd5ca94-deef-44c6-9b30-6223f6bb7e16", "comment": "Malware payload (Mirai)", "value": "c467e605b4c7c4a6a9aedda2cee63f6fa501e9cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887896, "uuid": "8afd4892-29cb-43a9-93b0-6f7daf00ae51", "comment": "Malware payload (Mirai)", "value": "aca1f2b3a5eedf071f05283e700e9e55bcbbe32be923b061a258899c03ea92d3e4c5e3386e5ebdfe337dd2326e8e464b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887896, "uuid": "9411a32c-b2b9-480b-8331-4c3a7d9f42a2", "value": "T1CE932955F891DA26C2D9167AF65D528C37231BB4C2CE7202DD10AB362BFF91B0F66C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887896, "uuid": "85f919ca-52f8-4afb-8e39-d6d9caefee8a", "value": "1536:idTWLGUBOAVu2K5G5udXNUMX8O2bzqJPV6OxVulGcj8dOr9uQm1Ir:KTWLGUBOAVuzG5udF2b+iOgSqu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887896, "uuid": "56b0dde5-c1d0-46ff-a1d8-95fde4b49f42", "value": 95660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887896, "uuid": "26bebd5d-ba84-4386-813d-9372cfde591e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887896, "uuid": "a3b68ae4-632b-4120-8e33-46c887eacae8", "value": "frost.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5ccc67-d136-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869074, "uuid": "b5466c29-72f5-4661-bc2e-71b4d7107923", "comment": "Malware payload (Mirai)", "value": "9ac26f9aed85cef5e5205a2550ffaa58", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869074, "uuid": "46a593e7-a56e-4ae5-ba35-1b0b4f21d8e1", "comment": "Malware payload (Mirai)", "value": "da712fe6884a06956320118e707d8ec94fca716f1592eae5dff4d90987a1a189", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869074, "uuid": "81dba474-6563-41a2-9895-f9dbc2c50806", "comment": "Malware payload (Mirai)", "value": "6427fa19c265b2d82b95356bfbd1498cd6559def", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869074, "uuid": "0d9a96fa-927e-4e08-985d-ac1f9b4a2f38", "comment": "Malware payload (Mirai)", "value": "0332eda557b7be368590a94fbb9079309c3f9313e543f6b6892c053421e3c6f7c72913221e0d9408d512bebe4e874719", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869074, "uuid": "ccb49c60-52e3-4e80-878d-c301082398ff", "value": "T13F1186BA02E6EB83151C4F88B09D805CB5D6BEF4F4B48D95E5C6543478F53092398BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869074, "uuid": "d1bd9c30-60a6-4c60-bf1c-24bf8901d282", "value": "24:3J3wmmHwpNIB2VbKpAKdEHQPGtNdlNwTCs6ofgaRilNlstLGxlNtoMHR:ammHwi2VboAKdEHQuLdTKCs6ofg42lsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869074, "uuid": "ccf8b24b-27a2-4078-aa6f-383d5de35089", "value": 1078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869074, "uuid": "e6591438-6b63-471d-9f7c-8f74e4c46b12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869074, "uuid": "e17cc428-6e78-4a5e-b0d9-ca15e852a9af", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc9fe97-d119-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764856811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856811, "uuid": "419376b4-0235-4a2a-918e-da7e2f256438", "comment": "Malware payload (AgentTesla)", "value": "3a4b22482d0b721bc575dec6ac990e02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856811, "uuid": "910a776c-34ed-4247-9494-3c1ab8475823", "comment": "Malware payload (AgentTesla)", "value": "db2271f6304ac6140d219a6a092c757e07dbe0fc342d62b9ba83dc7e0f005cda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856811, "uuid": "bd01e186-f3d4-4b71-a76f-324175c2e5eb", "comment": "Malware payload (AgentTesla)", "value": "8d7384ce0a006f95010c9a2a067a2fd28b5d796d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856811, "uuid": "c5824e87-9b34-491b-ab45-ad57ff2ec62d", "comment": "Malware payload (AgentTesla)", "value": "fb5f13fe2c210c40b46098ed531304049b8f175d35918c16d4628bb1d7815ed0694433acebf773fd295e2acec8d76e7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856811, "uuid": "5e73a347-feaf-4400-8bc9-43003153b172", "value": "T124C4128A99D19E90C2146731C836CC1488353871EE5AB36EC71AF5AB7C70383EEA775D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856811, "uuid": "857b9877-9365-41c1-abe4-e193eea8a886", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856811, "uuid": "bceb5937-3dae-4edd-bb52-c993caba2d0d", "value": "12288:Iz7hU5I5yuNHIgzSFKxWltRohBfSTso93Ue/IF/rWmUKY:If+iN57Gtene3LEWmUKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856811, "uuid": "e8c1520a-afe6-4d92-9ead-b4b04ee149a0", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856811, "uuid": "c2fba119-0f2e-4694-b37b-dd81f3b2db90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856811, "uuid": "19d5a43e-d6ef-475e-bd7c-1ca1ab56c2ff", "value": "z41factura-9876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad8233c-d12c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764865102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865102, "uuid": "53d5dadc-6570-49ab-92c9-d969c8475d7b", "comment": "Malware payload (Mirai)", "value": "0888b54fc4b7d228c1c53827c15ebf10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865102, "uuid": "49cc6059-ff32-4034-b2ec-716aee87509b", "comment": "Malware payload (Mirai)", "value": "db9ccc4cb109160d5e308fe48b98a286af5fc226fcc2e07c6b77c2e33057974a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865102, "uuid": "cdcce7dd-cafa-48ef-aaed-b6ab8cc4ee38", "comment": "Malware payload (Mirai)", "value": "a65b3b80c47e9a72f4e5c1acc5cece0e07d5eed4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865102, "uuid": "c3777a43-b474-4faf-b2a1-64e2d3e28199", "comment": "Malware payload (Mirai)", "value": "816d873e6ab45642b98312b158b2dd61214666c70699a098f02d2f4dec3f5aba6a0432c4c264a3432f8d8aaafe5c4acd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865102, "uuid": "cba52c13-ff0c-46d2-9300-2c1deb3b168b", "value": "T15EE3C609BF611EF7E89FCC3705E91B01288D691622A93F36B534D858B64B24F26E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865102, "uuid": "06f6bdb6-d2d5-4f2f-8352-d760597bbedc", "value": "3072:5SiLTdQUa2BSRcBIZaRmIbbc7pzrSQOfBQa8Sq:5SkTdQUa2BSRnZQTcJrShfz8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764865102, "uuid": "5bc55e2c-1dfc-4dca-a89e-4c8f7aa2b2d3", "value": 157156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764865102, "uuid": "478982ef-0776-40c3-b722-ce01de55e467", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865102, "uuid": "b20d1c11-e6f5-4426-b598-3eeb4d83c373", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6fbbe3-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883042, "uuid": "a55d11bf-cb91-46a5-906c-598c9b00d01c", "comment": "Malware payload (Mirai)", "value": "27e1228377caba82fd156787820b45ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883042, "uuid": "ffa642a0-3b7f-4bec-b355-0f21f2a0ab0d", "comment": "Malware payload (Mirai)", "value": "dbb5caa5f4ed987f3302f25b45eb69d989e35f985683e58086b1b6c524857af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883042, "uuid": "5d53b646-6565-4ea6-86c3-99b2238ed12f", "comment": "Malware payload (Mirai)", "value": "95234961a932105c879a75f21fc864bb49132422", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883042, "uuid": "33645c52-12b4-4c1a-9e82-3be575e607a5", "comment": "Malware payload (Mirai)", "value": "a097833e16138510b065962da0709a3e045f4ddbde1c4d223b80dbd48f2bad5dbb50e8a45aadecf97895ccd30056d3de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883042, "uuid": "200af404-3e8e-4d05-b418-9d6238b6fb29", "value": "T1BF73122387E153FAC4AEC17FE0EB6E9AC01123089A5DE8ADED4171446DDCF56D248DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883042, "uuid": "e8df6283-cc27-44fd-8d2e-0fc9e7667e08", "value": "1536:dHvaBVZ2O8rz0wU4w9RA14mLcQ32xS+H/oL6gGnPM1MRx81PJI7yRnouy8tyb:FvaBmz0b4BLWS+HMePQs81PeSoutm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883042, "uuid": "6b5219c9-30a0-4915-b2f8-e44a6d2a6f3e", "value": 76564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883042, "uuid": "d6277281-612a-4e8d-b25e-a022dab381bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883042, "uuid": "dcf0270b-e57d-477e-aeba-7cd5fde1cf8f", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1536fa-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829401, "uuid": "4dc585f5-9af7-47ec-8e43-0649cd778e31", "comment": "Malware payload (Mirai)", "value": "c2f8b8fb4cf91895deebabc4f8c1f506", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829401, "uuid": "03cb9797-bbce-4447-8cda-54d170053f4b", "comment": "Malware payload (Mirai)", "value": "dc7f457720223020eef65377625bdd7298538f686e627d76360ef1f832d53275", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829401, "uuid": "50b1fe97-3411-4764-89b6-b709b963b497", "comment": "Malware payload (Mirai)", "value": "a26e8d1cbf59769222811e73682ea06b85564e02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829401, "uuid": "e6b0c252-7118-47e4-96b4-ae5d958f6939", "comment": "Malware payload (Mirai)", "value": "66316d1163182367a29d1dabd3dd3a5b5c83570dc51c8808df0069a5006af71c8a4031a0b32e5421798e5dec91bf4255", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829401, "uuid": "92fb595d-83bd-409e-8e8f-3dfff9788137", "value": "T101B3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829401, "uuid": "5453162b-ad1b-49a9-b515-5d479b098cc8", "value": "1536:aEkWiTLiZECcpHOWWJDmun5Pd1Oe4+YLxlrwTH+E7+TeVedVPneQBZN01Ran:oni50po9vYNlrwr7+Te0dVPZ01Ran", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829401, "uuid": "cc0ae92a-89ce-46d4-ab4e-16840db1c2ae", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829401, "uuid": "8e16d86d-0c11-4cdf-9ccf-ea52ecfcd803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829401, "uuid": "e2935897-3e9d-423f-b386-819515849180", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd343193-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888272, "uuid": "0d436b84-d16f-40f5-a22e-80c210a6dab9", "comment": "Malware payload", "value": "a9c0b38bea767d825732736e0290de63", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888272, "uuid": "415d8a2b-0e86-4b9d-850a-8fc6ddbc2596", "comment": "Malware payload", "value": "dcb0ce778de49640ee2676af63561cf3a865574ec223bdf22cd861683e5296c2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888272, "uuid": "7f74dd89-40f5-4b0f-8987-60a85228344a", "comment": "Malware payload", "value": "1229fab5c856918bfbc52fea0397524fa75ee539", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888272, "uuid": "174a7fac-239c-47a0-972a-1d89e58dddd9", "comment": "Malware payload", "value": "809473287b750b7dc05346a63158d8adb050bc38d45b346296a4145c810922b731504253614d178105607a007a4bfd78", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888272, "uuid": "54b18e33-655c-448d-a0a7-fe9b3d4d9757", "value": "T1AC11E2DE7820ADC2B558CA14F973F570F948866211D87B57E2DE9732C0BB6083506FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888272, "uuid": "07e6c974-ee65-4c4d-8d88-a407ad7402f8", "value": "24:e7kgzmkgzdkgzpRkgzAkgz3kgz7VkgzqkgzJkgi:e7kamkadkapRkaAka3ka7VkaqkaJk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888272, "uuid": "3f128619-e1a4-4189-8f42-549f352cb6ab", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888272, "uuid": "8f985067-0bff-42f4-80f5-107ace74cfb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888272, "uuid": "31b78524-69ae-4386-a9cc-e1071545ad36", "value": "router.dlink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7067b72-d156-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764883054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883054, "uuid": "89297ffd-cb07-4be6-a140-1c3dd39ca0bc", "comment": "Malware payload (Mirai)", "value": "59f1dc5d5f39b898b0846a815bb91e2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883054, "uuid": "73e07f0c-88dd-4521-b29b-76fca359a306", "comment": "Malware payload (Mirai)", "value": "dd12d67c81353b47ff0777ee5fa658c55da5f6127b9546af4a11e523b3964d53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883054, "uuid": "0f985af6-9f4d-4a92-83f4-b506395ddc83", "comment": "Malware payload (Mirai)", "value": "474e54c6c48e7f27c14d6a0429892b1783920c1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764883054, "uuid": "5250d997-00a6-4405-b693-a5e5c6bccfc5", "comment": "Malware payload (Mirai)", "value": "2ab5aab62c29e4140d9c96a84a27a5f4c6288c6b59569002e708d7d21c23cbdb26e595fce27de882cc5a314a4caaeafb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883054, "uuid": "6a619d68-d091-4438-95cd-c4b1e17da8f8", "value": "T186248C62E832ADDCC2189175B4F4DF395B239441414B6EFAA6A7CB345087E8EF118BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883054, "uuid": "748b1ba4-567c-4640-9da2-b127a0aa827e", "value": "3072:HUa4M0pcDwwKuOjFXIea8WqboxfzXRuIWCLosWzU6C1N6hh1N4K:HUx7wKuOjRsUboxfkhFzgY4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764883054, "uuid": "2f98222b-1b9d-45f0-bcae-0489484890f8", "value": 229984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764883054, "uuid": "be77eb76-9e2b-4db4-8308-51fd0b313c26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764883054, "uuid": "359e5d85-d972-4f93-800a-20447f535a43", "value": "ecco.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca9a8c4-d0a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807338, "uuid": "6df6c303-4f5c-48cf-bbcf-3bd631fa91de", "comment": "Malware payload (Mirai)", "value": "cec847072e81de3df06ebd6f83f6c709", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807338, "uuid": "f9ed14cd-6a3c-4f91-88a5-018896fb66a0", "comment": "Malware payload (Mirai)", "value": "dd256e729d52822e5f0931ff13df9221fdf0508e7519020549b699b40fbf79fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807338, "uuid": "c5431205-b1c4-4ff6-819e-448c386599a5", "comment": "Malware payload (Mirai)", "value": "f4b03029ac36c7fd0b4376c9e26e772379c9b9ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807338, "uuid": "8fd2a4b7-5b5e-4982-a9ae-e02eaa8fc6b8", "comment": "Malware payload (Mirai)", "value": "d30cac72c2c26ac4de24b5e975b3c9e47df2e6fb8de2a90df3f4987989935ab7c3b9473e38e71e534e071e0d81546e0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807338, "uuid": "86973886-dad9-4c83-890c-96d3fc66f120", "value": "T12CD3B309AFA01EFBE86FCC3706E91B4625CD592B21A87F75B530D418F64A24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807338, "uuid": "4ff9cb31-4118-42a2-94d1-945a1f83f916", "value": "1536:+ABH0n8clbNnd53SXPPriD5LRErxb2EgcZ7Y7Zow/620ZIAO4HxBBs1kMDP7m:RUtbpd53S/Oh4MywC20rpWDP7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807338, "uuid": "bf0b3b8b-4901-4387-9346-100da2bcaeca", "value": 134984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807338, "uuid": "7d3e062b-111f-41b5-9250-03322aee7534", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807338, "uuid": "002b1ed1-943f-4070-b155-d8bf3be117f3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fe7958-d0fc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764844121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844121, "uuid": "12d0ad36-734b-4eba-a3ca-0ca49f563921", "comment": "Malware payload", "value": "025699ed6311079b6052e3a50c355403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844121, "uuid": "d7a8f0e7-7694-4065-9787-18d3ff04c7c7", "comment": "Malware payload", "value": "ddab1a2783964a1f64d230e5871eb80221cae975eb348e7767c86e43cc13d6d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844121, "uuid": "de77b5af-edda-40d0-b28a-8e830a56200c", "comment": "Malware payload", "value": "8f281ea8aaddee6876e2afc0e764943258064459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764844121, "uuid": "c990d27a-a8c5-409c-b1ac-89beabb1efc8", "comment": "Malware payload", "value": "c954fe235f57147c5f313e22cb963b7a57befc52f43887b5e002ad73c0ef83503e4e25052437e153a0ab36540a2b85ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844121, "uuid": "a4be5ec6-4243-4072-96d5-1d8502354576", "value": "T15B087B42A3EA04D5E9FB9A3489E65213D673BC063F3086DF324C176A1F736E09976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844121, "uuid": "57c712f3-bd74-4618-a6db-37712522d294", "value": "a462fc6eff0b9f551757bbe7a5c2131a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844121, "uuid": "cd77169b-b0fe-4d94-bde2-7b7ffd6a375e", "value": "393216:5Eh183u6i+BptZK6a+HnV7yaG0D46lcigGZroQRqDrVtZBJSIzf67yjgIP6CpzQk:5EwTZ6+rqH5KCTuuZZfgDvxOtxxyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764844121, "uuid": "a3059093-c1ee-43ec-9218-821c60ff26c7", "value": 83550502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764844121, "uuid": "306eb6ca-6323-47c0-809a-2d3aa3222662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764844121, "uuid": "aad18f0e-52aa-4717-84b9-e05a360eced9", "value": "ddab1a2783964a1f64d230e5871eb80221cae975eb348e7767c86e43cc13d6d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb492e3-d0a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764808387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808387, "uuid": "69c8b975-56a4-4942-8977-b5469388d27a", "comment": "Malware payload (Mirai)", "value": "6536e0ee180f35834ca6d216bb703637", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808387, "uuid": "44031886-cee2-4468-a65a-a04a727e554b", "comment": "Malware payload (Mirai)", "value": "de710fc0189f22aeab0dfd1d23359525fa641aa46ae3b9118408139a3f9388b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808387, "uuid": "d4aeda8a-837d-4bd0-b592-4883455b67cd", "comment": "Malware payload (Mirai)", "value": "6aa9d087e77974533beb4dcc5a7b4a01d9258782", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808387, "uuid": "a99aec83-2974-423c-9c9d-b43db0f6761b", "comment": "Malware payload (Mirai)", "value": "0a2ec9cc9d2f4b0ab1f4aac35dd2429c4fa8ac3d34cec0eecac22ae9ce4b435bfb64091b0e1b5c1ee2be4f0d3fc99ebc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808387, "uuid": "0514db31-6c0a-4d81-881b-81f28d831569", "value": "T19623F13036672CF2D2571D3FE46E49838942DBA071F163D27701CE6D27C62872AF9659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808387, "uuid": "d4e2999b-5c27-49ba-b47f-f2905bf80af7", "value": "768:yxgC+SgAqKcN7wn2k0oDAVIqufC81RApuHYYakVVunWeeq+ml9q3UELj2E:ya9/KUw0oggfC81RYubamVunWDb1LqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764808387, "uuid": "e0980fd6-af63-43c8-bf73-841b1808ad82", "value": 47400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764808387, "uuid": "2355c25a-27e0-483d-b334-6a299ab83a26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808387, "uuid": "f8fa8eb4-7252-4a33-9557-5556d77da54b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c88b57-d0a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764808645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808645, "uuid": "7465ac5d-2eda-4bec-ae95-addb6e6d817f", "comment": "Malware payload (Mirai)", "value": "ba61b04ee24d4b07b56845f3544a1f31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808645, "uuid": "91e33a4c-cdcb-469b-90f2-83f6c1d52389", "comment": "Malware payload (Mirai)", "value": "dea53bce5b5a461576b3112383599869dcb47e35d99aac6c2f17eb57c9727c87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808645, "uuid": "5ebc217e-edba-4543-8d11-f9140f8c956b", "comment": "Malware payload (Mirai)", "value": "ea660415dda148bfdf741bd37f0268c8e0311b32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808645, "uuid": "6a3fd452-7de3-438c-9818-23516f15c8e0", "comment": "Malware payload (Mirai)", "value": "a4ff6043047f36a52dcb1169c0a06ad2fd80a98eb757bd4efe0ddd9d7777ce8f25494121b07d11d1c6cd41ef3f70da9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808645, "uuid": "c0d71fed-1cb8-45e7-9e72-689723cc107f", "value": "T1B2A37CC6E693D8FEFC5605312172AB779DB2E13F2238DA87C3A4DA31A862411D51736C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808645, "uuid": "7548d423-040a-48a5-8d0e-cc0675f5de65", "value": "1536:07QrCia0TVDNvS82RA9NR+K1/T6D0N/9XODuv5i+OSzQW:07Ea0LS8neK9TQ019+Svbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764808645, "uuid": "8555dbe2-ce97-40d5-818c-d4fdb56d1003", "value": 99668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764808645, "uuid": "93917e66-8ece-4a61-8003-ce1277ce7e5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808645, "uuid": "75f5fc8b-7ec0-4341-bcc5-647cc3e631bb", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc8df12-d137-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764869535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869535, "uuid": "71ce3d63-8fec-4dd4-91ab-95197d39ed58", "comment": "Malware payload", "value": "7b3b414c75a7a8c56f4c577f41cbb64e", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869535, "uuid": "ed3d1848-d54f-4763-85a0-87a56da5f92f", "comment": "Malware payload", "value": "dfc4a94120f64c9a388c2a977b82eca0828e8af9f5577ccfbbfe9b112835cc83", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869535, "uuid": "a1db0095-18c9-4602-ba51-ad92aef39f78", "comment": "Malware payload", "value": "32f5443ac1ccc31d00218b540b729781690f3ea9", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869535, "uuid": "e9966f6b-2e03-4731-aa32-1543b0ea5086", "comment": "Malware payload", "value": "212b4cf640a0a3bff047d18adf789663c38b9913716c6bae83485b5787c4fa17ce887ae984c3c34bf031a29d4966deec", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869535, "uuid": "9fc0649f-0f32-4cd0-a6ed-77aa7492391a", "value": "T1865522056292D92ACEDBD6745A079ED5C03E9E00F78A5952F36A73533C31FBA136230E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869535, "uuid": "291e9fb9-fe6b-4517-a2ac-94cddcdab400", "value": "24576:kkdB+HS4mJoPXfScBkyrSQFIl0x9qxslR4zjE4hYamiSi:NrOVkxQ4AREQ4hdm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869535, "uuid": "ee819ad1-42e3-4bfd-836b-2da93a94dbd2", "value": 1361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869535, "uuid": "7b541a57-80d0-4164-b231-aec33fbfcc6f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869535, "uuid": "1dd5ce68-2500-4c52-8239-a1a36e5df555", "value": "SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16118.20934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e42b08-d12e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764866002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866002, "uuid": "93da1459-c172-4297-bbec-fc937547af61", "comment": "Malware payload (Mirai)", "value": "a24065318ba63c70f21672f4561d3263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866002, "uuid": "0263e050-cc34-4abc-b7cb-123caa61e46e", "comment": "Malware payload (Mirai)", "value": "e13e453af2bf00d7353d11f3fb81859132cd1ee800b94f6b565bbe59b2d0e8bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866002, "uuid": "f68f2803-3dd2-48d9-b84a-6d3818c5d7ba", "comment": "Malware payload (Mirai)", "value": "3addd2055c0c3270c95018d6289150e795680d24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866002, "uuid": "c1f248a0-8b7e-4ee1-8099-cb16e99f53f2", "comment": "Malware payload (Mirai)", "value": "b61e1ae65a9e5b4701df5cd22abfd2e87243f27ae967a0358c5216d3190bba254636c4257af063ca5c53188b6190b681", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866002, "uuid": "96e740ec-e08a-4b33-a0c0-2f80a0d4c163", "value": "T156630232E546B2C036085D35FC6E984791E388A7D4D95DB3032C74493A2669D4FEACEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866002, "uuid": "da60d808-7a66-4835-9e45-eb078ec95182", "value": "768:553jREL+0iyzo698pVcG4Rwr5JWwdMFaquV4Qx86nx1KMq5Vi1ST3YQv9EK5Y9O6:3+z0pVewCmquVXx1yi1mGgcz9RWWaILN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764866002, "uuid": "135842ae-3cca-41d1-99f8-a80d8e26d2b2", "value": 71804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764866002, "uuid": "7763ff50-1035-4e80-81bf-d8d8944540ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866002, "uuid": "99a9039f-6e97-4da4-8956-2d3fc845b4a0", "value": "Polar.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedb4e47-d11e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764859069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764859069, "uuid": "e3df1bf6-4f8e-494c-a716-88660d25a762", "comment": "Malware payload", "value": "c06de2e126165db626c4b30f716fe5f3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764859069, "uuid": "4ab70814-8d41-4c70-b26e-faaeb6d4949a", "comment": "Malware payload", "value": "e146bb7416b425f9c673609f56ef6392e58b3bfedefa882a63b019fb59d2ece7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764859069, "uuid": "dfa8a710-5ee1-4bad-9701-17ea76ca171c", "comment": "Malware payload", "value": "dff70fe81d6c857ae4ccf97b1170fc33e27449c3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764859069, "uuid": "2e719cc9-6967-4b6e-a6b2-f502803a8a82", "comment": "Malware payload", "value": "c2d205d977775be9f1aba6a61bd09203df78ee97bc7578aec9c43b4f63dfefe072ccacf5db1758988528af68ecc94356", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764859069, "uuid": "6b1e30a2-749b-4f18-b4d0-7d06fd287e53", "value": "T1DBB423A3639B6E63C337A73071B09C79B563FFCBE076A4BBCD11694660412D1C2C56A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764859069, "uuid": "2d7973eb-07cf-40ab-b501-6d6c21b27c8d", "value": "12288:PtWZ1mznxosFO+MuaaEeYnAwzZHIDH+lQVIWtKHrw2b9bHK9tAw:P9HFO+pnEeWA8IDtVIisvxqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764859069, "uuid": "05b73518-453c-432c-acdb-8ee5f419a862", "value": 531690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764859069, "uuid": "64b0e4df-a938-438d-b3d2-adb4a1ff4f83", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764859069, "uuid": "dceafb73-0532-4f9f-b0c3-d0b06c2b8247", "value": "a.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bd44f0-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764870437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870437, "uuid": "e77dc7b1-23d1-40b9-a7b8-4f40af5a03de", "comment": "Malware payload (Mirai)", "value": "5c7e77611030a671e19e8a6062a611ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870437, "uuid": "8586f887-afd9-4cbb-950f-caabca3709e4", "comment": "Malware payload (Mirai)", "value": "e23b3ccc429821e882e51a99a0ab16a1dc96592cc189f5e32b11d3f4a373a2fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870437, "uuid": "78693a58-e6fb-4762-9c66-bb026bcce3cd", "comment": "Malware payload (Mirai)", "value": "0ab67bc37839ec72414639ca786a8c43c54e00b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870437, "uuid": "f4c14cd0-3c39-4c9d-914d-23b02c5018fa", "comment": "Malware payload (Mirai)", "value": "30730a0846bf394dca72cd28a0893fb5c1a94d464b72162439a1f031655d9c23071a7bb0872f9642baadd24c3b583c1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870437, "uuid": "416d765c-56a5-47de-8378-cec5946febf3", "value": "T1D2934B02B3180A47D1A34DB03A3F1BD1C3BFA5D121E4F689692E9B8596B5D336486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870437, "uuid": "b951c119-2b3f-4c9f-971e-b6893fb955ab", "value": "1536:wrTRtMgxWLtLcDcTD+rdiYRQpPixbbUZrvoxnH7OGdpKTq8kJ+unHxpeECO7HnjH:awoWLt9T1Y2i6wpg2+2xgM/Lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870437, "uuid": "78e39e35-ac52-4015-adbf-6ed1de94d1aa", "value": 92064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870437, "uuid": "e436dbf0-498f-4a12-80f8-e1fde786cdbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870437, "uuid": "b22cd17b-c7d6-476c-b095-2fb05a182494", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882a1da8-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764831033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831033, "uuid": "72b73a34-e469-4841-a5dc-fbec641be4e9", "comment": "Malware payload (Mirai)", "value": "6ee8434e8474ad9bfa71ea707cd6af96", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831033, "uuid": "0ec30b9e-2524-40a2-883e-49cce7f5b11b", "comment": "Malware payload (Mirai)", "value": "e24b284e3b977559d454b2b463164be226d1482bc9f38932c97615b0b357f7b5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831033, "uuid": "50137632-d870-4255-a521-7115a48b50bb", "comment": "Malware payload (Mirai)", "value": "94f159bf1bc5b026186413b507156a272cded065", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831033, "uuid": "bf34a16a-8374-4b26-bbd1-6ef17296c5e3", "comment": "Malware payload (Mirai)", "value": "f6f3aaf171769270ea8409ecca453f34d1c9c96d7de5d556e5740b84709108de375eb5acb46991ea047da5925cbad2b4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831033, "uuid": "6c9e58ec-1eaa-4366-8b8d-7edab02641f9", "value": "T1391158892857DB87391C8F44B05E803DF596ADC070FEBD16F9E59C30ACC820424B4BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831033, "uuid": "4d735d17-0114-48f5-b1bc-1fc13540040f", "value": "24:3J3wRumRaRBNIMRXKHRBRBzZqjRvhRq9RZgRJRxxRFHR:a8mQRtkLtAlhM3gPVXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831033, "uuid": "80e584e0-80fb-4c4d-82b2-abb648eb659b", "value": 1054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831033, "uuid": "71872281-7628-4432-93c4-100074895384", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831033, "uuid": "d76e6a0d-a8a8-4f8c-8d8f-6d9cf222254a", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa5a24e-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807048, "uuid": "bc908f77-2512-43e0-bc0e-b638a5e05eb3", "comment": "Malware payload (Mirai)", "value": "426ce65a90ba4029e2f6f2eb4366f6a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807048, "uuid": "d86998c4-b61d-4749-b8cb-68c4de50b056", "comment": "Malware payload (Mirai)", "value": "e2bbaa1ecea9fe9b9b78387a10e2ed8b87608cce565cd4c0cc509dcbaae48bf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807048, "uuid": "bc950ea0-5c85-4e11-8bb8-2586bb284f0a", "comment": "Malware payload (Mirai)", "value": "7bc6b6063e2ea90c8940402df8cc9ca8294997a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807048, "uuid": "dc598e8e-fd02-4803-962b-a974f7103a64", "comment": "Malware payload (Mirai)", "value": "744407fb38bd96bbaff4cce347950a5fd5b6f39a63c7233b47bd37d7a6d845cf145fb0bc3b1ff89f6c9fee97114f6685", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807048, "uuid": "f0d5dea0-3fd1-4fd5-9f0d-f7f9225043ea", "value": "T12E13E170D4AB3AE6DEB98DBA4784C28473E45A8D373199707493CF65230DC176A0A7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807048, "uuid": "de216bbd-2423-45ed-9ef2-581dfcbee93a", "value": "768:n0CI7n79gcJPwhMtcj4JCMJhOFWLBmxyjximLREuVypXM1pcDR4uVcqgw099:n0bn7yf7U2WLQxyjpjVWXM1E4u+qgw0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807048, "uuid": "bb6d4dc2-40d5-4c18-bcbb-42548878202b", "value": 42996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807048, "uuid": "10e0443c-0c8a-4ab5-99cc-fab6860672b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807048, "uuid": "4296fa6c-a70f-413d-8a15-93fd77889b3f", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187b7766-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764878950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878950, "uuid": "ac540415-23d1-498f-b974-7db43614a7eb", "comment": "Malware payload", "value": "e4ed9a578bc92befbce95c4c3f77e386", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878950, "uuid": "85d1729f-5ef8-40fe-b133-c967d47bef15", "comment": "Malware payload", "value": "e305c08cff50e6ca0cfec6c6bf9aee235c4d6e83cfad689cf138d493952fdc75", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878950, "uuid": "a4228d70-f911-4a4b-ac4f-64ea3c875844", "comment": "Malware payload", "value": "8d5bd9e2a96f027db43a655ad4b2199b6f4c3702", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878950, "uuid": "0c89bc12-6359-4bbd-bfb6-b58f2071dd35", "comment": "Malware payload", "value": "5c519b065fba349ec71732a084d5fbb3cf84a7cc4f7fb5a1385c4639ecdf1ac5c66d5cc88080aa061faa759d4faa23a9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878950, "uuid": "9246262c-ffe1-4101-96df-f4ba513d90b3", "value": "T19346F1C7F7D8A92FC877507289BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878950, "uuid": "2028c96b-abf5-4c0a-a875-20dee8ff0435", "value": "98304:TPzllroTwrYpKjofsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltH:TL0KMfyaIbaciAFvrEZpXqmY9XrF/mpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764878950, "uuid": "06bac612-16f4-412a-8329-8a1fbd706c08", "value": 5822350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764878950, "uuid": "35675383-7e7d-4fc9-b00c-b8361363ad76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878950, "uuid": "ac3a7769-9a6f-4009-bcef-991d3384dc67", "value": "Portbet88.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ef17c8-d0c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764820992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820992, "uuid": "b0b42c22-6730-42e7-aa46-66f10df2affd", "comment": "Malware payload", "value": "150393c8c3d4c0c0f5da65721168df0d", "object_relation": "md5", "Tag": [ { "name": "intellexa", "colour": "#452A76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820992, "uuid": "d056cd1a-211f-469f-9f16-abfdd29d3594", "comment": "Malware payload", "value": "e3314bcd085bd547d9b977351ab72a8b83093c47a73eb5502db4b98e0db42cac", "object_relation": "sha256", "Tag": [ { "name": "intellexa", "colour": "#452A76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820992, "uuid": "69db67fd-13f9-4e7d-8b1f-05432722b14a", "comment": "Malware payload", "value": "0078cd0894564699252c4b9ca657a91ee7799a5e", "object_relation": "sha1", "Tag": [ { "name": "intellexa", "colour": "#452A76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764820992, "uuid": "b6f37466-03e0-488b-87b0-2301e9cea0e3", "comment": "Malware payload", "value": "1a59881d13037c91232ca6d48b19d299dff7f5a5d1af2247e2b2781fea8e3d707429c7096562834a63d2892ed3184633", "object_relation": "sha3-384", "Tag": [ { "name": "intellexa", "colour": "#452A76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764820992, "uuid": "413ae4b1-2d76-4e12-af1c-17bfeedaf6fe", "value": "T10EA2320866EB7401C013B3390F9FA21477A6751F5999CA08B92C9AD13F5AD35C1E6FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764820992, "uuid": "16508e15-40b9-41a2-814c-424af6fe3730", "value": "384:/lSDHtvH81y+l3QuYhyqktqIimjgmMziksklGh:/lACQuYhyqktqVAgmMzOklGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764820992, "uuid": "342701b5-ec57-4658-be8c-7c179d4823cb", "value": 22117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764820992, "uuid": "9f73b0d0-ca69-443f-ab6e-5dd47d3f948f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764820992, "uuid": "705c2a9f-31e1-4022-8945-c9bd7be550b1", "value": "e3314bcd085bd547d9b977351ab72a8b83093c47a73eb5502db4b98e0db42cac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61c13bf-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834573, "uuid": "b5b259c3-a242-48ac-b33a-3414705fce91", "comment": "Malware payload", "value": "d311b20e3c827099fc3323805f7a6814", "object_relation": "md5", "Tag": [ { "name": "kjarz-com", "colour": "#C3789C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834573, "uuid": "dc7baec3-758a-474a-9eae-a85059644d4b", "comment": "Malware payload", "value": "e33f92accf17c9b75ff3ae4f806ea604e49aface3560ad5a0785ab18d40209a3", "object_relation": "sha256", "Tag": [ { "name": "kjarz-com", "colour": "#C3789C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834573, "uuid": "8cc02c75-9713-4e8a-9471-d00b36d7dc43", "comment": "Malware payload", "value": "fb2fbf8f09fc188126b5df3c49ded62f864f9887", "object_relation": "sha1", "Tag": [ { "name": "kjarz-com", "colour": "#C3789C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834573, "uuid": "98004b78-24f5-474f-9933-4e5155bb3d87", "comment": "Malware payload", "value": "6c065619d9142405628953e3991269520a6a0c1ba6f9000e1bf8486179fd35b71d7980511abfd583a5e52c1a113986d1", "object_relation": "sha3-384", "Tag": [ { "name": "kjarz-com", "colour": "#C3789C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834573, "uuid": "1504b0e8-12f1-40a2-92a0-367cd2808824", "value": "T1B742C0C3FDF66865E24A3EA5C078D584B2E9B4A296C5AFA21D307047558B2C3F881DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834573, "uuid": "9fb9c546-508e-4a66-960c-e66c3fe91c44", "value": "384:T3AQr5p1waPB7RHcf9EiEAL6KYuPzXRVAp4iKdM:hFwuNcf9+ujvAi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834573, "uuid": "4addc91f-46a3-441c-9688-7c6d73a3e071", "value": 12879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834573, "uuid": "6597b195-a782-4085-b277-1f98f5927a8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834573, "uuid": "7db24ee7-e29d-4a94-b73b-e4a9fe262433", "value": "j.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238376fb-d118-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1764856205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856205, "uuid": "45f5f613-2580-47f4-af80-302ea25252da", "comment": "Malware payload (N-able)", "value": "932e74bd734cda1cf79cc8d69ced619f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856205, "uuid": "15169bac-2859-4c33-b5aa-faf0635ed627", "comment": "Malware payload (N-able)", "value": "e345c01e2e0309d07da683655d4a6cdd0142cd8770d0c34b29102b0dc52b0fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856205, "uuid": "f524a2dd-8d55-41dc-8076-d22c5dcf751c", "comment": "Malware payload (N-able)", "value": "8aa18da86da2530de575b54716b8a2cb9d9bba52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764856205, "uuid": "44ea3bec-6157-4e3a-ba6e-1dfec5713554", "comment": "Malware payload (N-able)", "value": "93095949e460dbe8a77afca80740654c9d43e6013ce619750c91b1da399fab91a73bb6de67661a8da2f77b0aed338572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856205, "uuid": "7f0a078b-1683-4512-a3b7-8dbcf0f11744", "value": "T16DE633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856205, "uuid": "376c8919-b705-437c-8d38-5bb2aa812f18", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856205, "uuid": "87c121d8-bf13-44c7-b23c-19847876795f", "value": "393216:7EF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1F:MrRxvoC/7a0jUxX7h1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764856205, "uuid": "dc35904d-258a-4d30-a709-481926dfaea5", "value": 14781992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764856205, "uuid": "994cc350-9c92-4ee5-89f3-a405adea2c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764856205, "uuid": "dfb3b314-176d-4edf-939e-198af0db8270", "value": "invite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e47ef4d-d0de-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764831312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831312, "uuid": "ab3a6562-fc66-4111-b4f3-c7aeac6b962d", "comment": "Malware payload (AsyncRAT)", "value": "805ef0d13b176f08ad181cea3bb2ace0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831312, "uuid": "bcfdb511-b8e9-458e-bdda-ba271fa6ca6e", "comment": "Malware payload (AsyncRAT)", "value": "e3733d68078f927a67479fded197bf45287c17a775da4c81d3b3d4853e57d1f4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831312, "uuid": "15f2a276-abab-4ebd-b039-a820d8c99630", "comment": "Malware payload (AsyncRAT)", "value": "d7202ed12e96ae72b06507c31bcaa1c341d2e381", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831312, "uuid": "e67787ae-e007-40b7-9aec-b58bfa316108", "comment": "Malware payload (AsyncRAT)", "value": "c286dd252ec238a211a6f9d526321969a50221f9b3e4f97c3b9d12bfcc38a182eb63fd9da578746f213751e218dd74b4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831312, "uuid": "eddf8498-edb7-459a-8fc1-9c2136e7b179", "value": "T12FB4122616C5DA16DAE513B11A32E37642BC6F5DA821C30ADEEFEDFF302A750A404753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831312, "uuid": "1ab48281-625f-45ce-8c04-0dbffe4900f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831312, "uuid": "9aca08eb-11d6-418e-9c49-9f3abbf9a57d", "value": "12288:T6FKfeh2hb94dzCFycWJiWl3yZrY+pKpc/g+DIR:uIBmGFyFLlCBYNbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831312, "uuid": "b8b03384-2106-4e6b-9770-45739fd692da", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831312, "uuid": "f5c9edc3-5cfd-43f4-a0fc-292aa6f6da40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831312, "uuid": "9a320751-c3e1-47df-adf0-86d30276214e", "value": "TT payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e979e42a-d0a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764806715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806715, "uuid": "9d0583fa-0f9a-4eb6-906f-29a5887a0c58", "comment": "Malware payload (Mirai)", "value": "5b92fc0f779af2467f6740d7881d530b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806715, "uuid": "e49e1050-a93a-40ae-a3cc-10abba16fbff", "comment": "Malware payload (Mirai)", "value": "e387546c4a99a976a8635d4342ef0bb6f430b2e469eb650ca9290dd16afb0e6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806715, "uuid": "0b017c61-6043-49b0-8bc2-f3bcccc45f59", "comment": "Malware payload (Mirai)", "value": "1ab06bcd70b540419f4a9cca519829a27c4e8c4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764806715, "uuid": "994ca7e0-a710-47a2-a9b4-6b1328a60074", "comment": "Malware payload (Mirai)", "value": "b533cc4fae33f714795f558fa22d62c829e8103ea53f0241316f02390cfd0a194b5a4d01cbbf510e7693d793c68d8bf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806715, "uuid": "fa22fdb5-1ce6-42f9-9a7e-dfaef33a7405", "value": "T1C573C70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806715, "uuid": "eaf78c1d-7284-4255-aca0-ffa41168d314", "value": "1536:bpxe5qoct9fdlQBI6rrEnUFndlBotYG9CJa101Dv:Fx3oANdYrndvomgC4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764806715, "uuid": "829fc791-23ae-49f0-9d55-6d0ea3cb8f0f", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764806715, "uuid": "ffe6bc5d-1ebb-4fbd-96f1-d8a152a20b3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764806715, "uuid": "0cbba0f2-4ec6-4561-8965-b096b615e889", "value": "uYtea.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a15fa6-d105-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764848348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764848348, "uuid": "3c29238b-9f20-4ca8-873f-bf0799c74885", "comment": "Malware payload", "value": "3c3db5ce889463052045665376c61be0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764848348, "uuid": "f0e0edbb-bdf0-4c0f-bc52-2ce37ff86284", "comment": "Malware payload", "value": "e3888ed6bc225dc6656ee02a4dcd5608f7901ebfb6ba665fc3a5e0956c40621e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764848348, "uuid": "8da11078-cc9e-4c82-88de-57439210ff05", "comment": "Malware payload", "value": "fce43ac664f11a797aba396f2e9b5c245e03599a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764848348, "uuid": "ba671eef-844a-408a-acf2-1c8f891bb293", "comment": "Malware payload", "value": "90a1b8844d898cd3602d4941e1f9f690f26886e294329d82cad3d36474a3ddcfeacff2f6d9310fa498e6aef9d7145665", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764848348, "uuid": "0e2db520-244d-47dd-9ca4-1035ca40b7f8", "value": "T17FD6FBE23611E9B9815593B22F1641B0A87EC750CADA8EA5F24D8F4DB10EDC736F53C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764848348, "uuid": "902b3fba-6d26-4ef7-8f7c-d286ce724bb5", "value": "12288:Z/jshyYee5w5Qf8P8wgVdd8WaTGaodENLkCBicR8UVCgYCv2c17ExvI/sQgcV6u8:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764848348, "uuid": "47b7e0d1-a03d-4609-b0a6-e924b5b3cd43", "value": 13440162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764848348, "uuid": "7d235760-fc80-4be1-b28d-cd5e0409a913", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764848348, "uuid": "e2cfed69-e5e5-4796-be26-227439826c97", "value": "1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb8ea37-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764831019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831019, "uuid": "141d5063-0fec-4593-905c-7819457a2488", "comment": "Malware payload (Gafgyt)", "value": "dba1cefbd174bd0351de94990809888d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831019, "uuid": "7b458dba-d0f3-4d91-9e4b-43d0b916eb3a", "comment": "Malware payload (Gafgyt)", "value": "e39ae8606f7fde8f7c4f6d05820c01c0d88761828c94de707c5fd8dac60f5434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831019, "uuid": "c41c5df7-cdd3-4bf9-9e63-a1de33df10a5", "comment": "Malware payload (Gafgyt)", "value": "874b7c9e9515ef78a563d18773f2ffec4a58bcec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831019, "uuid": "fb92de10-c075-4296-a632-e60e2e083b5e", "comment": "Malware payload (Gafgyt)", "value": "63b1f14603af674c93255e8edf39dba7f0b6d57c3c4bba94fdfe957360ebdf127bb20d5c30a4e218015f8ddcd748fdf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831019, "uuid": "1cc70ad0-8e63-4303-94b6-b27613ea8c48", "value": "T1D6A3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831019, "uuid": "3a83ad02-cdfd-43ac-bf58-c1d4ffe44461", "value": "3072:Vgdr2vIBAxMyAOLRcftxhOemuxVqDr78fz1e:Vgdr2vIRyAYcfhOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831019, "uuid": "739e81b4-491b-47d1-b706-0964c8e6117b", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831019, "uuid": "fa7a9cb4-dc7f-47c4-bf9f-b4a03061fe1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831019, "uuid": "f1ccaa76-c658-4567-9839-3b3fffaa1097", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4ffc78-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888269, "uuid": "c0df12a9-b5e4-4fec-97d8-21ca920e21a1", "comment": "Malware payload", "value": "98d04f2075a1125935b73fae6f51082b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888269, "uuid": "69ac03f9-63f7-42cf-97a7-63d5bfec944b", "comment": "Malware payload", "value": "e3a16161cb77f89a5e49f4943a26f8e2f9aff459f3414ab88980e380e180cc48", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888269, "uuid": "345508a9-c704-4823-9e3e-d27a756d1ee6", "comment": "Malware payload", "value": "30f6eaaad8697f5fcf0492c1a6175e3550b7fa6f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888269, "uuid": "fad4c237-8aa8-4366-b2e9-e9883e142efc", "comment": "Malware payload", "value": "0fbcee6af98a05008a15fa615ee40e3aaff2cff99b93a66bc21cfc0875ad3527be8922a54dc8b43cbc4b97b5f153784d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888269, "uuid": "38bd15f1-8dd3-493c-9689-50800ec5bfab", "value": "T1F0113DAF2801BFB5C9D8DF01B8B3F508E505828B20C06B1682DE97B184BAD5D3913E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888269, "uuid": "0a956d8e-7304-4f47-8e8a-8787ba3729cd", "value": "12:78ZMeO70Z3eO70ZeeO70ZpaeO70ZXWGeO70ZQeO70Z7GeO70Z7PeO70Z7OeO7xkE:emuZuwupsujuKu74uVuUNkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888269, "uuid": "59b8bc90-8653-4ba5-89ea-59eb2535c417", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888269, "uuid": "b06b393c-5f3e-4429-9fa1-678e7adc6743", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888269, "uuid": "5d7bf26e-796d-4169-995b-de29b1655306", "value": "router.lblink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23eb4855-d131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764866943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866943, "uuid": "abc2a471-0821-4152-9a1c-3c08da6be5b8", "comment": "Malware payload (Mirai)", "value": "207ba7387801640cad190a01fbb8c685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866943, "uuid": "c1c961d8-53c6-4b57-ae25-a45a5036c7f9", "comment": "Malware payload (Mirai)", "value": "e3b3cfe47920a18fc373c86f99509d57289db49ec086bb8a8d4c9b84f3abcc4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866943, "uuid": "378bb067-7142-450a-9b59-09a687a431b1", "comment": "Malware payload (Mirai)", "value": "b9c6b4334322f5e2b45a3eed0c1b98b31cd8fe10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764866943, "uuid": "5f8f4699-83c6-4a0d-ad53-523813b510a4", "comment": "Malware payload (Mirai)", "value": "bdd771b1e7d3e8272c9ed04b4cd17004da245c413d74478d31f11a182956ececdef63a94ba7653c227315b16e2fd82d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866943, "uuid": "84aec1e2-8065-441e-b58c-6973e509b519", "value": "T1DBE2F1D879E64A90C236383FB66D82C2033B156982B4B6B53350571C62D6C8D77FFB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866943, "uuid": "78d88422-9e40-43e0-b6ab-c19d742d20e1", "value": "768:niLfi+jD6fX63cizKYZtPkc7PGIs3Uozw/:iuhgPpLG9zQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764866943, "uuid": "d681889e-cb4e-44ad-9417-b216797311e1", "value": 32148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764866943, "uuid": "bef6bd28-826f-4365-8161-a6828bb43f1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764866943, "uuid": "6cab658d-9f63-4dd6-b105-6808b5e98bb2", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708743a6-d108-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764849462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849462, "uuid": "43547188-4762-4743-bf22-14ff0fb49d14", "comment": "Malware payload (Mirai)", "value": "3dd2f0678076d598d9fc213edf9fb99b", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849462, "uuid": "bffadbf3-20c0-42f8-9ea2-93f19cf6cb68", "comment": "Malware payload (Mirai)", "value": "e3f68610b7ebc7aa6dcf5d884f4fa0470d350ae867d4cec48541e331d2da5cf6", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849462, "uuid": "8b4a1c8c-f0be-4d61-bb59-0513ac039956", "comment": "Malware payload (Mirai)", "value": "a497ed3a74896a157373987376cfd1c0bbddc4b2", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764849462, "uuid": "a1e574c9-a093-4155-9d99-1964246251fe", "comment": "Malware payload (Mirai)", "value": "df3e4bf92db0e1ae4a0115e8e771d0ae365e3bdc57d96a9528d0c68cec853527e43cb70fc261ddd878714da81121456d", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849462, "uuid": "22cf78c1-cb70-4d0c-850f-d801dbb41c92", "value": "T152730A46B8818A16C5D413FBFD2E018D332267F8E2DF7212DD115F647BCA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849462, "uuid": "dcdbd282-c9a2-409a-81fa-ed3f06b0c197", "value": "1536:CNniNkfWjpqh8QzWIcZMoVbmk3iBPdZvN2S5i4YMTzGIIiYNfI/bWd42+:LkfWchhzWITkjitoAi4oNfI/bC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764849462, "uuid": "1a5eeb6f-a134-4a4e-9589-d332b791e9ef", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764849462, "uuid": "d26f33b5-bd1e-4a83-b8ff-b09a3dd06578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764849462, "uuid": "e6b42852-fca1-4d5f-9509-75166155d90d", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4878d1a-d0a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807566, "uuid": "18991140-f42b-471a-9fa5-2faee49190aa", "comment": "Malware payload (Mirai)", "value": "ed7fcd5f10d8fb74beab79f00184db07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807566, "uuid": "04381906-9a0d-4156-8861-f9213aecc0a1", "comment": "Malware payload (Mirai)", "value": "e3fc379c9f1de9c19c6fe5378687300cf91558884c77cd408065c2f6acbc212f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807566, "uuid": "e1723900-659e-47e8-a9db-fc7c6f933026", "comment": "Malware payload (Mirai)", "value": "201acdc45b98c7aebf9297bf898c089793a46784", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807566, "uuid": "a6242024-d383-489b-8d9f-44e0d4c044dc", "comment": "Malware payload (Mirai)", "value": "5e0a2fa94726e65319b47695a0bf64baaef64b582c712826ec3457a8b69f4cbe45a0c260a46bd8b373f28da487e87693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807566, "uuid": "02982067-e2fe-49c7-9104-e460fb70b485", "value": "T142A32942FD828F13C5C622B6F7AE018D37117BA9D1DA3203DD25BFA133865DA1C6A661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807566, "uuid": "1990336e-c4da-4428-b2e7-051083d594b7", "value": "1536:UM1rSl3RdCue2YAOaoH3XIgPYrOcOwItwjCHilsgLrASv25AQf:UM1ridC70O5IgPYrpXItw+ud25AQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807566, "uuid": "12a3cb1e-f221-4ea6-8136-a896a1751b8d", "value": 107244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807566, "uuid": "e8fbf498-7a94-4e11-8da8-4c8314d15dae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807566, "uuid": "edc05487-9310-4b41-a5b5-80225cc0f0e9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27d785e-d153-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764881839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881839, "uuid": "f6c2181b-1fd0-41b0-91ad-04120052e1e2", "comment": "Malware payload", "value": "bbea1f0794a28fc5f57c4c3bbc562d0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881839, "uuid": "6dcb0f49-99e3-478a-8768-2c260f4c4a4f", "comment": "Malware payload", "value": "e466c12f6d18dfee0afa22898c98753353436fdf1eb2fd3041fb41360a8805d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881839, "uuid": "11ccb8ae-b6a0-4234-86a7-835dccdbae15", "comment": "Malware payload", "value": "9ec31b89ac7442f5724939bd6c1b68927317c1b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764881839, "uuid": "9de57475-efdf-4968-8a07-b7184783a28b", "comment": "Malware payload", "value": "a1753870e996e9b94c1370e22092ba33ba4f23eff5b13bca182ba1812103cd25e774abc98c206e363f665103be9f53ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881839, "uuid": "de9075a5-4147-4b8d-b3c0-2c538dcc84bf", "value": "T152C529362AA26E69C7639031E53697907E7351B16102E57BD831D3F20CE4DA6CFBE42C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881839, "uuid": "bb6470c4-4796-46ca-bd01-bf997b0cb28f", "value": "536df8a6c546a73ee3c25c2272d69d43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881839, "uuid": "b14606d6-97a3-4517-aa20-5beab033d043", "value": "24576:vLjWgicPnNfJbcduA6QD3JUHkGhXcH1holb94hXtvGnpLTD5fhkFa0va/dpU96gp:vWIPwD3J8dhXcWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764881839, "uuid": "4756af47-55fb-49bf-bb3a-c6ecd59ab840", "value": 2496000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764881839, "uuid": "2fa74cc5-2bb7-41db-9bd5-c3457ec9b959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764881839, "uuid": "aa9caea3-08c7-47f2-b7a6-b18153690f80", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aebf6ce-d131-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764867116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867116, "uuid": "84caf8d9-f5f1-4d97-a803-932c26ba4c38", "comment": "Malware payload (Mirai)", "value": "b273e1c36db02591004cbebe87c9d24d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867116, "uuid": "b190c061-5fdd-4560-87d3-ea42dbdf1d67", "comment": "Malware payload (Mirai)", "value": "e48cc41b095778d8fa995861e016b03e8ed17d94acaee927c7daf67dc68a7c38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867116, "uuid": "717d3432-713f-4deb-8703-34976dc3cf7f", "comment": "Malware payload (Mirai)", "value": "c432e7bf7fd5d8826d648c89fa9a90a6f5424618", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867116, "uuid": "eac9c858-1571-4ca0-9d94-23e473362a9d", "comment": "Malware payload (Mirai)", "value": "ea452d1a55b8fc9f657024ede3769a4130b81df172f0965c054a4730886eabef13a2e308b7e8f78f7786529ef6bf5070", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867116, "uuid": "1b171702-4b72-415f-b6b1-1d9560a3d64f", "value": "T1A6931235696DECD314F04D7FC9D18927F6752A708E3E50327A288A7C8CDA5224AF7B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867116, "uuid": "e0cc7568-79c1-46c8-846a-1a0c29b1298e", "value": "1536:zxhtzPr36vlZpLH8TswU1T98F2fOi7JvelL9XrJTamfglLMj:1DKxHtwCT9P7FelLvHg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764867116, "uuid": "5fdb353d-fd7d-4d4b-94b4-3737f2effa06", "value": 90988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764867116, "uuid": "41c9dfea-a7e3-4778-9a98-c189142dc5c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867116, "uuid": "ec2d5b77-8b36-49b6-a851-faf20ceea81e", "value": "Polar.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c56474-d0aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764808941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808941, "uuid": "08eb8ce6-ca24-4b1c-80ff-3b3ec365db29", "comment": "Malware payload (Mirai)", "value": "5a244fee5610035979ed06612627a63e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808941, "uuid": "98afcb4f-3f89-43d2-b8fa-93787daa4e65", "comment": "Malware payload (Mirai)", "value": "e52ab23f959a3b6950d3ce6a8f0f3babe9db1589815a46a7d0542d197e6d4d38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808941, "uuid": "ebf164cb-3630-4e17-877e-43997b0a67cb", "comment": "Malware payload (Mirai)", "value": "cd9044d599d44b97e1aac7586761e4aea8ab60e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764808941, "uuid": "053822b4-b240-4f2e-9fd9-2721019c6f7e", "comment": "Malware payload (Mirai)", "value": "c637f29852561c1c9de900f4805a80c57cfbccabd39a41380e706a4bdfdfbc7d6f21412f0303283daa06668dc2e4f5e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808941, "uuid": "bfa4f9a2-f738-4874-a38e-aadc8997c40f", "value": "T165932892BC828A2AC6C113B9F66E258D3361B3E1D2CF3217CD264B1277D524F0DA7E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808941, "uuid": "99e84893-9c94-4ddd-9a56-4671b89aaf29", "value": "1536:0ZNtcUPP/wpzNBQn2KRYkV4pXXlrPvW45SB7iWJqo:0ZNtcMJQlrGQSBu0qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764808941, "uuid": "ff6a45bf-f6c9-4899-8f7d-ad30a3537b1e", "value": 92832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764808941, "uuid": "0649074d-fb78-4cae-a370-0f33136cdc2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764808941, "uuid": "4decbcc1-1cb5-49a4-af28-3b3256ed8df6", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff08d7f-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764834617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834617, "uuid": "12dca457-05f6-4ac8-88e1-be2dbfd4b450", "comment": "Malware payload (Stealc)", "value": "7c4b78ba32b22cf3fcefece7839c6027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834617, "uuid": "92738348-4ea6-461b-b9ce-3bcef4a24d9d", "comment": "Malware payload (Stealc)", "value": "e5aeffbee83d9bc25e3b7dda0906045d0cbc0feca9dd3229ce224be752c7c3d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834617, "uuid": "c38117e9-7a90-4780-a2f6-b774a8ec03e2", "comment": "Malware payload (Stealc)", "value": "d53e3186288be45eb7d67995505698111c75dcca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834617, "uuid": "e920af64-fc33-4f4b-b17c-9c3d5e89d5c0", "comment": "Malware payload (Stealc)", "value": "e5ac8400692d9ceba3c279810bc8382c9d9b60ea1da6bcbfacc4c1c7f4873a47380ca583163495cb1968f496707a2570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834617, "uuid": "3aea5d73-1c85-49f1-b6d9-a5956bc53c97", "value": "T174058C1AA7A503FAF0AF8374CA428842E7B27C455770D74F03E196A62F37690993FB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834617, "uuid": "1bdfeb9c-18c5-4d7c-945c-5db27781c0d9", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834617, "uuid": "e83f9145-3931-4c6f-95c9-9a9b938013f7", "value": "12288:eGLVpIo/cBJ9InRPehbyv8plnEFSv3YZtF15kjHP:ekkBJinRP6bw8TEFG3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834617, "uuid": "308dd433-58f8-4afa-ad0e-bcb917775007", "value": 797952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834617, "uuid": "1b36221c-c5e3-4709-a45f-1a29aee63875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834617, "uuid": "14258dcb-69cb-41c8-a54d-7105eb8dde44", "value": "yy3n4glt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd43f62e-d0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764839739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839739, "uuid": "b9a04d7a-76d1-4514-ac43-1c85d3b3f2a9", "comment": "Malware payload (Mirai)", "value": "33f1ec8226e562b43e09c552d4b54a66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839739, "uuid": "b19a9e6a-39e9-46ea-b5fe-452674084396", "comment": "Malware payload (Mirai)", "value": "e5c198727232c9a0988e87735bd94c0908e042b8b89d3545eb870910ab5a2ea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839739, "uuid": "2ebb34a1-6ba3-4c46-95c5-25b54115270f", "comment": "Malware payload (Mirai)", "value": "3386d23209aa34e808c9a094da037e21ce417220", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839739, "uuid": "12dd390f-cad1-40b9-8921-e748fa92dec0", "comment": "Malware payload (Mirai)", "value": "dad252e53f54214fd614fc251fe891228e1733e7ee4e68df582560831570d40f95bde916b16f8668f9225a99261ea19a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839739, "uuid": "3b7f7e7b-0cbf-4f6c-95ed-1a50d6813832", "value": "T1B4445C1379BA1C1AF4D0913651EB43A2BBE153CF20785F1AFE640DC9AF276A076432B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839739, "uuid": "442e89ea-f153-4bc1-b31e-d38ef1890f26", "value": "3072:FyLl6RuXs5o3mU7s/0N06x42bUAY0BhAMGuUI+MWpQ:FPR3AmCs/0TDAf0BrBUI+M9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764839739, "uuid": "5d562b37-f119-432d-8d41-f0495031b788", "value": 263584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764839739, "uuid": "693ee0de-ce85-4fcf-bf6a-5ff78cc27a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839739, "uuid": "82113b3d-2290-4d0e-8816-6c7cbf6e23f1", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f811aa-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829902, "uuid": "6cd0d36f-7982-46ce-aa7d-2130867c8de7", "comment": "Malware payload (Mirai)", "value": "96ecc2a6b1aaa839c0dc4096d2af4fdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829902, "uuid": "0dcbf7df-694d-4696-a7d7-8d8db5d070a9", "comment": "Malware payload (Mirai)", "value": "e65f5bf7c484e697effd8733a6117524f29ba61390a88c021054a8c8eb59ceee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829902, "uuid": "462748d9-5cbe-4b62-b401-8d9d777880b2", "comment": "Malware payload (Mirai)", "value": "d25b3c119e04519c0962a1421aa8dd7b004e535b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829902, "uuid": "1341df14-f431-473f-9f92-ab814b7d83bf", "comment": "Malware payload (Mirai)", "value": "272f52d37e6d1b1cb7cb385197c0a2b29f8cd400d29a54981c16f1cceba9e9c0b1b03417e2499515d3be223d6731fcf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829902, "uuid": "0500ef8f-51b2-4c18-9a52-dc889968916f", "value": "T120531222950378BAE7137D7BB7E04FC3FA0D4B32B599643D216521A8F6F55212C712CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829902, "uuid": "379c19e6-6cd7-4f3d-96e4-0f63c0b0929b", "value": "1536:L7XduYshWhq/HIEy6Og3Nwz9hAyGLSM5Tfv83KJGTb6R4x:HdpssMPR9w4yGLXTX83K0Tb6RC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829902, "uuid": "c6f40e4d-785f-498c-b33d-7308c23b4a5e", "value": 61848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829902, "uuid": "1248ac96-d76c-4e01-9734-641ffb34d906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829902, "uuid": "330e0f92-300d-49e7-bb33-da31b654b162", "value": "ub8ehJSePAfc9FYqZIT6.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28581aee-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764872963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872963, "uuid": "a35a6e13-ecbd-4403-b817-90e2c3c240ca", "comment": "Malware payload (Mirai)", "value": "fefc44338be3561758f81f98d4461fdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872963, "uuid": "2f436717-49ee-4cc5-9e2e-16db74776e05", "comment": "Malware payload (Mirai)", "value": "e6ab786b982a290353258593f1e76fdb35d6f7057a4994478875ac3d46e828e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872963, "uuid": "fa99121a-0a9c-4539-bc4a-2e68d4efe0ec", "comment": "Malware payload (Mirai)", "value": "3bcaf0e7ceb219fdb70baf00c534cf63320b1ae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872963, "uuid": "a95ad3ef-9cee-490a-9105-240ec6fb2835", "comment": "Malware payload (Mirai)", "value": "602026337e4f6d453b1c4f14fa168fa22ec1be9fc0b26d3884d320b9df89fa6f833232cd7494dfdc53bb61c0a88121b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872963, "uuid": "d9c95372-06a1-461e-b78d-412140085cd4", "value": "T1EFC33A41BC828A63D6C71376FA6E11CE371163E8E3DE7203CE259F113786A1B0D6BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872963, "uuid": "946b44b0-6e18-4bf6-afab-08efc5ef234d", "value": "1536:OKmFkAOKL8lbRUysUncuRbiJB+L35iOEGbacQ9LHxdEY+AqgCvA5xTe:OKmFkKLmgc5iZhcQFxdkXjA7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872963, "uuid": "936c79c3-a456-4000-9bc2-c2e9ccaa1954", "value": 121376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872963, "uuid": "02196305-e95e-4ef0-9ba5-1b76fbc2448c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872963, "uuid": "ff9cbbf1-5bcb-4dba-9aa4-98a1fa16654d", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c4c105-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834491, "uuid": "3d8c7530-76cc-4c80-8266-5e19f36efb58", "comment": "Malware payload", "value": "7901779760bc65b9407d0ac8662511f8", "object_relation": "md5", "Tag": [ { "name": "kjarz-com", "colour": "#C3789C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834491, "uuid": "9ebd6ae7-eff9-4165-84b5-351873d0c7f5", "comment": "Malware payload", "value": "e6e706d5575672d029d9c816c360a0595ebcd4c81b044f81e1e520542c0bcfe7", "object_relation": "sha256", "Tag": [ { "name": "kjarz-com", "colour": "#C3789C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834491, "uuid": "99b37c18-1333-40b9-9f06-e8f022b85c98", "comment": "Malware payload", "value": "976d94ffd3f2823ceed59a37157551e0e5035df0", "object_relation": "sha1", "Tag": [ { "name": "kjarz-com", "colour": "#C3789C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834491, "uuid": "9361cd8b-a8db-4bd9-bdf5-9236a72224d4", "comment": "Malware payload", "value": "7f7035c9b2ae86b6d51719fa5306225f0dca203ce6ad9eda8d7f6a523b6752381ab761826960d1ec6dc2ed2b39476445", "object_relation": "sha3-384", "Tag": [ { "name": "kjarz-com", "colour": "#C3789C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834491, "uuid": "4879dbb2-12d5-4070-a9bf-c874fd1a7757", "value": "T12ED0A7A6B89CCC8527DF60901083694D23BA8793CA3801B561885D456C58911C7FA1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834491, "uuid": "8b27a3ba-cd99-4637-b292-c0b18f8ed78d", "value": "6:s8SMVnxV7NevE8ydH1O7kC9kO6hrupHCBtOmCr/q4:s8z9evE8ydH1OgC9kO6hcHCXYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834491, "uuid": "c8375e88-303e-423c-8c38-7a26f879ff49", "value": 229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834491, "uuid": "ad3eb90b-217a-40f4-9bcf-257b2b616b00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834491, "uuid": "6e2dc60e-f77c-4e2c-bbe1-10be1e99f84b", "value": "new ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8be3c04-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888265, "uuid": "5d3ebd53-0df7-4f9d-8c3f-86fb57475844", "comment": "Malware payload", "value": "ccfc59d47c18ed877f11a82a7086e2e3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888265, "uuid": "0aa9feb9-ce9b-48ae-b285-0c1eb62eb352", "comment": "Malware payload", "value": "e705a02a911d69d7d09352a040254d7c86b3284e3e8f68edbd68d242b025c3ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888265, "uuid": "23475f92-5a64-4f61-9a50-dc8b188286a9", "comment": "Malware payload", "value": "8866a8bc3f05540e2f659d82db887db89c2899c5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888265, "uuid": "46ecf3e8-fc6b-428e-9ace-a686f944373f", "comment": "Malware payload", "value": "f7320577d5c7f4bc86aa16c29032fda40cd5ca9a3478b39df023fad38b7aa8d999f244936aacbfe9594ae3541eaf8044", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888265, "uuid": "598fc853-f568-4217-b609-c80dac3db9c2", "value": "T1BD11008F385176A4CD98CA0078BAFACAE267568D10C0FF26A0DA0E35C0D960C3D12F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888265, "uuid": "a56a52b6-d535-4e0e-97a5-8a77731c2555", "value": "24:eX7mJw7mJh7mJpt7mJS7mJL7mJ757mJc7mJF7mL:erEUExEpVESEXE7ZEIE9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888265, "uuid": "1c8e811c-20ba-484e-8576-8c269413e28c", "value": 940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888265, "uuid": "11b308af-4549-4bef-b6fb-334417f7cfe3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888265, "uuid": "a49b4055-c2ca-4a28-89fd-fe534061bf6f", "value": "dvr.lilin-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7f986e-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764829351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829351, "uuid": "3a393695-e668-4c46-a8f6-beed0d67acad", "comment": "Malware payload (Mirai)", "value": "978fe917aaf3f31f631569dfdd7474a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829351, "uuid": "7f670b1e-8afd-4b68-ae63-4cfd18c77f64", "comment": "Malware payload (Mirai)", "value": "e7110bb80c531bee344eaf36017d9b9fbda772c9e414cae44546836569318469", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829351, "uuid": "59cbbce2-9b0e-48da-b2a0-183e64fef781", "comment": "Malware payload (Mirai)", "value": "40e2752d7910b2b00b900cbe017bf7540b6a32bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829351, "uuid": "4a0857fd-21f4-4dce-9640-c5d7aa2ab7d4", "comment": "Malware payload (Mirai)", "value": "61c112b53c04957c641ecb1f72981d91dcee4a81206146f69d8f2b54dc7952b321aa8f77c54e52186d6d39d482f1b4b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829351, "uuid": "d894e7d2-75ca-42af-a639-91761edece4f", "value": "T14413F1730899ADB2C2790D32D84E166A7F3B0BADD275743D321C06A8A54224BF97C2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829351, "uuid": "4e9816a8-98f0-4c3c-96b3-a39500a111fd", "value": "768:liifDEdlpr8S3nuzKg+t4q38MmTDzXmjypcOVR2s0+PNoSGps3Uoz6:jDQVqzT32+FCsVG0z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829351, "uuid": "a769c305-cf6d-40d7-8d89-01f7bc8ad8b2", "value": 41628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829351, "uuid": "6ba083ce-57f3-4f22-818a-53bb98d8598a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829351, "uuid": "ba3965f6-d584-4a15-9d07-bde1f323ce1f", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9189ee8-d109-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764850067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850067, "uuid": "3e95e91c-ac32-49db-8b3b-4c6e117bbf2d", "comment": "Malware payload", "value": "746dcc726eae201198187d9e7068de4f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850067, "uuid": "074a0501-1086-4882-81e3-ab4f8306df44", "comment": "Malware payload", "value": "e756a707443f382f4f93ca4b6101de16e4cac521d9032171c7b68b3a9585c39e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850067, "uuid": "3943b3e6-8031-4d95-8eba-965a9a0bd79d", "comment": "Malware payload", "value": "bb0c5fb186d06ed0f4246bff6eed93c10dfc8a43", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850067, "uuid": "61655489-4bb6-41e7-be40-da836fced714", "comment": "Malware payload", "value": "b7d6379b2855792d8939b4d943716d603e42e05c4aa64f5356782ef6953cc52a75dff8832059c7373b426796be51708d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850067, "uuid": "16acdb93-7d02-4e93-9d23-6966525b6511", "value": "T1CB66D1C2BFC5D389C6B65A3E0575916513618F3747A38AD73E98B7344E333A05A8AF80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850067, "uuid": "e1137618-999f-45fc-a495-0ebdd0e01500", "value": "98304:pWtwxwP+ASFAMJaPfuAiAtBBX/mdwNeBVD16xYkfZyEG6v2nb:pWtRSF2fT/FNev0ZGZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850067, "uuid": "74bb12ba-43e3-4b92-8f70-74d0e5e85e90", "value": 6645020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850067, "uuid": "a124bc7f-9fef-44ed-b717-81c8a1482345", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850067, "uuid": "68b56d38-1a2b-4a11-9d8e-322aa222a8dc", "value": "mParivahanV1.11.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af62dd59-d132-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764867606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867606, "uuid": "9fadcc9b-b8c9-4003-b42b-f18ff86099be", "comment": "Malware payload (AgentTesla)", "value": "4b9cc7d84e87fa8fbcb3115c765ce361", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867606, "uuid": "6d84ffcb-0134-4a62-83e9-20284f56a41f", "comment": "Malware payload (AgentTesla)", "value": "e7e637ddff53d65c5d1645cc6c3ee595319948e7db913fc283a7da7b5b21a626", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867606, "uuid": "4485373b-ed35-4275-b866-a5ce21749776", "comment": "Malware payload (AgentTesla)", "value": "487b40d11907c7fbf6f6595a87f7f301cf9c9f53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867606, "uuid": "bb93b5e2-df14-4b8c-b384-0d0d6535baad", "comment": "Malware payload (AgentTesla)", "value": "c4045027230d44b90c506e767cc2e977f7ead83f9b084c0bd9a9eedfc05e00e1609591d7b1dcfd05e25cb34cccd875d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867606, "uuid": "1da65908-655f-4505-ab57-cbf549c066ff", "value": "T18D35AE027391D062FFAB92334B5AF6115BBC79260123E62F13981D79BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867606, "uuid": "87116fe1-57c9-4b52-932f-ee6f381c6f14", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867606, "uuid": "3bd81efa-cee9-4e3f-9d87-b7e0dcca1b09", "value": "24576:45EmXFtKaL4/oFe5T9yyXYfP1ijXdagsmLxDjnq:4PVt/LZeJbInQRag9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764867606, "uuid": "749dd1ab-edc7-4274-a8d2-0e13d44aac3f", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764867606, "uuid": "696619ba-8c34-4af5-8913-09fee3aa229e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867606, "uuid": "1e65a360-a58f-46e7-9212-7ba4d07c6040", "value": "rorden6743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f4fcfc-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764872961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872961, "uuid": "396ee6a2-92d9-4002-931f-6988b4de5453", "comment": "Malware payload (Mirai)", "value": "9721f0066cf5028b17e46fa3ec3885ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872961, "uuid": "e2aa3623-f289-46b4-b98e-6e2c25b7df29", "comment": "Malware payload (Mirai)", "value": "e8931391d0092f3e57c4737824e61e073ddc931b96214cf07565eed4dc6482da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872961, "uuid": "89df015e-22e9-475b-9c40-c25d5aa5f168", "comment": "Malware payload (Mirai)", "value": "fbe1ee0a2941a0b907e9c91fcf1467ee2b6eaef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872961, "uuid": "bfff382b-1486-4c29-930e-10e87fb3460c", "comment": "Malware payload (Mirai)", "value": "641facd6111e02c00e33abad34900359ad72a1a677ba05d13d791b7db27ec4bebf4fec84a77051f88121ec992ee4a992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872961, "uuid": "c5e96da0-1b46-4210-85cf-7ec6f28539e8", "value": "T156B34B57B9C18CFDC2A5C13407BE793BDC21F0DD0238B29B67D8EE266A4DE610B19949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872961, "uuid": "c119480b-016f-4f1b-aa28-5431a242612c", "value": "3072:PeKYd+ctkV5HQWKIWRge+6XP//x1LdeDbo/iLPRy:PeKYdhkV5HQWKIWHL4/o/gPRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872961, "uuid": "af51bf49-fc02-4916-9340-37740f64355b", "value": 117216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872961, "uuid": "829a9a37-6d63-4499-8575-b53d886c16ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872961, "uuid": "34320af2-e326-4681-ba9a-8da1998da3e7", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e7b263-d0d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764827292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827292, "uuid": "463d1094-30c7-4ca7-b427-18cdbeed2ff1", "comment": "Malware payload (Mirai)", "value": "e7d05b406bea3da39b8e83931fd44e85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827292, "uuid": "d5741c3e-609c-4d3f-ba06-c54c0b2120ee", "comment": "Malware payload (Mirai)", "value": "e896f269ed4e87b3967bcd804c67dde4722a2a8b327c0095f95bfd4e0e662d32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827292, "uuid": "3ef46fee-1d16-44a7-b151-b7fa48bca174", "comment": "Malware payload (Mirai)", "value": "1af9318343f70328c37e3cde20abc78641b2da9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827292, "uuid": "958d71c7-c450-4c83-9284-18f4ae45065a", "comment": "Malware payload (Mirai)", "value": "04a34514eb0238a32ba2c1188a2f276b0bceebc1c6c47da02ab7388bdb2b8d9374b7be2be480c603446ba6166644d4e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827292, "uuid": "b7796bf6-5c56-40ad-b1c0-f67658c0b6c1", "value": "T1FD715FF9205A4E707E5B9B5731F48B0A32895B9F90C2AE85EDE93CF811CFD1875449C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827292, "uuid": "14c11900-6f00-4768-b2a6-4a853550bf5c", "value": "96:iNJklqhNy9+F0Njq38PNG5qZINYfcr+NQH0zWN9AhuVNR8tipNYfcrsLNT6HsfND:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764827292, "uuid": "d6060ba4-1d5a-40ba-ab71-7a28c64422f7", "value": 3704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764827292, "uuid": "24b59c17-7d11-4fc5-846b-0412b562784e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827292, "uuid": "27d6718b-bdd2-465a-b60a-5edac22a851d", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81b70f6-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764829047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829047, "uuid": "7f5b7b25-be45-42d3-be41-5dd7773cf46c", "comment": "Malware payload (Gafgyt)", "value": "b8ebc255e4cd4b8375cd0f81836702df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829047, "uuid": "6b52089c-7610-4bd7-97e3-90eb85e47052", "comment": "Malware payload (Gafgyt)", "value": "e92c1f4721b5c1248e1323bc324ccde665f4ba733aa82ac37339e28b1540b16e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829047, "uuid": "295520b6-c181-44d6-a082-c7bd34f4536f", "comment": "Malware payload (Gafgyt)", "value": "e0752ba43367ca301df4f5d023263276cdfe14a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829047, "uuid": "fe89024f-1d14-454b-a0a0-f379d6d4c807", "comment": "Malware payload (Gafgyt)", "value": "29820a3b306f51fbe6ef6e57f373aedfead65474506255735f1bf17eef1caf5d8b2ec8c6f734ac41a9f5e79078d4f963", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829047, "uuid": "ac8eaafb-b223-45b5-8011-0594e6f4e45b", "value": "T13483F793B901EEB7F40ED67644D34B247230FB624E931A22731779A6AE362D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829047, "uuid": "fbb8a642-697a-4e68-acee-9046fd0abb0c", "value": "1536:2v8A0UlZxWb5f584AqOwL4YMVMKxnT0yH5l1NC9Ob+xknV7BGHbHImzS02q2/cOG:cbHAbBryVrxnT0yH5lrC9G7Brmu02q2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829047, "uuid": "a33a30b3-5196-4ee5-a9b1-f536beec22d0", "value": 86515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829047, "uuid": "11eb411b-7680-48cc-88a2-837b33e4aa83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829047, "uuid": "9bda9ae8-e97b-4977-a2eb-34475ee16804", "value": "bootingworld.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fa4ead-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834145, "uuid": "b570e1e1-18f3-4440-aa71-7ae767b7a08d", "comment": "Malware payload", "value": "924c3415f750a80dc5462d7ce68c4e5d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834145, "uuid": "f5b69894-166c-4864-bb42-ec9082cb6bb7", "comment": "Malware payload", "value": "e93d21282e2da4cd478c2db2ff11f7d929a2f2c41136bd70d554107437cd49bf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834145, "uuid": "c78fcf57-0970-40be-a6b3-2e9192141945", "comment": "Malware payload", "value": "a009513143754d3c5e12a62189ec67af349b3b99", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834145, "uuid": "df69980f-c174-4884-a0fd-4de08aeabffc", "comment": "Malware payload", "value": "800739efda5b405c6a4fd4d7e1b52a995cfc98e3748c48936e6994d19e9631ca3518ce7ff486f01049d82102fc0832dd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834145, "uuid": "5ab239c1-0b8e-4f08-a068-9f2127a780c0", "value": "T12156F1C6F7D8A92FC8775072C97E52B151878C028A839F836D18760C69BB5D42F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834145, "uuid": "583de520-9fea-42b1-9ff0-ae00d0cd1c98", "value": "98304:5xKoTwrY5K8Yofsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpClt7:JK8HfyaIbaciAFvrEZpXqmY9XrF/mpC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834145, "uuid": "d7aeda88-2035-4de3-962c-e0c3fcc79509", "value": 5898778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834145, "uuid": "1155b764-f929-41cb-8562-07857c595423", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834145, "uuid": "8f6dd111-8f5c-40da-a533-626328ab22a6", "value": "Adugaming.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d108c02e-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888279, "uuid": "b194141e-7f60-4a36-91f8-3defbf1a55ee", "comment": "Malware payload", "value": "42915bd87153602b0622dcc296264d5b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888279, "uuid": "edd4e3b1-807f-4635-a2fe-12fc7312f1ea", "comment": "Malware payload", "value": "e96838fec3fc9c0853f992769da7ff182ec44e61703e31c9927d0b7bfee2f50f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888279, "uuid": "0522267d-df19-4de0-aff4-d9cc87cd9764", "comment": "Malware payload", "value": "883d2f5a91f8dc766822437be4ea60791a775c1a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888279, "uuid": "7b3147c4-3bf4-4bf7-997c-0c24cea28df6", "comment": "Malware payload", "value": "68255a179fa443314123247c22120389642f3a0411cb91605214230286ff02d647785fa49ae32c82265867bd1c8600d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888279, "uuid": "5663a53c-d583-4cd0-bd1c-76ab155625c1", "value": "T15711866F7D155D8C9214D78074F3E5426A0F938D60D03F5531ED473DA0EE514F511D6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888279, "uuid": "2586e272-d204-453c-be19-e94fcdd46c9a", "value": "24:eMSRWIyjSRWIy+SRWIypySRWIylSRWIyoSRWIy72SRWIyXSRWIyqSRWIEwK:eMSdyjSdy+SdypySdylSdyoSdy72Sdy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888279, "uuid": "72802dc5-98ee-4357-aaca-193e3a3a25bc", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888279, "uuid": "444b2176-7702-4e73-8614-19855651fde6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888279, "uuid": "878b443f-6f54-466c-945d-e473f2b9effe", "value": "router.aitemi-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25580e0-d124-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764861598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861598, "uuid": "382b770a-4096-416e-a4d9-7d9b17327143", "comment": "Malware payload (Formbook)", "value": "e996283e4a4a787ca2c560410ef8f6b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861598, "uuid": "89892393-0644-4adc-be26-343001ebe0cc", "comment": "Malware payload (Formbook)", "value": "eb91cd66e60f105d9c783da4d6d121b79906f4f2b702650ee444c262f16489d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861598, "uuid": "803d30a8-e2ff-4608-adbf-65f7eabd6d31", "comment": "Malware payload (Formbook)", "value": "29ce10527e09b370407a8766fddf89b573ed1a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764861598, "uuid": "56b9177f-91f7-4908-98b9-7925c4e40462", "comment": "Malware payload (Formbook)", "value": "b0540d64d4153b37d8f199679350538c3d3ba4eba11402f522e8fca0b502e2da8040cd7d9ea5882f489ad687c0f7f7fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861598, "uuid": "80d731b4-da00-4623-b14b-3d73949f2e5f", "value": "T19A45BF0273D1C062FF9B92334B5AF6115BBC79260123AA1F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861598, "uuid": "3d67bb25-0840-4e04-b740-2911c6de96d4", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861598, "uuid": "af50dd42-020f-4e21-8a99-71318a6a7575", "value": "24576:k5EmXFtKaL4/oFe5T9yyXYfP1ijXdannF2U6rls8hS:kPVt/LZeJbInQRan/gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764861598, "uuid": "828d1909-a741-42f0-b1ca-92310c7b30ce", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764861598, "uuid": "3d7140c8-6337-47a1-8c0e-2ddb137acdfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764861598, "uuid": "c8bd197c-8567-4814-b88d-fa7f69523918", "value": "eb91cd66e60f105d9c783da4d6d121b79906f4f2b702650ee444c262f16489d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95e132f-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875408, "uuid": "e91c53af-2eb6-4dd0-bff9-51eb4931a540", "comment": "Malware payload (BlihanStealer)", "value": "16e7de273be07caf4ca9d183e15d8534", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875408, "uuid": "f99867ed-d39a-43b4-82bc-c872022138b2", "comment": "Malware payload (BlihanStealer)", "value": "ebb5e57a1e3266037b89fada7fb43986df5462bf58d0374b8e8492d6ce71be69", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875408, "uuid": "79ee93a3-a6b7-424b-8064-5d66012db4db", "comment": "Malware payload (BlihanStealer)", "value": "b4c0a52d4004d10b9384f3109bd5ccf24a9eb96c", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875408, "uuid": "5ba3e2ea-3d90-463e-95ec-936c74dee3dd", "comment": "Malware payload (BlihanStealer)", "value": "fa05bcd09d7fe843ff16c773b38ffdfbcf3a33b9bd39861c8427c76b89cb43ec1ea686a6731cfbcfbf7574824f242776", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875408, "uuid": "e8c0a868-ef37-4ca5-b506-15fe007d5013", "value": "T1D2C3E70B6FB1CCEBD851043A57BAA22D86E7BC440DDCE35687DDCC4634D2918C8AEA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875408, "uuid": "d06c0927-aa08-42e1-a4ac-554952c1f51d", "value": "f68ddef5f29b66bbd543e947c8743bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875408, "uuid": "34f08965-da7b-42de-b2a4-a12a7c0f9541", "value": "3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hK2:eene", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875408, "uuid": "055d47fe-1661-408c-aa44-d1354be21d61", "value": 128246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875408, "uuid": "6cc2c604-7371-41d2-aa1d-b847c186cab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875408, "uuid": "986f343b-0858-40aa-ad6b-cafe9fb9a821", "value": "6bzix3j.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d6396c-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875459, "uuid": "ce2616a0-9274-4b31-84b1-8de2ae770428", "comment": "Malware payload (BlihanStealer)", "value": "88b9e9e54cfe509408bc740f00ed0a71", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875459, "uuid": "a2287f3f-b752-4802-b4d0-9423a9f7fdbf", "comment": "Malware payload (BlihanStealer)", "value": "ec13ab00ebabb8018c6fd97c85cf0d6089deb52d4936c3c8a7d88823df6b4bd1", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875459, "uuid": "93880370-95ac-466b-a513-bfc82e38f3b8", "comment": "Malware payload (BlihanStealer)", "value": "19185db14ec632edd5dbdf7cb86279ce6b3aa0a3", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875459, "uuid": "824438c1-b519-4ace-8869-730bc4b089d4", "comment": "Malware payload (BlihanStealer)", "value": "6cedd31f47ed64d623fb3ff1cc9c748aaf784968d2724ed1f763cc6d5bb3d56a6b639820c800fc7ee6fca9fd34b38b39", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875459, "uuid": "53d5390c-4507-42ab-a21d-18ec6131f8c7", "value": "T12AB36C139EC3C9B6C4A121321AB9967DD2EFBD051FEDA38387DD9C0922525C4DE2E643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875459, "uuid": "a059a1f7-6af9-4a5a-8048-fcc1259fa3b5", "value": "757708ca9fd3f4d0b8bef404d6ad71f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875459, "uuid": "c762bfc4-b446-4cfd-8faf-4b151a8e5215", "value": "3072:vAowVFgjQiUkEwt/XqXBn22n2222IICUrh1EasEE1YCfCnEEEE1E14AK1EEqE1Ek:oAjTUkfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875459, "uuid": "9b411ae1-6ff7-416a-85c8-83f79924740d", "value": 108420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875459, "uuid": "78dc7a9c-5d2d-4ff6-bf66-06218892fbf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875459, "uuid": "12aeb863-c283-485c-a639-6c71490f0a00", "value": "9deb52d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd26e32-d14f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879923, "uuid": "6e61d064-a2f4-4606-b758-8b20bc1bc3c9", "comment": "Malware payload (Mirai)", "value": "773672cf2f1ab9a093f1bd1e9e2a3186", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879923, "uuid": "4c3a1ac7-0202-4e9b-9f93-2651c2f0fbe5", "comment": "Malware payload (Mirai)", "value": "ec15a07b61e50dc800ed79dd2179de5d3615587316ca8b20e0b4b261a361a8e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879923, "uuid": "e4e2467a-adc4-41de-92b1-c3d66ce85b38", "comment": "Malware payload (Mirai)", "value": "b39b79bd3f607b9edf2d45575ecda37ac7b9f065", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879923, "uuid": "f09f7988-53a6-41eb-a18e-c22fe5ca0a96", "comment": "Malware payload (Mirai)", "value": "a151592ef4205078d26e2d37ead605a03f65ab988f2bc4e72c590aa0706a1b08ef4cd709c514f0b49131b495441d2d77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879923, "uuid": "08175f43-8857-4267-8510-0c684291c834", "value": "T18761D6E511428B346DDB5812A368CB7D3441699FE0EF8F1667FC29BA1C4CEC8AC4D742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879923, "uuid": "a8a9b2ea-f27e-4d9d-bd5b-3ea6fa80b66f", "value": "96:itmqtlMtk6tNUtH8t/QtIKtSCtXWLtuWtJZet1ctQit0yth/H:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879923, "uuid": "2c11a334-2668-4fdb-97a8-26aadf6dd9c1", "value": 3269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879923, "uuid": "7277d0a3-14dc-4000-af21-cc284f707466", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879923, "uuid": "ba34f7fe-942c-442e-9254-12e69746a557", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7f2bda-d0d6-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764828066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828066, "uuid": "710bceee-468b-41fa-8a1c-81a094ddc438", "comment": "Malware payload (PureLogsStealer)", "value": "b7b0e3457972bcd10daa62fceaf287a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828066, "uuid": "75465bdc-d142-447d-9431-53f9491a591a", "comment": "Malware payload (PureLogsStealer)", "value": "ec624e32754a0730e350b500833c03c8e530c3fbcedb11d681f0d65bb9291f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828066, "uuid": "de3a96ff-567d-4adf-b123-ab932046ab22", "comment": "Malware payload (PureLogsStealer)", "value": "91ea00cb9dc9d101f0c5eef08a59ae0d9aabc6f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828066, "uuid": "d13f5205-53ca-4cc4-a593-b18598c895ee", "comment": "Malware payload (PureLogsStealer)", "value": "d8cbf657b682bb30ab809da8eab454fd504fe7d479b4ab0cf5a499bc5574d193127840ccc92e866883f9b2bdd6c52265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828066, "uuid": "5e26c89f-8d53-4e15-ae32-983f875019ca", "value": "T15AA412E2FE01C03EDEC147F1D47C46B65BBD0258A3AABE8603601B0D7A5160EDACD5DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828066, "uuid": "dc274894-369e-4914-bbaf-144b062954eb", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828066, "uuid": "e0440347-3200-4259-81d9-5ca0ffcaf2a6", "value": "6144:HlHXcMW5TJVCxEGdgPE1fPk277AMurltzBYTug00uLlUon3tWsv6/C4G6rY7vO6n:6M/xEGQE13k2INlbhdn4DLnrYzP00Zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764828066, "uuid": "6955b668-478a-4d7f-bd04-b97e2e35511c", "value": 454600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764828066, "uuid": "8c611af4-a478-46e5-b9fa-dafe879b6381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828066, "uuid": "79b47b23-4860-4fb3-b654-7ece4be2d80e", "value": "CE-Swift12042025E31014ZQW20NR5499364YT63VR674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9004da05-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879150, "uuid": "5c6d9ae1-4f58-4066-8afe-6a5ed1ad4a96", "comment": "Malware payload (Mirai)", "value": "aea93d88bc523667fd36c62d159c6caa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879150, "uuid": "3443b850-27a9-44dc-842a-737c9483b790", "comment": "Malware payload (Mirai)", "value": "ecbc8273e87bc397312d698de7e64834a75475404b105f758e0996efc1ffb775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879150, "uuid": "141b4118-754d-47c9-a099-06ce2e542018", "comment": "Malware payload (Mirai)", "value": "fc773a528ef71c25e7724e8316111eaa898078b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879150, "uuid": "2b2ab235-2d89-4956-94bb-ebce74349d33", "comment": "Malware payload (Mirai)", "value": "7a41ed4302e93939f8b9c552b00f88c258d4f072f1288656484fec11a7d2a8f79cb95107c05ee85e1bb066026c5d9f54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879150, "uuid": "980f46be-bf5f-42ed-8339-60b2c46ebf53", "value": "T12A3329D6B4019E7CF85BEFBE81224909FA71621151930B3B637FFD93AC322A48D52D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879150, "uuid": "fb248064-8b20-40c2-934e-9d0dd83c3bf3", "value": "1536:OVrztlv7/lZrmi5QvTDCHLnyaPCV25XRb8w:yPllmPDALo25h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879150, "uuid": "35ced44c-8f33-47ba-b2a1-c07fac6a0004", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879150, "uuid": "ea84fc7d-a866-4164-a7dc-0e45aa8d647d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879150, "uuid": "ad835bd1-0e15-438c-94c3-84a9da6407e8", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824859c6-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764831024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831024, "uuid": "c91dc0fa-badc-4d34-9132-8f219bac3ceb", "comment": "Malware payload (Mirai)", "value": "de55a8814fff0ae0f17252a6ade60d29", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831024, "uuid": "54615d10-0d88-4671-a903-1f9b7cb204fb", "comment": "Malware payload (Mirai)", "value": "ee22abadf5a9c48a3a8928f66844746dc48964fbdc5d58b171a1b2be85070c2b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831024, "uuid": "e11355b5-4c7b-4561-af9f-9cc26b41a920", "comment": "Malware payload (Mirai)", "value": "c4d9e1f1b201910ee7d865b044823f0aae754839", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831024, "uuid": "d26c043f-d0bf-4c99-81f7-c264a5316f40", "comment": "Malware payload (Mirai)", "value": "a4df81254fa23f7b561c533ef261aca08d7376dd8a6465e1fed0cfdb72318fba5a9ff603b1d9b03a81d5eb2dd974379b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831024, "uuid": "9cfcc62e-2dc3-41f1-b33c-6e6d7943c9c7", "value": "T1A911CB892913DB4A60188F40315E463DE69BAED470FEBE1AEDD51C72ACC850474B8F9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831024, "uuid": "dd0f92e8-eeb1-48fc-b653-a791072accfa", "value": "24:TRuiRGRBNIsRXKhRvRBzZqtRvtRq7RZgRHRx/RFxn:T8iwft0FtAlts3gZDXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831024, "uuid": "febd8ed0-dd3d-410a-aaae-c5a38c33e7e7", "value": 1035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831024, "uuid": "c6726e78-62de-45c2-8571-dfb2fa3be4a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831024, "uuid": "461eeaca-08cf-4685-bd86-a7066d758bb8", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5c1748-d101-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764846422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846422, "uuid": "2fb90e24-24f9-46ea-adec-3987199aee9f", "comment": "Malware payload (AsyncRAT)", "value": "e7814fa179a608fe7c62732d5e1fe20e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846422, "uuid": "bcac1954-72d1-4d27-858f-ab928e7f0d67", "comment": "Malware payload (AsyncRAT)", "value": "ee6185134ac3070a52a5f5dff8091fdd7eb2002a7e0246cedb34192cd36fc63d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846422, "uuid": "c6dcb462-84c8-4c7e-83d3-0b3521f110cf", "comment": "Malware payload (AsyncRAT)", "value": "8ecd1da776ae2f70bc46d0eee70b2b78aa3062d2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846422, "uuid": "79f692d5-7d02-41c8-b77e-be16b5fce807", "comment": "Malware payload (AsyncRAT)", "value": "914fb5809c3b339269801d686b1304267c4849d7183cd2e2bd9975ad738ea36c88356b1890438311d228c0ba4c45362e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846422, "uuid": "0618f9b2-90fb-4e22-8dcf-e9676406463e", "value": "T1D0259D0273D1C062FFAB92334B5AF6115BBC79260123A61F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846422, "uuid": "f7c6abc4-337c-49b8-ad64-a5402eacad39", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846422, "uuid": "7a45dc11-bdbc-4847-a0c7-6f9fbb3efbfd", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1ijXdaJdZ:0PVt/LZeJbInQRaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764846422, "uuid": "e085d6d8-7e77-418d-bb28-e2781c804ead", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764846422, "uuid": "f62a0cb8-5b7b-4e1f-a3c0-2e5f57dd5566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846422, "uuid": "a0998807-a3c8-4d5c-8c70-ca2f005a25cd", "value": "Curriculum Vitae-Catalina.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f861ea0-d154-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764882156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882156, "uuid": "44ce3b9f-81f2-4415-b018-c9fa1a600087", "comment": "Malware payload", "value": "c071a567f1d9c6cba7cc9d3e50d24418", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882156, "uuid": "dee473ff-03a2-49a3-a48c-23949d73b059", "comment": "Malware payload", "value": "eea99f22aca1ebe449b97faafe79fd1d6e71441ccc40315a2e629280f65de0f8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882156, "uuid": "d8790c41-b00b-43e0-b250-fd02569e197c", "comment": "Malware payload", "value": "307e039164b82807414fc9f1052b47b4626bfbc5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882156, "uuid": "fdb03efc-d651-4b7e-9433-6d9a828e7e59", "comment": "Malware payload", "value": "793624d238732194393f28025eb0941308409e7b568585c174635c171c7d814c90ea57bf52b7c39091e158fcddae0e9f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882156, "uuid": "f04325b8-88fd-4024-8eaf-82542b776ce9", "value": "T12D03EB5B1E28EDD0338F7A78AE9C619012D0DB5F6FB391A1D04BC5B12F229A874047B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882156, "uuid": "a9299dac-cbe9-4452-b133-f306c3f3f51a", "value": "384:23wt1tgCmKXMgutiPcIfjmdBmf6pNp4Kdm4dwvIFSX3OVhhCIayQd8XA50QKV2ND:7XMrclSzp4KLCnAQ6w+AN8V2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764882156, "uuid": "523b05a0-3c3a-4e0b-a2c4-09f87649904b", "value": 38866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764882156, "uuid": "cfb6e215-c21a-4d2a-a4a8-60d36410d567", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882156, "uuid": "e7b7906e-395a-441c-8c73-c2ab6e2a94e8", "value": "SSA Secure Access.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2090ec2c-d115-11f0-a129-42010a9c0007", "comment": "Malware payload (ShaiHulud)", "timestamp": 1764854911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764854911, "uuid": "440936be-0748-4df9-959d-18c905379b2a", "comment": "Malware payload (ShaiHulud)", "value": "a4056cd36b94594128654d692e1ec90d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ShaiHulud", "colour": "#970A21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764854911, "uuid": "0217bd5c-c37b-4cd5-8a75-a45c368fdeff", "comment": "Malware payload (ShaiHulud)", "value": "eebe8bbb5d1f4641a83e29858ba043bb17a2ab2d7fa386ceb9195b840da4b426", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ShaiHulud", "colour": "#970A21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764854911, "uuid": "aa238d9e-72ee-430e-bc42-15dacd5ebde8", "comment": "Malware payload (ShaiHulud)", "value": "f5823453295d97ade534f6c5c1226d8622368ca3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ShaiHulud", "colour": "#970A21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764854911, "uuid": "8ee24ab8-f8a6-4c6c-b86b-0914ea79da6b", "comment": "Malware payload (ShaiHulud)", "value": "5fbb81b8259a2aeb7d953d825b5d1bea3b034a1278f1acb53ba519520c4f8f78ab2bbcd44be10a309fd1286772c74d4e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ShaiHulud", "colour": "#970A21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764854911, "uuid": "2ad7f730-d258-42f0-a600-12e94d5af547", "value": "T1969681491A9564159277B77EEB1AE0D8FB3B063B01940807BDACA490EFF0C14CAE5FB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764854911, "uuid": "da5e1f80-b32d-4a7a-9e7d-d9c3c11987a1", "value": "49152:h2sOg702/jlg5ns8Peyzv9ah43pj2R+y63Rw7ZLeD+Kq8zA8sWm:Va9Z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764854911, "uuid": "4931a8e4-5460-430b-9679-6269f1abc26a", "value": 8950141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764854911, "uuid": "bec65c74-aaab-44ad-8427-4dd625c88fe5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764854911, "uuid": "f2816501-e9fb-4769-b564-9f5d01f4f8b7", "value": "environment_bun.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e2294c-d0d7-11f0-a129-42010a9c0007", "comment": "Malware payload (HeliBot)", "timestamp": 1764828498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828498, "uuid": "a2892b5b-9e8e-4529-be17-2c2b06a684c8", "comment": "Malware payload (HeliBot)", "value": "a467c89a9fb1b24fbe74eea2096642a0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828498, "uuid": "aeb2ab44-0a6a-4981-8c24-129fe1f85401", "comment": "Malware payload (HeliBot)", "value": "eee8970fbf689f85e7b65f83d80a7966bf3a1a5fa6bde3f6d2d92eb4e1b64dcc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828498, "uuid": "019646e5-4347-40c9-a47e-36b6cf25b371", "comment": "Malware payload (HeliBot)", "value": "06c39de1a1063a6c7048d48cb239023a2dc5e275", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828498, "uuid": "70a3da28-42b1-4f29-b4e8-ab24fc7b1bd3", "comment": "Malware payload (HeliBot)", "value": "e24e5a378469d1f8133be79fae8904fca4a70830b02370433868e57725127202aa59fc4a10bbc13dfac52ffcdcf25cfb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828498, "uuid": "2451256f-58f1-49c9-82ab-ef7a560c3b39", "value": "T11E41BA8BB1734C3D5E71DB3633798C273686A59650E6BF3A3ED839FA628CD0C2141586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828498, "uuid": "96935e29-35be-4898-a466-ba368b0362d5", "value": "24:v5HQCl4gn38qmsgCDUs1jwy/gjbs1dJI41mvGI34BvpLIhNIhLgvqksIl7K/rvc:vpdaY353xdVwy/QQDJlFLPJGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764828498, "uuid": "f59835a0-71da-4a5d-b401-a36cf77f3d06", "value": 2248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764828498, "uuid": "ef2fd418-35e5-443f-b73e-2a4cafaaf610", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828498, "uuid": "d7247a4c-61f3-4e49-892a-8f8aab699ae5", "value": "bootingworld.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3dda82e-d0d4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764827295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827295, "uuid": "7801a104-f4fe-4184-860b-ea2460e0d391", "comment": "Malware payload", "value": "22009524cbf312fee9bce63d709c6d94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827295, "uuid": "11f35347-8840-4635-9bf0-97e972ca1c45", "comment": "Malware payload", "value": "ef04a08ba24b604880c4b4afea0cb759250724085e9604df00ef8963e9219b31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827295, "uuid": "c741d136-5e5a-46e0-92a8-5421f91180b6", "comment": "Malware payload", "value": "22501566bd0c479a78f007f22de7786f49b45dd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764827295, "uuid": "809dc1c6-ae62-459e-ae9b-73fb5bbdad31", "comment": "Malware payload", "value": "7c86161e541568a17a9617fd2f65af07dd93828855bea4f199365f5599c844edf73dea32b49979f2b270d5b221bd0a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827295, "uuid": "ba5b5164-ec5b-4739-9df5-df3beac03c01", "value": "T1CC33F174EC5B9DB3E76F5EF28AFC4204A7C45A08B845E9F24A110EF35C265923B95EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827295, "uuid": "732e0752-180d-4a83-b75a-858ac2cfbc85", "value": "768:4+ff5K++praht4/s28VtCX+Yuef1Km1Gvc5anuNMQ8BUw5X6My4uVcqgw0X7Jkm6:zff5j4I4dX+YZK7U5a4Mhby4u+qgw09O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764827295, "uuid": "2af8f659-0b36-40e5-9e1c-5543b2b0a3c7", "value": 50244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764827295, "uuid": "1702cfda-1f60-4d6c-87b5-183ab9465b42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764827295, "uuid": "e88d255e-c70e-4381-946e-b60a57b16bfa", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151dd4a0-d11d-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764858328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858328, "uuid": "d9ffdd80-2cf5-46b1-8839-766e033de3a6", "comment": "Malware payload (SalatStealer)", "value": "263d1164b535ffb64209f2ccb1bd4eb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858328, "uuid": "95542698-8e55-4080-aec4-5a8b41e3f657", "comment": "Malware payload (SalatStealer)", "value": "ef8ebdca42b6b9f19ce4f3965f95c9e8a1116852288fc41aa6b8c1493711bea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858328, "uuid": "8d2de7bc-6de8-48c0-932c-fd57b09a013f", "comment": "Malware payload (SalatStealer)", "value": "85fbb8b94a767041dc8587e3917f250444a7aa8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764858328, "uuid": "6483ea8f-be78-4adf-94f9-1f1c33820565", "comment": "Malware payload (SalatStealer)", "value": "b54994e0635de7d284b76b6710c61ed3e1f00096deb4106ed95e0109831461909585b168838eb7abc157cbef4516f65f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858328, "uuid": "9a3a29ff-9409-47a8-8f17-d8703219e306", "value": "T1CAC65B41FA8B54F6EA031832415BB23F63305D049B28CBD7EB647B6EFC77681197A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858328, "uuid": "961afda5-cff4-4aee-9cb8-e156c49b98d5", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858328, "uuid": "0fa83e3e-bfa8-405b-a4b4-7ef9069067be", "value": "49152:Hgifi405rTTkJMiUDV3wZrFCkrszR4mXlZ/QiatyngN+g1p36lNathkPkzMP3yZ5:A2iN5YMpNoEjFfq18NdvLKXyhqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764858328, "uuid": "931d1d5d-ec16-4abe-885c-87aaf4a184e8", "value": 11654144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764858328, "uuid": "34e6249e-52e3-4f2c-911c-2c4992257a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764858328, "uuid": "36910bcd-07ed-4a32-8356-48a57427ecc8", "value": "DC9E71D3B5G4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a478947-d0d9-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764829212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829212, "uuid": "36fd2310-ecc2-4bb9-9e4c-5303bcba517e", "comment": "Malware payload (SalatStealer)", "value": "ab69fa8c9aaba1b1a5f761cc15c7526d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829212, "uuid": "8624bc5a-0638-4b78-acae-038958438a11", "comment": "Malware payload (SalatStealer)", "value": "f096872b2e50a4a05e909803ee434f0e4a818d160b03d3af0daf77b1115b8c8b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829212, "uuid": "eb386093-e0d4-4c94-a514-a971e2c844b9", "comment": "Malware payload (SalatStealer)", "value": "58cd0bf230eec68b490432fa9b89cf9704c8bfd1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829212, "uuid": "b1a9e20c-ff05-48d0-b77d-94b4cae7b11b", "comment": "Malware payload (SalatStealer)", "value": "9aee1dae6efc1eefc45597deefd90a9114a00661df5aeed5dd3b09e0294e444dcbd5f4aa93cb61bc19934f5b0a9ae4c7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829212, "uuid": "a29f4af3-b47d-4dd9-9603-9fd8edcb690d", "value": "T1EFE533ABBB838A26C4CB9E3B7963C01DE3A82B4FE452921BFCA15D3E74C7D5A5045504", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829212, "uuid": "6d06a62d-cbb3-450e-854f-3254ba1eaacb", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829212, "uuid": "a9f7f679-8614-49f9-9dd1-79aaa013c5cc", "value": "98304:lQAb7xpndHWYCmxXIGhe7SgjI9EYhATdyaF:lDdH4mlhQbYq0aF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829212, "uuid": "e8a7aded-034d-4368-b9b1-a8e0e9ed99e6", "value": 3290112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829212, "uuid": "1efecd82-80b9-4a5f-bd0b-49f86ab75b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829212, "uuid": "f048a2c7-8444-4975-a423-29dc0503b901", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7578deb-d151-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764880934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880934, "uuid": "d60a2282-487a-4bfe-b29a-476a3c7fd6dd", "comment": "Malware payload", "value": "38e5388d7373882ba1d49ae6b6f7e205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880934, "uuid": "96999280-94a2-443e-adf4-eb691f258a55", "comment": "Malware payload", "value": "f0c5692b600a6e5c4d496152e3b90b488c4f6a8d443b8e560b806fe0edcb407e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880934, "uuid": "4b2c1fd7-6156-430a-952c-76ce2ef94f30", "comment": "Malware payload", "value": "e3f0fa421d3a6a773499dc9603f4cb264fb0649a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764880934, "uuid": "1572ca5a-e33a-4620-8499-36220680e9a4", "comment": "Malware payload", "value": "13156e14c191192e2fc3593a9f3df7bcd87edf85f7b7ddfd93688e62a212996fb6c2c0cc3dcfa34f267f5e03fcb64d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880934, "uuid": "475b8d83-384c-468a-9872-5ee59b5bd775", "value": "T186F55A03E29940D9D159C074CF4AD232EB22BC4D47F266EB36907AD62A77AE07B3D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880934, "uuid": "683a7005-6a3c-4a87-a85e-901516c278a4", "value": "3e82ae93b8102462dda81604af164e8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880934, "uuid": "2fdb3c08-8c9a-40cc-b410-794c903a8c69", "value": "49152:zyeQgl4TVKmc4zdEU2ggu08mC49UNGEDJuoui0W0qpqXcPTY6Y5Aj:1QgCUoSXZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764880934, "uuid": "361ccf5e-9b95-4849-bb5d-b3353ae09f63", "value": 3382936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764880934, "uuid": "fe4d390e-abd7-4aa9-a6eb-064e4569134d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764880934, "uuid": "f58c43cc-41d6-4262-bbd6-de8188312098", "value": "FPS BOOST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5f7ba2-d109-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764850046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850046, "uuid": "e7ed8345-f60a-4368-b9d2-2d2ec7c64f9f", "comment": "Malware payload (AsyncRAT)", "value": "5354467420fe0d3722c476778575a2b9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850046, "uuid": "20efd1b8-f448-47b8-af72-9b6b74468bb2", "comment": "Malware payload (AsyncRAT)", "value": "f11f8e2e25897c099a6ea283b3d91abbba7ef5ffc7157691d50358994a2960f4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850046, "uuid": "559c946d-e068-4f6f-ba1e-ef6d67258327", "comment": "Malware payload (AsyncRAT)", "value": "60d25421b471ec90d27f2b89ba4fc8bb4df14fb4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850046, "uuid": "502beff5-2cd9-41d7-a8a4-c930d6124e37", "comment": "Malware payload (AsyncRAT)", "value": "8d46025b12318b16e47ea2abc8962e9b8b4ad13a7ab3fc9e636ffac4054da092bb738b485b1a8318722c97e3f2cf5a25", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850046, "uuid": "aa9f67a9-db4b-4158-b5b2-6245e27612d2", "value": "T162E24B4877954312D9FEAFF02DF2710A5274E11BD813EB4F0CD4899A3B679C246907EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850046, "uuid": "cfae2aa7-0b90-4342-b950-91d12c522ccb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850046, "uuid": "ec7689b6-d326-45ab-bddb-64be22a4503d", "value": "768:RR3ffdnmLKjvGFbO752aDFo9jcDhOjhnbO:r3ffdn7j+bO752uFo9jcDhOjR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850046, "uuid": "85d0e322-2d44-433c-9e04-6acc00498c96", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850046, "uuid": "6d145b64-d510-40f9-9647-197019ddf7b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850046, "uuid": "b5a5e038-f467-46f0-9812-079a0318f93e", "value": "bad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19278d1d-d136-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764869072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869072, "uuid": "81568a9e-0d14-4dcb-a2ea-a424546f52f8", "comment": "Malware payload (Mirai)", "value": "8449b40f3e62a1089268129901e84a59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869072, "uuid": "af0a3191-9296-42e0-943c-30aed66b446f", "comment": "Malware payload (Mirai)", "value": "f14544f6303ad47fc35bb4969707a52f082b1e40dfb09d81ce6f6299835d95dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869072, "uuid": "7fe08e85-35f7-43bb-b6fd-08e53dbb3d80", "comment": "Malware payload (Mirai)", "value": "69228c73570753f16b66ad5c48f8541592df7967", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764869072, "uuid": "00027378-64d0-4e8b-8611-7274ead3ba50", "comment": "Malware payload (Mirai)", "value": "d321d6d947eb8676774fb58a31cb8c085bb2af6ef3b61734a8c9b10356f529b6a189c2abf3bd91c926240229b0b5cdd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869072, "uuid": "503ac4f7-18b3-4a64-82db-cd0e5b4ed8fd", "value": "T1C0A34BD7F401CEBEF80ADB7B44570A0AB635E3E106831B276757B963ED321951862EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869072, "uuid": "f1cc8267-5c50-4647-a6b2-800326770139", "value": "3072:WtQIMfjbhxIbhhTykLVGSyYYZmdCu3IKDMq6z:FezykRGSyYYZm4u9Mq6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764869072, "uuid": "9ed65787-5d0e-455e-8b61-b115a8c6efc1", "value": 100888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764869072, "uuid": "c07b52c5-7f2f-4d7b-9e72-c3cbfefc3cc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764869072, "uuid": "3c2f1462-dbbf-45d5-a545-551b69d8ebab", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874ccd15-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764879136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879136, "uuid": "80da4c22-0a2b-4101-86fa-07957e9c0e25", "comment": "Malware payload (Mirai)", "value": "18067a5df61b73ddeb7e0faa5b2c828b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879136, "uuid": "fc49d535-fbfb-49c7-8336-14fd4534c52c", "comment": "Malware payload (Mirai)", "value": "f1ba5290bce7320212875d292e94acc88583e7ce0c8d234e84c37cdaf00d6387", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879136, "uuid": "bb1bd259-2aa8-4d2f-8046-ae330b5bf397", "comment": "Malware payload (Mirai)", "value": "4da7dc79080b97803d74858286dca87853b9ff3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879136, "uuid": "198e8733-0b54-44e3-8017-945e2af18f9b", "comment": "Malware payload (Mirai)", "value": "f02aa15fc73b67ad162bb31ef0f7bf418b2c3cbb7b0aeb1d387fcf74ed077740d6f8691f9cbe4a4cbfca7f1f29a7b225", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879136, "uuid": "8f6250f3-3ec0-40c2-bcfe-4c063da8189a", "value": "T19773940ABF610FF7E8AFCC3789E91B45248D641A21993B797D34D818B24B64F49E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879136, "uuid": "e9c50136-ef9d-4960-a3b1-03756e6af8a1", "value": "1536:IlGFfut1GzBpR5YgxmkSrGZsTefCqNuRHxo:IcFfut14BugxmZ+uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879136, "uuid": "d2590d1d-aa8a-4b62-8023-3ef1b6933a11", "value": 79900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879136, "uuid": "2122f894-9432-4080-8c91-d37724d332fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879136, "uuid": "50885628-7cee-4c42-ba11-f152a2c9e6f4", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa160549-d149-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764877476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877476, "uuid": "91441ed6-c929-4c94-bcc2-3c81c3a1a581", "comment": "Malware payload (NetSupport)", "value": "75cead391313d25540f45b0d57aa1293", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877476, "uuid": "a2d5497d-efaa-4b8d-8f89-ca94bbd77696", "comment": "Malware payload (NetSupport)", "value": "f20db71c8652933011884c6a9499e83b6922c6203840dc3281410fda827dd4e8", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877476, "uuid": "0cea5ce0-749d-450c-82f1-9c9967104fa0", "comment": "Malware payload (NetSupport)", "value": "35f1bc8591b986141de09c49e66079ab2ba26bba", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877476, "uuid": "1f1ef8b3-67a2-4781-9cd8-e7515d988ec9", "comment": "Malware payload (NetSupport)", "value": "c029fcf4db61ec2a1dc9c90b791e8c3839715470fa774a71f35deed530b0e38cf56787dfd085b1dc8afceee250dbfa13", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764877476, "uuid": "905f1e06-d58b-4f0d-81d3-03d43f3a345a", "value": "T147767EB284576C37BD5D384B90042FA29E69164B67188F46FB303779B2EC951DE3C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764877476, "uuid": "a9c78b0a-9f13-40b3-b9ed-3e656bc5707a", "value": "49152:O0zmX3QXU+yY/F4+9Q5Py/nDOtAT9qN5izc829/EvUw2Z2ORDHHIS8H4l/TwVhmt:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764877476, "uuid": "43721920-109b-48bd-859e-443deb8aff5d", "value": 7289238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764877476, "uuid": "bc0c5797-8499-4157-bc8c-14bb5a553da8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764877476, "uuid": "15adac3b-30b5-41d5-b59d-f4780dccb754", "value": "GjdjFt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb3b688-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807098, "uuid": "4c219aae-ee82-4988-990a-110ccc1ec39d", "comment": "Malware payload (Mirai)", "value": "19a2ed07000e28f64f4f2ae18531b904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807098, "uuid": "9482bede-8e9d-4955-84c4-59a94634217f", "comment": "Malware payload (Mirai)", "value": "f21b259aa9f30ffa82ac0725f7f529eb6a5378d9b153baee08ce25a18c3f4ad7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807098, "uuid": "2392e458-ebb7-4f5e-9a01-30cff6d494c3", "comment": "Malware payload (Mirai)", "value": "fb438c37bdc43c82f8c82ed791c94468bbf21847", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807098, "uuid": "60790ac1-5065-4662-b39b-64f31cba6365", "comment": "Malware payload (Mirai)", "value": "e8e31928e717d112a7a6cfc822ad4a033baa28f33a2d8662035423ed7cb940830d79b64959c25ad6eb1b1e8da8a456a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807098, "uuid": "9b1abcc7-5834-41cb-8058-b3344cae7c7c", "value": "T1BFA36B02775C0D43D1A75DF02A3F23E983AFD99222F4FA89250FDA4681B1E77154AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807098, "uuid": "fa702dae-3bf8-49d0-ad9b-b61a607333e3", "value": "3072:w8QuO2gcPU6wBIn9Wa1PJR0Tzey1kC9AtrRo6UFdf:w8azTWC9AtrRfUFdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807098, "uuid": "33f63cce-27c5-4455-969e-aa29a5e55c55", "value": 100456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807098, "uuid": "7b72f051-0c66-4a29-84da-824fc461b894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807098, "uuid": "49d7ba65-6575-4eea-92e4-679bbe8a25b9", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30754cf-d15f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764886994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764886994, "uuid": "0d09d92c-8a19-467c-912d-4e812b13d7c9", "comment": "Malware payload", "value": "0cbb8b7c4cc801729f3bd325e452a01a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764886994, "uuid": "f1c348ca-5bef-49d6-be9a-2e7556e73440", "comment": "Malware payload", "value": "f22a5d3a233af8f50f2e1198c3d2714c68a582ab3536e5e27a20505236f74f37", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764886994, "uuid": "ad65e003-03b6-43dd-b684-4a260e20db19", "comment": "Malware payload", "value": "639030f55b15f12cd06a1efb2275ed7a76c7b95c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764886994, "uuid": "c3df3cd8-bd91-47d1-a789-2e1ffe2b398e", "comment": "Malware payload", "value": "b83e4250198b2df5eab55ad9a5682a5089f52292b789b53b79ffe58af66e86a9b06bac8146a0e3b133092f651d8c9420", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764886994, "uuid": "7cf7d541-e05f-43bc-9ae1-e4d10422254d", "value": "T19B733E880BCFD0E89A27BC6849DF4C02F7E9D517071CCA95BE5CA5B82F1193995E86F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764886994, "uuid": "b1824afc-fe70-497e-b06d-b152b37bac97", "value": "768:Tlsm0iKlPQNCYapFGAueqUyyZuQAch7dyqMKEHeMiBLMMdDJ2pL639b4v9JonOJW:pKyTFMAaEHeZiUlz4sTUfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764886994, "uuid": "adcbb249-df41-451c-8c1c-a9a3cbb239ec", "value": 77087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764886994, "uuid": "d85c46a7-1f90-45f7-9718-50c9ba0274bb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764886994, "uuid": "bcf5fb18-4ba1-4a69-99d8-3a4d217c5d77", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61b6416-d12d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764865524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865524, "uuid": "92d8de14-557d-47cd-8909-24d088972290", "comment": "Malware payload (Mirai)", "value": "2ccd4d16b12b431c4b213caac4866d8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865524, "uuid": "7d4f4a30-1e1b-4b75-9d5f-1a709c3b4eca", "comment": "Malware payload (Mirai)", "value": "f2c458c722dc052821de7c8d3a22e58bae49db0ddfd4ab98ab2cb9fdde2cac3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865524, "uuid": "8c75f5e6-a6cd-4b4f-8b8c-a45253dbce34", "comment": "Malware payload (Mirai)", "value": "ace9b05f32a9129b2c9a8e8ca1a76e5db3579775", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865524, "uuid": "96ea47d1-bb17-4144-8f4f-979e50077902", "comment": "Malware payload (Mirai)", "value": "1e5d855d56ef170fa5e4bd97470c53e26da2c807f9795f9903f61771feeb1f72eec183dbc599272c9c55f46cce9a4db2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865524, "uuid": "7e074f6a-7c39-41ab-9659-aa576d88ecd4", "value": "T180144B46EA404E13C4D71779B6AF024A333297A4D3DB33069D286FB43BC679E4E67A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865524, "uuid": "62dd4be3-f055-403b-9a66-6363a4031bdf", "value": "6144:E2jeX80a4HI/8+UYPHaem4TZBpr1vxHYKqRiM/9X1:E2jeX80a4WnPHaem4TZBp1S7r/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764865524, "uuid": "4b399d99-dbf5-45ab-94e2-2583431350c6", "value": 206214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764865524, "uuid": "79e91496-deb9-46d7-94d6-493fc4983cfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865524, "uuid": "f7ba4ea2-199d-43d6-988c-76502a74c0e6", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b6ed1a-d112-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764853731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853731, "uuid": "97d66d63-8767-4ac2-af84-9bea9e043296", "comment": "Malware payload (NetSupport)", "value": "2eff1b9748fca669dbc0dc157d6629ac", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853731, "uuid": "a11c924a-249a-47d3-8b74-3618b1146ab5", "comment": "Malware payload (NetSupport)", "value": "f324c4580f513d3bbb2937c09b7b03f80505dd71808b8801732b84f4ece3de1b", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853731, "uuid": "ffafc60c-a247-442d-97c6-e37b6df0db87", "comment": "Malware payload (NetSupport)", "value": "96906b521747f0cb3b79bf410a9d6dda6ede9c7d", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853731, "uuid": "50061e36-72ef-47ea-bba4-1394b9d4c0af", "comment": "Malware payload (NetSupport)", "value": "8c72cbc53da794637c0358144ebc8857d1fcbc7c88ba35b5207f26a7bbde77b553110874a6e687e671865c5854863f2a", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764853731, "uuid": "7a14c1ce-3d87-4d43-8baa-2f459de15f74", "value": "T165767EB284576C37BD5D384B90042FA29E69164B67188F46FB303779B2EC951DE3C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764853731, "uuid": "06b9e59f-693c-486c-93f4-78ce23859c7d", "value": "49152:geQmX3yXU+yY/F4+9J5Py/nkOtAT9qN5izc829/EvUw2Z2ORDHHIS8H4l/TwD7mE:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764853731, "uuid": "46abf271-a376-4504-ac5e-5fd401e8f345", "value": 7289165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764853731, "uuid": "4ecdb16c-aa01-483f-bffc-95a7cc1187f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764853731, "uuid": "0b8f60b3-5f27-49c4-a86c-1bcea1c0f61c", "value": "squ22.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c88f77-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764873087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873087, "uuid": "6da0ea94-66ba-4485-87e8-9ca9f6c73fa3", "comment": "Malware payload (Mirai)", "value": "9b1bfc2588b24d07d3ad49357e9ea85e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873087, "uuid": "9d421112-86bd-49a4-a091-5de29584d42f", "comment": "Malware payload (Mirai)", "value": "f373b9ec470f298a311944d114587d37b71033b1be78e4a02e2cafc03b724b81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873087, "uuid": "a79783d4-03e3-4b46-8663-26adf4dda22c", "comment": "Malware payload (Mirai)", "value": "aa67e72762f99069c34d85199d81b9879212d1ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764873087, "uuid": "bce7edb1-609d-475d-9ef6-94600df5a261", "comment": "Malware payload (Mirai)", "value": "317c8f06abc65c1c614cd4e8927a3be877f33aea2bf88f8c51bbaf30bd37569e8c5ec0196e16563a37c7814240de8e00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873087, "uuid": "f2f59380-3590-4854-83ff-ecbf97edda73", "value": "T1B213F139C1F29E53D7392B60699497C377E16B9E21EF45E1B7E88A0374A3806E2417CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873087, "uuid": "649f1030-8c1a-4351-b968-3712cb05777a", "value": "768:8AM9+7a/W8FIDOEUU+TR7KBbX71oniAbS1FoLvf3/tJ6zvgd4uVcqgw09d:8AQ+7TbaB17E31WtugZ4u+qgw09d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764873087, "uuid": "a7c17fdb-3adc-4ca3-bdcd-c1e3d9516917", "value": 44340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764873087, "uuid": "2c2e8a32-0d42-4741-a7fe-47a38c38693a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764873087, "uuid": "d90eefdc-e1bb-4dde-bb83-60f87d8ef533", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef799bc-d0e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834212, "uuid": "b724392b-0438-48a1-a44a-ad0deba94ba9", "comment": "Malware payload", "value": "d2ebd4a026c1c5d476a4a43bc6711835", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834212, "uuid": "3bc05051-0068-4884-910f-957f4383ccf4", "comment": "Malware payload", "value": "f39f2b55a8f8554bb60d19fb280db230f999bb234ddbf437a9d0723c7aaebe66", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834212, "uuid": "1941cd39-7d22-4cee-a991-39cf94ba1838", "comment": "Malware payload", "value": "6e4dd8f2b73bab3cde94ba5c1c2470deab4a5030", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834212, "uuid": "f0d423e4-bd72-4b28-a886-e5f8c66332f9", "comment": "Malware payload", "value": "0046afed700d81a3ecddf8c1d40be1c4e9d65e7608902a7ae1deddbbc95205e69ec0ac54fde5fe6ee16ca693c376723c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834212, "uuid": "d850095a-412c-49a9-9e03-625c48c5cfae", "value": "T16057232BF6096D6FD8FBA3346D7B02A154256D25CF03E6877938B33D28B35C55A8A1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834212, "uuid": "8d37e2a3-b8b7-496c-a13e-cf4b859a3eea", "value": "786432:XBCDp51CbGe7wJirwS0R7+g4uEb4Zw0/3yJKn:XwDpybkYwSq7+g4fb4Zt/3yJKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834212, "uuid": "66334560-89f8-4a6e-bf01-3dea0cd1caf8", "value": 29681254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834212, "uuid": "75c2da38-0814-4c4c-bf01-fcab7d351408", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834212, "uuid": "81243dbc-cf74-4e7c-ba20-5209fb7094cb", "value": "TV-Garden_Ver_12.03.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6c1fc9-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1764878953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878953, "uuid": "4e1d9ddd-021a-4d81-85e0-75f8fe154f4e", "comment": "Malware payload (N-able)", "value": "22ead7044eaaff1a82664ac563dc720e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878953, "uuid": "f6ce3b4c-a95c-45e2-aee7-9ee33404bb53", "comment": "Malware payload (N-able)", "value": "f4092d03248806530d8e17332425facd2c65ba860d6d10f0efc996450c6ff7ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878953, "uuid": "1ce2c677-e577-429f-b83b-150e351ee2ec", "comment": "Malware payload (N-able)", "value": "bd7485523a05c061485249ff3c7ddc5ea68c09bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764878953, "uuid": "fa1c5d18-a10e-4945-b855-5fded0fbeb2e", "comment": "Malware payload (N-able)", "value": "51c52475202f338a9d97be9c4297ea6fa8858048658eee97b9059b84e8aeda72caf9ddc46a4b8ce866161b183290ca14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878953, "uuid": "fc6127ff-ed45-45af-bd15-ec6053f0421b", "value": "T147E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878953, "uuid": "f573cf0c-0acd-45c4-9244-c964d0ea0e6c", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878953, "uuid": "971e20b4-a290-4919-9aa8-6fa57c009df1", "value": "393216:ZXF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1d:brRxvoC/7a0jUxX7h1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764878953, "uuid": "df7d9e18-5704-41c4-838d-61751552cc1f", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764878953, "uuid": "961a64dd-f97d-4a08-8d16-856fd4204f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764878953, "uuid": "4c1637f0-a65f-4b79-a2b1-6fcbcfafc192", "value": "FILES8478974989479494489479749489AGENT_468950_V10_14_4_RW.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce3aabe-d0a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807956, "uuid": "b3ae9391-c70c-41d6-bb90-ba192a9ab341", "comment": "Malware payload (Mirai)", "value": "10e363b0d4ce3beda9e23883cb15653c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807956, "uuid": "f68ee078-6672-4f76-8a69-38f9d6a1739d", "comment": "Malware payload (Mirai)", "value": "f43f43b4ebe5432798b1383b4b0c892952104622c5e120e52e6e5f1b46d053f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807956, "uuid": "7cc01570-bf60-4945-bc8a-9e2f929e7941", "comment": "Malware payload (Mirai)", "value": "b0488282e7daf47085c4fa33d7f7c1a17aca8eb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807956, "uuid": "648de674-c0a1-49ec-862b-5b5ca0a3be10", "comment": "Malware payload (Mirai)", "value": "e81b31bff04eccbed7701185256594ac700ce6780c5dd49539621423f8826fe96898be07221c3b130572102ba7f28b77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807956, "uuid": "b87cca28-b92a-4018-ac44-7afac6e17fb5", "value": "T17F23028C095147EDE4ABC4F48AE22F612C704F969641A4C1DB9CFE154E870A2B1D3DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807956, "uuid": "4e8aa21e-e064-45c8-b972-1b1f37a966ad", "value": "768:J66eFt7L1b4sQuiQu9+BAIv3QcvLjLHj3ZWwJdI9FQIgocCiNkg9FpJgGlzDpbuG:lSt1b4rQuwBA/cvn3ZnJWbQDocCqbVJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807956, "uuid": "3714db4d-0a0a-41e5-90c2-3b31021ce3f1", "value": 46200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807956, "uuid": "c9d55183-a9c0-4481-b82b-943d3fe95cb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807956, "uuid": "31dc3f8d-3b2b-4fe2-aacf-a90ad891dd95", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd9f210-d112-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764853937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853937, "uuid": "7ef2b9c8-c521-47ee-bcb5-ff5a36c4aede", "comment": "Malware payload (Stealc)", "value": "f9e30738b2b0cd581b80596af2e1c884", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853937, "uuid": "804d6083-fa44-4a09-8b65-2ff668ee008e", "comment": "Malware payload (Stealc)", "value": "f4584140becea8907edb22c8a99d5e9e9157931aa1e2ab29522adbc9ba684f07", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853937, "uuid": "4192488e-809f-4220-a291-56aa32bb3a66", "comment": "Malware payload (Stealc)", "value": "097ae0cf6c979acde93537077f54eaa7807d9770", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764853937, "uuid": "c371a4e5-b8ac-47c6-8272-ce598c73808d", "comment": "Malware payload (Stealc)", "value": "79a553922fa37e77d1ec74a258e665af68be0b5a6b44e8c62e7920a130f86b0de083b0cdc8ae0eead667c73f18e4f773", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764853937, "uuid": "38786c7e-69c6-4480-9268-2fd37a891873", "value": "T199E47D5AE7E603F8D0ABC278CA428546E7B2B8454770978F03E15AB62F376905D3FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764853937, "uuid": "612243a6-74a9-4e2e-aad8-a0d1f6eb8847", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764853937, "uuid": "b4512f66-3e93-4d5b-acc7-ae9e7dca20f1", "value": "12288:iahVHeIz95fPy1vOB2/v85l3UQpv3YZtF15kjHt:iyp5Hy1vK2H8DEQh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764853937, "uuid": "652c526d-fdd1-4534-8948-9d69b5fd509d", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764853937, "uuid": "833bea55-bb16-4846-b9f4-031540843b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764853937, "uuid": "e5e23b95-3827-4ebf-84a7-a9f0019f6346", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4139992f-d14d-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764879018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879018, "uuid": "3134f014-4f07-4378-b4fe-27cf470d4bbb", "comment": "Malware payload (RemcosRAT)", "value": "44597f322053dcd6804317955cae05f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879018, "uuid": "c61c52f0-3ce8-4d96-920f-d33f3a338d68", "comment": "Malware payload (RemcosRAT)", "value": "f48b56e4f61e6ab518d100b332aacd7c21cc7a0f01b63b98ab445fa3fa6638e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879018, "uuid": "a6c3dc8e-6c81-46e6-bf9b-f74e3429d983", "comment": "Malware payload (RemcosRAT)", "value": "ebea80771e43bb02cd9125ab353bc5f5551f434c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764879018, "uuid": "802e4016-d6c1-4c51-848f-62ab883cc540", "comment": "Malware payload (RemcosRAT)", "value": "89f9ec95799b127868329cd8e3c361a8b9dc21655e4bcf16d186a0f6f7078df7be6aa4a2289ceb17a0f764b4af508d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879018, "uuid": "802bbfab-78e2-4e62-bc32-dcc04e1c123f", "value": "T181B4AE01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879018, "uuid": "ae6bb0f9-0849-470e-b2e5-217b4324253b", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879018, "uuid": "ecdf0237-1fc9-4f87-9927-411ee1e3ca1d", "value": "12288:86pxxGI8gvGOHJpAbDYGxLhZ+sPZtXmPFN:86pxxx8U+bDYGxLhZtZ8PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764879018, "uuid": "fb6885df-c090-4a2d-af99-a8054b67f513", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764879018, "uuid": "884ac7c2-155b-4cb0-ae1c-ba457f213334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764879018, "uuid": "e841cd45-966b-467a-8f14-bddaa8ed96e6", "value": "f48b56e4f61e6ab518d100b332aacd7c21cc7a0f01b63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ea1ade-d0e6-11f0-a129-42010a9c0007", "comment": "Malware payload (OctoRAT)", "timestamp": 1764834872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834872, "uuid": "bf6c6683-ee1c-4fd0-9d9f-e196f3fda8f8", "comment": "Malware payload (OctoRAT)", "value": "43183464cca97961b7617eebd7b4c402", "object_relation": "md5", "Tag": [ { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834872, "uuid": "ec346724-4afe-406f-9f6a-13e541162967", "comment": "Malware payload (OctoRAT)", "value": "f4e5b1407f8a66f7563d3fb9cf53bae2dc3b1f1b93058236e68ab2bd8b42be9d", "object_relation": "sha256", "Tag": [ { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834872, "uuid": "3d4368e5-15e8-4c97-a492-c13bada9393c", "comment": "Malware payload (OctoRAT)", "value": "b47701497d79497bf7e34d148f4ca079228b55fa", "object_relation": "sha1", "Tag": [ { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834872, "uuid": "eb3d5ce5-18cf-4460-931c-c0b8efa52b8e", "comment": "Malware payload (OctoRAT)", "value": "673ebcd80483f072cfbecfda98181cf2fc0e2128bec6c0d9a3c9e4cf6191c629ccccae5d98b299d3600a084cd10ace58", "object_relation": "sha3-384", "Tag": [ { "name": "OctoRAT", "colour": "#2932FE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834872, "uuid": "90cb4d15-1d30-48e8-977c-0e422a26ddce", "value": "T1D39423005D04EEE0AEFC911D2A7B86452A5E4FFDA04EC22B12CEFC88139F65A45FF594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834872, "uuid": "8fc65e8f-3305-4397-8639-160de7b17219", "value": "6144:8wrfeV+hPrsxUxOYjy4Pl1PvImSfnh//KSez1i4I+j8kHlb4xxcG3uUnmu4+ZkT:5rf7Nre4eSlCnh/I1i47nHwplG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834872, "uuid": "80c7b9dc-eab4-4282-adc3-d1fe9e74c071", "value": 431948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834872, "uuid": "084af2e0-4b5f-4b43-8455-126e81a97f74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834872, "uuid": "59429fa6-1d74-4096-b159-e7671904fd9e", "value": "f4e5b1407f8a66f7563d3fb9cf53bae2dc3b1f1b93058236e68ab2bd8b42be9d.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca855e15-d0a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764807093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807093, "uuid": "6301a2bb-3223-4a6c-89c3-b0cc9aa77c0f", "comment": "Malware payload (Mirai)", "value": "8b9e8dd779560b6cac25e54318a64b50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807093, "uuid": "57c13c31-7619-4fd7-bc05-267fc1a8c6cb", "comment": "Malware payload (Mirai)", "value": "f4f5aa481621e3d0482c9e774f470dd84fc38a5b76dffc98a0d7aa129b4214af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807093, "uuid": "9c869f19-b6e3-4517-bda0-7869ab74fd24", "comment": "Malware payload (Mirai)", "value": "a44f15bae3608f2148aa88b5d8531c270456eb11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764807093, "uuid": "cdc2c25c-9b54-4481-8e80-d2048f0e8509", "comment": "Malware payload (Mirai)", "value": "42037a66f8f3744282a1c34216c50099c4233cb3de24dd0e5ff43e5e155417a99e904390464344dc3a086ec2e9aa7e2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807093, "uuid": "212fd8dd-8caf-49cb-b016-f11ff4fb18dc", "value": "T19793390779C0C0FDC499C13887BE7136D962B4BE0239B29A27D8BE266D1AEE01F1D745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807093, "uuid": "9de587a1-1666-487d-adff-aba7618a7c91", "value": "1536:vUZvp4E9GO2mk00z44H8dC3+TWRHHUclddLA0ZuW8sW:vUg+GO2mk5fcdC9RHRlzLA0ZasW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764807093, "uuid": "929e786d-c4fd-4e6f-928b-5ce2f1e423ae", "value": 90480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764807093, "uuid": "d16ca407-3cf0-4701-8c95-1e92b1c1a848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764807093, "uuid": "c48b86aa-7dad-4028-9cb3-ddbe2911e7d3", "value": "zerobotv9.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2136767-d0c3-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764819910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764819910, "uuid": "491a0f94-563b-4efd-9dfe-3aa70c0306da", "comment": "Malware payload (AsyncRAT)", "value": "46dccd2fa2065a761ab6114614f948b5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764819910, "uuid": "1cc4ae3c-0168-4b62-b512-d53d9de38a85", "comment": "Malware payload (AsyncRAT)", "value": "f50d4bf5151fc2f9f89ff48f4ead9ea615bc85a951b88a6d83d0dd53bd17a942", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764819910, "uuid": "90121fef-7b59-408f-a05d-5ce7970da8c0", "comment": "Malware payload (AsyncRAT)", "value": "bbc03c7416ddd63b41531d321843841b5bb6023e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764819910, "uuid": "a130d3a5-b4d8-4949-bd35-df7c7478ecca", "comment": "Malware payload (AsyncRAT)", "value": "bc8da8d89f0c0e54f659b8fd905a2d0f0506273b470587c8d051f46c5ab035abc99d79b2d87bcbbfec8a5f599e7209d4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764819910, "uuid": "0e636054-1c21-496f-8494-4bf0114f6c77", "value": "T1D0B40190B269C867CAFB52F94822F37083FA5DADB412C3C98DEDAEDB31D5B510114663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764819910, "uuid": "c36769b2-a4f4-45f0-aa36-68e267bc3e64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764819910, "uuid": "6552f189-8c19-4baf-9c12-8e99b43932ab", "value": "12288:OPdilT8xzHu94dzCF1a2l6JW0+EDYbs5PTE5yZmrV3sxzH:OPdilgYmGFtl67v5LE8kh3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764819910, "uuid": "7f68918d-ab2d-46cd-92d3-4d0577c567a5", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764819910, "uuid": "1c76ccdf-f534-40fd-a66a-96342bf31220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764819910, "uuid": "989e4b72-3971-4b0a-808c-06768a680566", "value": "RFQET242517440000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c0c089-d101-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764846521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846521, "uuid": "009e9b02-e198-40f4-b5d7-fe339fd6ab45", "comment": "Malware payload", "value": "20c91b47836967caaaa3103ec0b2c626", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846521, "uuid": "e7093639-2aae-4c08-85d1-b20830aa7e1b", "comment": "Malware payload", "value": "f59b5224efac776a01675db6d391971c9ffd0a4535f9f19002b169f7c7f50f71", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846521, "uuid": "711e907b-c9b1-4999-91f2-c62c1bee4560", "comment": "Malware payload", "value": "6d120d2614e178b7300e50cbccfe73cf278132ac", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764846521, "uuid": "7d7aa718-72e2-47b8-a134-47c46cfe3222", "comment": "Malware payload", "value": "21a979190d95faab4c09afae3932e1d52c3659a1562436d7450c4165901a3bce17cfcaf5962e0de904126e98bc18d9c4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846521, "uuid": "48397cfc-d358-4aa4-9f4c-5f0327770fd5", "value": "T1C972E802275BA084E6913A371E5E7DD3B6B49D523A876D88F64510BEDFC2FA0C63C8C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846521, "uuid": "8dbd66c0-e567-419e-a612-f5e987b23168", "value": "384:fh+F5h3tWBl32l3Ql3Cl3bl3Wl33l3cl3nl3Ql38l3ll3o:fhch3473U3y343h30313G3l3y3m333o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764846521, "uuid": "c9cdba5e-3ef0-48b1-b8be-ad8cbf88e872", "value": 15978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764846521, "uuid": "7586b7ac-cb34-46a9-bd28-e814aefb3fb1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764846521, "uuid": "990ad421-2541-4642-82a3-df79bbe975e0", "value": "Declaration of Income and Assets.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ffbd8d-d0d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764828486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828486, "uuid": "d0866a4a-bfb7-46cf-9720-82773132dfa4", "comment": "Malware payload (Mirai)", "value": "998dd9639c1441c9582e8aa6e75628a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828486, "uuid": "ccf4c4ac-9e49-4ee8-8f62-0f3b0aad1a37", "comment": "Malware payload (Mirai)", "value": "f5c710af3781510bebb99a9c033bfc364297278340bb7aec2657a60981cb69d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828486, "uuid": "b0b280e3-0002-4dec-abf3-410649918586", "comment": "Malware payload (Mirai)", "value": "206fbaa73acdd356048861a66961d2ba9ac348c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764828486, "uuid": "a4c0c70e-ed71-4af8-8094-5bac19cfcfe1", "comment": "Malware payload (Mirai)", "value": "e4cd947c6942ade23332e66fe2aeae69db04ee55e0bce8b7b4e1d463d4b6e29ed1acb937f03f7533de8c0e2d4f70afa2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828486, "uuid": "e6e49ea2-f968-4f00-b1a2-281c826e049c", "value": "T1816183FAD2D646225EA15572A3AC88047C5EE1B3F8C76E146DEA3AEEF44DE447001D0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828486, "uuid": "8d8e4359-8e76-4c30-b5cc-1b890a3e10d7", "value": "48:iVcRWRQ3AxVFkhiVdsnKhL4Jfl3qb0T23ET12:iW3Ax9sKhLqfb23E12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764828486, "uuid": "0aee64a5-40cc-4cc0-ac9c-9470869771d2", "value": 3333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764828486, "uuid": "11cd1943-cdc4-4b08-a96e-1778c75526ae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764828486, "uuid": "74ad53c4-88b5-4cc4-b41a-c23e2e4daa61", "value": "thefuiodaas", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec27ab29-d154-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1764882311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882311, "uuid": "0e708003-29a0-41e7-9f80-00655f6fc5bc", "comment": "Malware payload (CobaltStrike)", "value": "9044e9e97da86cd1b2a273192c57f1ad", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882311, "uuid": "2f91ff7f-8462-47e4-994b-aabdf4caa476", "comment": "Malware payload (CobaltStrike)", "value": "f5c7faca5b5563e4740a6d2196acfb3626ecbcd38da4d690dc23e13e7ecf747c", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882311, "uuid": "413c756f-1efa-45b6-ad61-59b428ebeda3", "comment": "Malware payload (CobaltStrike)", "value": "7accdf3672025fef4f88ee062790c17d43f413a1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764882311, "uuid": "f44140a9-240b-4636-b237-94942c98871e", "comment": "Malware payload (CobaltStrike)", "value": "6141307cd73143a31d6d4371c5bb8b0a07141d909d84764a73c9861c4b1a0aceaf4d1643d4075a84fc384d440bc9d1bf", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882311, "uuid": "5bc23b4b-8dd6-454d-aec3-2d4cd827ca96", "value": "T1D692FB3FE71368E9C106D57845FF3772DCB23DB385A6931E1724D2B42E106A46EAE610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882311, "uuid": "3122ebfc-4017-4e30-9f0d-2a6d6ca79616", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882311, "uuid": "8604edf2-3276-4786-bede-06ace0bb2e12", "value": "192:bV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2jzzk2OzWF8qa1Dojjgi:1qaCF31cix+Dc4zj43k2hFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764882311, "uuid": "f0b1dd25-b9bd-443d-8354-b8e4fe606ed6", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764882311, "uuid": "e8921727-dc1b-4365-8e92-6008b197faee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764882311, "uuid": "1dbdca35-31c7-4f50-91cb-8f1bb7d9aa62", "value": "RD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be48368-d0e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764836140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836140, "uuid": "eefde42c-2437-4a3f-a35b-987dfde0d6b0", "comment": "Malware payload (Mirai)", "value": "d4e4c14fc09301a1e36288d9a001dc77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836140, "uuid": "0ce9962c-6ef3-4af8-9f83-5a71e995e4d4", "comment": "Malware payload (Mirai)", "value": "f6a19083cd6d83d996bcaf7fe9a01677b9b50369271b01157602940db2f98e34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836140, "uuid": "b1cbaeb2-1a7f-49af-9921-66a0424547d0", "comment": "Malware payload (Mirai)", "value": "4781384dc698a61277b36aa72e6caa3663a18527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836140, "uuid": "51606302-8d37-4f90-ac79-b4d27c981dd8", "comment": "Malware payload (Mirai)", "value": "7437224550fd73599fb538387a3b8d253ed5bfcbf0da44517190fd1ecf08e2480d7300d19a5735432fd625f42813b618", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836140, "uuid": "d0142802-fac2-40b9-8df0-0fb2fabff261", "value": "T1C053F905F950871FC6D277BBF75E039D373A5A58A79B33116A382EB03BC5BA42939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836140, "uuid": "f4581fbc-3e30-4a07-b0d9-840a32503203", "value": "768:eWxHNAAbh60EofRDJFgSOhXFWUec2iRxElK0cEN9pelBmS1/cd+MafSwKrAgDd:JHN/3P3FgSOh1MhiRx1ZUeRGAKj35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764836140, "uuid": "0f774dbc-fe58-495b-8553-bedccb295517", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764836140, "uuid": "1194c459-f8af-4ff2-9623-e7613031400f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836140, "uuid": "37ee90d5-9195-4bd0-90ac-c43d06bc32bd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085bfb2d-d126-11f0-a129-42010a9c0007", "comment": "Malware payload (PupyRAT)", "timestamp": 1764862172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862172, "uuid": "c66ad2f4-6591-434e-ba9c-187a2f41c7fc", "comment": "Malware payload (PupyRAT)", "value": "e0e1691e2330a42a823fe8507ec7fabe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862172, "uuid": "d4ffc011-8241-47ab-a466-1ac8ce871588", "comment": "Malware payload (PupyRAT)", "value": "f6dbf9ef53dc7851a037f2e3b80c78aed19eb32dd9aa8fd81e9f3ba0a30ae095", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862172, "uuid": "d9fba471-c728-46b2-aa7f-791f0b14bcf9", "comment": "Malware payload (PupyRAT)", "value": "359b705739559cdf88d62f3d398d60b8df90a0d2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764862172, "uuid": "b00c8b19-07c5-48ec-b2c8-5b59bb9d1e48", "comment": "Malware payload (PupyRAT)", "value": "347a376ebf7ce0ba2c64b6f674015fc05498e56a5b315c4914e6194bf0b2835d5fb4cdd46fb1e45145bbf94fa6726f09", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862172, "uuid": "0eaeb56e-46e8-45b9-b5de-f4dc77afb266", "value": "T18F55E0A67890C98FC6BE31F7FC46230C963B64452BD977A752B0370C2A2B5A419BD3D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862172, "uuid": "f60bba93-e193-43e1-98fa-e8f418aa0b13", "value": "075b333ab597dc57551d81ab21d02fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862172, "uuid": "9ee5b4ca-0f94-4a69-b804-2faf14e7e29c", "value": "24576:ClsfwE1663yJTIzH2FpiNRlVVQyTNg6KJlDxEd0QN9wpcE5qjsYW:C4w0663Y07Nwky3Dv6wCExYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764862172, "uuid": "fc11568b-deb0-46f7-ad58-8338817cfa69", "value": 1352269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764862172, "uuid": "9993e067-fef2-4969-927f-6e01122baf46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764862172, "uuid": "29b8b4d4-4f59-4672-9334-d6f5ebc5a177", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0c9133-d0df-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764831709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831709, "uuid": "bd8bf255-69ea-485c-906b-2da376c63ce6", "comment": "Malware payload (RemcosRAT)", "value": "13ff00b8561513dcc1503a5ba21f3027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831709, "uuid": "bc80d4fc-007f-467f-abc7-6cbbfd97e46a", "comment": "Malware payload (RemcosRAT)", "value": "f6f4ebaad107ea8d7ca36820f2ce6dd40b40e004b70c7656ce0ebfe66200fca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831709, "uuid": "bd56edf8-252f-4e73-8c87-cefd89a17da4", "comment": "Malware payload (RemcosRAT)", "value": "25a3a7d4bc2ef462dc678e356d02bfe5d9c1d458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831709, "uuid": "31255173-9907-4b95-8f15-0e9b869113a3", "comment": "Malware payload (RemcosRAT)", "value": "b2ed5bfd56fe3e99ef1806affe77b861001cace28e27cb4498e0f0cb21ec143b9ad776d849a5840e9c4b1f2f747a697d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831709, "uuid": "58d1ad09-c110-4c77-a2c1-ebf79250c768", "value": "T129942352B578D937D8F34BBE0075DBB62EEDB93E43725D4307102B2A7E954829B4B220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831709, "uuid": "eb1bc419-ebf0-41ef-81b4-19b81753d594", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831709, "uuid": "13445f83-a743-4e61-96f3-428d3700d5d0", "value": "6144:NbE/HUS1d6Gae7cSdorxUhjA/wjysgbnK2K/+312v2CupgeU0n/zN7ApMDnKIUUe:NbYdbaEzUsgbnKhmIOCGnL/zNc2GUmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831709, "uuid": "c76abf85-1763-403a-9fab-6a2efe858830", "value": 448120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831709, "uuid": "1f0e8b65-9ca1-411e-a585-e9e6fa060589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831709, "uuid": "0943251d-810d-46e7-b182-95601fc77d2b", "value": "f36ux.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18085716-d0da-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764829557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829557, "uuid": "5480cd4a-0342-427f-adb8-4c55b385ea3a", "comment": "Malware payload (RemcosRAT)", "value": "c005ad924a7a215d242cd20640e9e025", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829557, "uuid": "c4052dd0-79fc-4f57-ba00-8299aadcb0f0", "comment": "Malware payload (RemcosRAT)", "value": "f7125bb975a0af2985fb3dcc8e12194a7e3753face53475afed7718614100853", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829557, "uuid": "d7495e97-423f-4902-be6c-b520fe47683d", "comment": "Malware payload (RemcosRAT)", "value": "88fbcfad6a32952d8696985868667fb22d4fdc61", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829557, "uuid": "6b80ed39-235b-4069-ad78-11e90b6c56b8", "comment": "Malware payload (RemcosRAT)", "value": "6dd2634c25bdc7c23f2c7e8d40042237156d47697b8c5b84e9d0938c593d241fc1e6de8fc77e9bba3e45b7a2b75d0a7d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829557, "uuid": "4b05ca94-afa6-4107-819e-a08c540e8822", "value": "T1C4A53316ADB3BE3D412A032934239E4A3CA59F84D40DA4D4B7FE60D71F6BF53468E498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829557, "uuid": "5c1c0f32-bd5b-40ef-a941-979606873536", "value": "24576:RY2Y9HmMzo/b0bXMTscAntcO8lUE7axN/STUX4U8aXrbaz/59oVPUmLQQFhQo3hA:R3r/OtcOkWNKTiW9oGIhE/NXvUV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829557, "uuid": "9709814c-0758-416f-b772-189541cd6e74", "value": 2236496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829557, "uuid": "4a52f0d7-edbc-4b5e-a497-e163525886c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829557, "uuid": "62b8e2c2-a672-4c16-a137-154e9288b4a1", "value": "Encrypted_Script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8b89b9-d0c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764821785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821785, "uuid": "fc548041-70e3-4dba-bbe4-048104f342c0", "comment": "Malware payload (Mirai)", "value": "f39a45b4052f2e0f542b4693cb13ac30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821785, "uuid": "25f2276d-10db-4a42-ba06-263a2e2df7f8", "comment": "Malware payload (Mirai)", "value": "f72278328b22c8f51cc6384de0cb349aeb822907c72141a8a2e3e5f161fb0041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821785, "uuid": "34ba8c7a-1a2a-4901-b610-d56e856f875d", "comment": "Malware payload (Mirai)", "value": "11e2c028c7b11759d7c4890d2d25ba4a7a134407", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764821785, "uuid": "8264face-cbdd-4446-aaba-4c7ea9dff92f", "comment": "Malware payload (Mirai)", "value": "d257f818e215e75b7d19b9741f1cbc09f8c5c3e795112fbc9c782bc6c95fe8acc44a3c5c122f1df05cbf4f1d8640a2ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821785, "uuid": "ac2975f2-62dd-4e81-9e26-eaa79f5af546", "value": "T1FE43F2455AE939E7FAEF1438854E13B16D4A07CC22DCCB0C370A8D11EB29D0B6D89D9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821785, "uuid": "df6aef6d-06f2-4741-bd43-ade74c66287e", "value": "1536:FEKZji+fRmZVShBdkPBLvkNk/v4Nl6z9Fh1PZcNM:KQQSWINMv0W51SM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764821785, "uuid": "e78810db-1962-4bec-83f7-f678a9d00213", "value": 56624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764821785, "uuid": "e0293921-3f71-463b-a583-0533e4e08c5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764821785, "uuid": "4f6c3f34-52d9-46c2-b3a2-935208aa0dde", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc705f6d-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875467, "uuid": "890c8d4b-cb02-4237-b78b-7245a9bc02d6", "comment": "Malware payload (BlihanStealer)", "value": "b6479c4de956e7d9deea0e50b0a90f8b", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875467, "uuid": "f86938a3-7198-4eef-9684-8a8e487eec9e", "comment": "Malware payload (BlihanStealer)", "value": "f739353bc281265d5d5ada6eec05f0bcbec8be3f48ec34a1790effaacba952ec", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875467, "uuid": "ed42cf9d-425c-424a-8f7f-74a0f3386900", "comment": "Malware payload (BlihanStealer)", "value": "820cea30459c56725b8971eeac03805056530972", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875467, "uuid": "9c7eca68-5e54-4f78-bd57-ae63de5732db", "comment": "Malware payload (BlihanStealer)", "value": "66d33b6f8b223963011942b6aa86314f26440f175d7257e884c21de4dd511e813041117105590d6cf54d32c82d7fae30", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875467, "uuid": "1d888927-e209-4098-a182-2fb8dc545e71", "value": "T175B36C135EC3C9B6C4A121321AB9966DD2AFBD051FEDA3838BDD9C0922525C4DE2E643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875467, "uuid": "f07cac0d-dc6e-4670-ab85-9169f12a1378", "value": "757708ca9fd3f4d0b8bef404d6ad71f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875467, "uuid": "cd3c8c7b-852d-4e97-bc50-682e729931d0", "value": "3072:vAowVFgjQiUkEwt/XqXBn22n2222IICUrh1EasEE1YCfCnEEEE1E14AK1EEqE1Ek:oAjTUkfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875467, "uuid": "f7046b2c-675f-4ceb-b5ab-f710a88b4103", "value": 108420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875467, "uuid": "723167bb-75ef-4e9a-8237-30614cb53421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875467, "uuid": "db2cdcd7-c09a-4d58-ae7f-0cfe018c48c2", "value": "nh6is8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47012f3b-d0ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764836508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836508, "uuid": "d916297f-891d-4795-96c0-a138e9b8cea6", "comment": "Malware payload (Mirai)", "value": "af538e1715c5e03f960cf04975210392", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836508, "uuid": "78b3b83a-05fd-45f9-84d0-f98faf81ae50", "comment": "Malware payload (Mirai)", "value": "f7a278ab0b89bc08c0090216d1a2166bd64dc32041ad7d28bc04b83f5e787c81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836508, "uuid": "66ed1721-d1ae-425b-8eb0-047033de9adf", "comment": "Malware payload (Mirai)", "value": "996606a6f478313b592e7a59b22cc8570b07f327", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764836508, "uuid": "ff78243e-e833-426b-940e-d6fb0d537ea7", "comment": "Malware payload (Mirai)", "value": "79e32aa0a7f6de32ffdfcd721b616833a09111f31de0fc7b1a31f6ce5ba22000259fef261a9256fb51f2c9837bf6ec9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836508, "uuid": "0a1af14c-9df6-42d1-a477-210199514d07", "value": "T19E73952BBB61DE77DC4ECD7306AA4502208DA44A12D96F2FB6A4D52CF34BD4E48E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836508, "uuid": "cf9ca1db-4f96-4311-baba-37e074e21570", "value": "1536:3eTB+2ZkXDwhToPVoFNsQ9qZuLM8+UHHnB:d2ZkXDwuPzsq/UnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764836508, "uuid": "1c91c24a-7618-4770-a83f-e40ac7ae9fe9", "value": 79644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764836508, "uuid": "bde968f5-806c-440e-8ac3-2c111a55ff83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764836508, "uuid": "992a45e9-9b27-4624-9bde-6227005a52a6", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa48cd5-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (HeliBot)", "timestamp": 1764829051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829051, "uuid": "cfb596da-6e97-4016-af9c-2f604705d6ae", "comment": "Malware payload (HeliBot)", "value": "26af55c9894aa1327702cc619dd39ce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829051, "uuid": "3470ead9-1afe-45fc-801a-e87ac9cefaa0", "comment": "Malware payload (HeliBot)", "value": "f82716a75a974c80272d7beb11a9fd2b8a6ad48116936f4499888f14e44fdaa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829051, "uuid": "65689d05-b320-4924-9053-b9a53229b9e5", "comment": "Malware payload (HeliBot)", "value": "fc2aca3755c8435832112a00c294aba3804de9fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829051, "uuid": "34499cfc-dec2-4731-b289-438bac7364e9", "comment": "Malware payload (HeliBot)", "value": "77be41b5ccd4e0f116cac61e9af76487ceb723a347190a2635622a545dcad557c87862fe738b2c4067bf1a55fa6486d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829051, "uuid": "170cd522-a95a-4458-9846-2fc3bc6a8bf7", "value": "T165932B41F9418B17C2C327BAF7DF439D37366A5897D733016A297EB42BC67891E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829051, "uuid": "2cb15384-42fe-44b7-88ae-fe681366954a", "value": "1536:7TqOIBM9ItFCzx5O8nsMyYP+Cv2AOStVNLb2pqmkgmQAE+dAXDfj:iB+zTscR2AOKKkmkgmQAEUAXDfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829051, "uuid": "7881d2da-46fe-47d7-832c-4d918a398a33", "value": 91819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829051, "uuid": "6563056a-d263-4367-8fa4-166c456aabd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829051, "uuid": "ab4179d9-fe48-4ac7-8478-75446a6c5fac", "value": "bootingworld.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a5a106-d145-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875479, "uuid": "28f6d891-4270-48a5-b306-967b747c782d", "comment": "Malware payload (BlihanStealer)", "value": "fbc5bdb84bd676981edd599aba769479", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875479, "uuid": "7c312a88-eda8-4538-972d-e212ebedd1b9", "comment": "Malware payload (BlihanStealer)", "value": "f958319dcd79450ada739744f052d3925c98b38342850a05fd1e9fa9b661c0e8", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875479, "uuid": "b1f8e0ef-67f5-4a16-b5e1-76f05fc42808", "comment": "Malware payload (BlihanStealer)", "value": "e9be4045abcf2d0b5d7d2034c99e98f96563b048", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875479, "uuid": "54a19f43-4faf-4ef2-a87c-60274749af81", "comment": "Malware payload (BlihanStealer)", "value": "f0fd8e36b251ec3bed57903fefb0b5024e4acc91aa68a968456dd51ed33ebc138960caf6cf17b9a6932a364b6f036e85", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875479, "uuid": "da992357-e2c6-46de-96d3-681dd59064fd", "value": "T16C938D13A9C284B5C4A2263255B9967DA6AFBD001FFD97C387CCDC5D26622C0DE3E643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875479, "uuid": "857a5804-d083-4fbc-b5b7-ccbec3ebd6d8", "value": "757708ca9fd3f4d0b8bef404d6ad71f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875479, "uuid": "29186444-d35f-4f5d-aecc-8d90ddf11d0f", "value": "1536:vAowfbJFgjQ284U+w2EwRz/IUqX51n22n2n2n2222n22n22222n22n22227XjCFC:vAowVFgjQiUkEwt/XqX51n22n2n2n22Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875479, "uuid": "e9f6d766-5d6e-42f2-ba3a-53ff3656f019", "value": 94828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875479, "uuid": "040ad819-edf0-4894-beac-b0f499dbce94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875479, "uuid": "45077021-58e7-4b70-ad22-f0a1c7a0a2b0", "value": "50a05fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5563f00-d139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764870623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870623, "uuid": "649f96db-36f8-45f6-8d61-373d42e57fb5", "comment": "Malware payload (Mirai)", "value": "fe9ac135f452ec482a5bca44e08f86fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870623, "uuid": "d8ebe2e2-1eb7-43cb-8a3f-e05bef2e0218", "comment": "Malware payload (Mirai)", "value": "f99af17edce023a866543c2bd5a85eb1269afccee56ee688be561a0b00904a92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870623, "uuid": "79a47224-742a-4cc6-be7e-a7b11989420b", "comment": "Malware payload (Mirai)", "value": "f2f3bb0c5f6b52d1a1d0cba7715bfcbcc6c23b10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764870623, "uuid": "a191dd68-ac6a-4d3a-852d-3e947dda1932", "comment": "Malware payload (Mirai)", "value": "1f8dd8346ca1791f4cb7d0f3595a0be6b3fac1cada67fce7ce1188b24c0ff528e93b3f453407426ac6f6f3e9ad656aeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870623, "uuid": "1cdee748-4c28-4fcb-99c5-0328648cfbfb", "value": "T17B13F1AA031144EECE82F0F8DFE04F912B282B57C90FCE656566ED57CD4B2A17CE1949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870623, "uuid": "442c94b5-3ca9-4cf0-970c-dccc953ecdca", "value": "768:PH63cEtjr/ciLDEPv3PPMRMdZrIopQOKwpo0AycP1/s/oK4iHK0JgGlzDpbuR1JS:PH4004ZrPpQOKwpo0Ar2l4MVJuuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764870623, "uuid": "7c2e0e71-8d6e-4747-a0e8-f4ec22d5e280", "value": 45436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764870623, "uuid": "40ca5039-82cf-4d0a-b21c-9b7ddec5b9ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764870623, "uuid": "f138677b-e377-428c-a485-fe8452df8321", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcca0a03-d12c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764865052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865052, "uuid": "20714a07-0d82-4ef7-9c45-5c6a10079d78", "comment": "Malware payload", "value": "334f4d2d623375ce23af71749a057b70", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865052, "uuid": "58c1b14b-6c26-458e-87de-8586cada6236", "comment": "Malware payload", "value": "f9fa1bf29cacff53e39865e45fc05d2164314c0f2877f9720ca604d50f00df71", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865052, "uuid": "dd713b16-5629-4263-b378-fc8176dc16a4", "comment": "Malware payload", "value": "52ef4c3669392482aaaed1145b04280e65b23029", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764865052, "uuid": "8ace6aa9-447e-49b3-9443-dc4341026a48", "comment": "Malware payload", "value": "33010de80d2014fe3fd1a9b1c119b215cb19fce7c8ce278c7828fa2eb2e4836ae4b724f02c79bf456006619c89b03abf", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865052, "uuid": "5e8f6fbe-d393-49f6-a48a-d73ae3a088b9", "value": "T1AD01F9BD91A88A5205B5C5C7B2F54546C490D08BA2FE57E6F38D09266F28CDE3C5320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865052, "uuid": "432039f9-6bd3-46d9-b1ed-07c51821b837", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+MjRCkV9GDClkV9GDoBjZhG+E6:FH8j/wWi2jz8PV9TSV9lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764865052, "uuid": "ad38c1be-e6bf-4478-8187-3951839d4f90", "value": 740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764865052, "uuid": "ab4782a5-655d-4216-9098-1c58be8ce267", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764865052, "uuid": "cdec5ea6-a2c3-48d8-a311-76ccca1372c7", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d09b03-d0cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764823708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823708, "uuid": "dd59af2e-2d5a-4e07-a7f2-ce697325d83a", "comment": "Malware payload (Gafgyt)", "value": "159f8be0199fe335f204c36c89a2c77b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823708, "uuid": "5cede6f1-0436-4a86-b13b-cdb0bdef30ee", "comment": "Malware payload (Gafgyt)", "value": "fa4e15019b36b3811b0f470816e43302fff87d811680a4628d85473154ff036a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823708, "uuid": "e6c560a1-a2f1-43be-87d9-08adc49e7937", "comment": "Malware payload (Gafgyt)", "value": "b2baa6f8ef0fce0daed9ad6a6b13e9d51584fea6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764823708, "uuid": "3e5634fe-396e-4713-955c-cedb83cdfc9d", "comment": "Malware payload (Gafgyt)", "value": "4a52d01b8075dae6f7b9526322fc9a5bf410c49201c8adb987c5ab8c5de42101c1d0a14f6a2267e41ee8677d572583a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823708, "uuid": "25d2f2af-12c7-4729-818d-7af4f7200bfc", "value": "T12004971D2E228F7EF66C873147F74E35975923DA26E1D684E2ACC1041F2029E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823708, "uuid": "30102446-04c5-4232-8957-1329834d8144", "value": "1536:YSFGMkn2KF2BopHqopK34L3ljjgO8ynvTQdpgWeykQsLaqp9BgKcxfJbL2e+IK30:s2w3qO5BykQ7y+KyLgIK+QEHqPm5GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764823708, "uuid": "fd968d32-0005-4aeb-841b-7e2303f96c80", "value": 173408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764823708, "uuid": "d8e8361a-2c7b-4749-bccc-8256db323915", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764823708, "uuid": "28faf424-a7ef-4472-92f0-269224d225da", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c27489-d0df-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764831697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831697, "uuid": "a2334592-6840-460a-ad3f-339080bec24a", "comment": "Malware payload (RemcosRAT)", "value": "f13a7f7b9e972b935826b3f562a1cd94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831697, "uuid": "1d13dcee-dc29-444e-8c69-bb78b112eceb", "comment": "Malware payload (RemcosRAT)", "value": "faa2846a9b557f84fcbc338bed4e7b3b748994150d3bee39abf4724d5af085ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831697, "uuid": "bf5b2d68-c6ec-44ad-bb61-a9ff221fb5a4", "comment": "Malware payload (RemcosRAT)", "value": "b6c996893ad6f5cb899885a29813e721151c44f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831697, "uuid": "f1bdaf9c-1cd4-4c21-a3d1-95006dfbae12", "comment": "Malware payload (RemcosRAT)", "value": "8c0d49eec7796868055f89c1a149d35244361503feffc0242c8c9372198e28616db2ecfb6c3c2f91e95590f6b6c968fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831697, "uuid": "91bf5c78-5262-443a-985e-7225a78a564d", "value": "T1A2842266B2F8E467C7B52770A9B61B376BEFAA3652114C8703603F0A6C733C1A60B155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831697, "uuid": "20c673ba-5090-42ba-97e1-beb25c7576e0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831697, "uuid": "68c8d2c8-48d0-4dad-8336-577efab28646", "value": "6144:dbE/HUS1f+Nt7rMLCM1Icc7Y3vlKCLVFiO2JftmoxvApMDnKIUUmy/:dbY2Nt7rM2wIr7Y3TZs7zmJ2GUmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831697, "uuid": "5b1e0706-81f7-48ad-aece-2a53cd80e891", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831697, "uuid": "def8abd5-a399-4548-a838-5dbf0c77bcb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831697, "uuid": "2b7fced1-1ea6-4081-af6c-989cc0492e70", "value": "Arrival Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202962dd-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1764834295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834295, "uuid": "f7d4d325-55a7-42b9-aec7-6fddd20ddb71", "comment": "Malware payload (Adware.Techsnab)", "value": "67ec804096f6daa301f56de5ea10e61b", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834295, "uuid": "13d4f879-215e-485f-9fda-d47039dcf944", "comment": "Malware payload (Adware.Techsnab)", "value": "fab7b1f9eabe9609138d344f88982d32892dbde8ab7ff1f42589ff9605952245", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834295, "uuid": "a5647642-33c3-40b1-8b99-0bdc755f4127", "comment": "Malware payload (Adware.Techsnab)", "value": "eecc63e5e5e7c4217d0b2b2dd237303d912e409b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834295, "uuid": "a06f8d5f-1633-4b3a-9d75-d181deb2db95", "comment": "Malware payload (Adware.Techsnab)", "value": "5c62238650a3035b97b6577c02999d316caa1c305b93708402ef3cf0874b78b2e4466c96253996fcadef8ea135ffa812", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834295, "uuid": "11173314-53cc-4478-b491-1960ac882ebb", "value": "T15322292F314E8464C7E29595CAEFF60DB8C3B4BB04162D9C77DC950A6F20464D3ACA6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834295, "uuid": "acb01b6a-8ef3-41da-8240-ca2296c56936", "value": "192:IzAAEhEcEXlpPyIiCzIb1j8iDJiJdiqmriccKCSTrif6zdJaEOHhx:971Qigiqml9BTW6zrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834295, "uuid": "df72a88c-57be-4258-b63f-4ec11bd2084f", "value": 9920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834295, "uuid": "5d9b6f49-e8a8-420d-b841-98428c26144e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834295, "uuid": "76083c30-225f-438c-b82f-a45686d8fa76", "value": "fab7b1f9eabe9609138d344f88982d32892dbde8ab7ff1f42589ff9605952245.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d873ab-d144-11f0-a129-42010a9c0007", "comment": "Malware payload (BlihanStealer)", "timestamp": 1764875394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875394, "uuid": "17da5658-a9e8-4b71-8289-3b8e54888925", "comment": "Malware payload (BlihanStealer)", "value": "1d515124033e6c8b2189cc26066bc334", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875394, "uuid": "d09ad0ff-0c87-4188-bc0d-d991a92f57eb", "comment": "Malware payload (BlihanStealer)", "value": "fb77de991705263fe3cc9f8f9bf2ceab0341ed718057e483647f8a445a07f0cf", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875394, "uuid": "08fd4063-eaec-47b6-ac67-b43473ac720f", "comment": "Malware payload (BlihanStealer)", "value": "901e980c914794138a26dda96365da6a0b610996", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764875394, "uuid": "37ec9087-9e8e-4c79-91b5-e34a4b68d075", "comment": "Malware payload (BlihanStealer)", "value": "87099eae4b541632b2bb1d1770560372bf34aa7ec6e381fe917b18f81b6028c59fc57288337906849391b95e88277616", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875394, "uuid": "826b33ad-98a9-49f4-a979-55b13f6dbdf8", "value": "T111938D1369C284B5C4A2263259B9977DA6AFBD001FFD978387CCDC5D26622C0DE3E643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875394, "uuid": "87665b89-abbb-4be3-aee2-fb455bdb82b8", "value": "757708ca9fd3f4d0b8bef404d6ad71f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875394, "uuid": "75bec113-a1d2-4e26-8bf3-403b23a3d106", "value": "1536:vAowfbJFgjQ284U+w2EwRz/IUqX51n22n2n2n2222n22n22222n22n22227XjCFo:vAowVFgjQiUkEwt/XqX51n22n2n2n22m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764875394, "uuid": "da61baa2-ca52-43a2-b2ae-b937c0a098ac", "value": 95088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764875394, "uuid": "09e2bea2-4051-4c1d-9d99-69a057434d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764875394, "uuid": "77a1560a-86f7-4bbb-bda6-dd000b81e896", "value": "a26dda9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23927231-d13e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764872526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872526, "uuid": "c5bc92c6-6289-40b0-91d0-cc7a14bb030e", "comment": "Malware payload (Mirai)", "value": "2918044bdc6f2d5de20480b462a0a4e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872526, "uuid": "e812b81a-53c4-433f-900e-02f1ef31b1b1", "comment": "Malware payload (Mirai)", "value": "fbc5f4ff1a51a606c1b24d53548fa62c928691de1320841ff46e328a9ec32470", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872526, "uuid": "9cf8c2b2-7d0d-434a-9884-7bcf6f9e33db", "comment": "Malware payload (Mirai)", "value": "0ac40e6b2b479fb2912c19af7aed395025c479ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872526, "uuid": "8f40d671-4623-4123-a83a-847baf3687bc", "comment": "Malware payload (Mirai)", "value": "c71db79e13af64432ce9a37cb2cbb45972ecb065f814224f47889cd7b305f4eefbce33601b3ca5ccc40743e658a3af0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872526, "uuid": "ac130e0f-9e9e-4585-8462-4be574b4417d", "value": "T1AA93F803F5C689FDC04AC1306F6FA436DA34F99D12387A6B1B84FF21296EE315A4D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872526, "uuid": "b006a61e-a63e-4000-9ef4-912f6f5161e3", "value": "1536:0DFQ8rwo9Y1JaUWfm/NvXEGW11tfy6RgVIIWAht6RztCaEdeWMdqw1Xof9R9zr:AQIwo9saUAg99O5cWHRzIaEUfjo1Rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872526, "uuid": "d7cd58be-747d-49a0-827e-793d6b99f60d", "value": 89736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872526, "uuid": "c9a11c8a-b879-47a8-8af7-12591727778b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872526, "uuid": "1abdc313-ce1a-44fe-9d3e-09546a800cf4", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f132ff-d134-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764868242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868242, "uuid": "453fe21a-4839-4fb1-9e93-5911550cf2cf", "comment": "Malware payload (Mirai)", "value": "3d6f17dc8b6d15ebf7fe11179672a967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868242, "uuid": "50b925ba-c893-4117-b877-ebe08fbc64ec", "comment": "Malware payload (Mirai)", "value": "fbd3fb6d7d867a42d40a78d344e8a3aa15efe4fff7d79058fc2fc5d5336a14e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868242, "uuid": "3e351789-61f1-460a-880b-3f1c1ec12019", "comment": "Malware payload (Mirai)", "value": "48e2d45a7b725e0e971ba848dd480401b6d83ced", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764868242, "uuid": "8d014f0c-6b6f-42f7-9103-4c8dc565f96c", "comment": "Malware payload (Mirai)", "value": "253a7359e8647a3099949c765380799ece103bf1882901081ac04451acf1d3797e447ee55ea9a630f5247d242d3bc98c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868242, "uuid": "2e859b75-69ae-45f1-aa84-931d4f43415c", "value": "T16873022966FA7D9CD52D1CB064AC0B3A7F0750D6268909E96313458FFB2827E667B0F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868242, "uuid": "957f79ce-a8a7-42ed-9e64-6d77f7279b95", "value": "1536:HnMVNqkK377kYf8qaols/9jGtavTGK5D4k3icy3VSWuRdHJ7Uxb:HaK3MLQlWTGKpx3icyduR95UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764868242, "uuid": "c279a2e4-a0c2-451c-ac1f-10fdf8283221", "value": 73812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764868242, "uuid": "d1daee5c-8c41-48ff-be94-395e9b771d89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764868242, "uuid": "f66ca168-9774-46cb-8261-9b869950aa28", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb34f3a8-d0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764839736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839736, "uuid": "9128aa79-7a50-4c3f-b790-379f7c513649", "comment": "Malware payload (Mirai)", "value": "24fab7c2c5398aa5f96dfec7f2d4ec7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839736, "uuid": "21036b8f-2fd1-49d4-b911-929387b13237", "comment": "Malware payload (Mirai)", "value": "fc3af680dc02564f402fbe955155f786dc350715dcc596578735a91079f901d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839736, "uuid": "4ff3dee8-c9e8-453e-ae2b-61b88ba14482", "comment": "Malware payload (Mirai)", "value": "d94f639a0fa92184b2d0e8e7c774ce7819fa77bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764839736, "uuid": "99353d73-be71-48e4-b024-05a14d05b231", "comment": "Malware payload (Mirai)", "value": "08b2f8d69e0673bc0bf4f4a11565c8a78640cbf91f2d69991f16f1bc8daee07a91f16f2545d9cf467eaf942594a7dc24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839736, "uuid": "7b146cba-b74d-49ef-a7de-8d55b9515d4e", "value": "T1B9D37B73C8656F58C114C978B035CFB81B63A660809B2FBE59A7C2784483DDDF61A3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839736, "uuid": "57731ce5-341e-4dfd-bedf-c522cf0b8e8f", "value": "1536:rcfIlswHciaC+rVs553CkiXmcCDKG729uxEI/CS6AW4UmkF6xPwIQzt5c:rcfcHV5533iWc7GHEI/0AWXmkrII5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764839736, "uuid": "17c1f90b-ad44-49c9-b2a1-a2411b53d287", "value": 140896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764839736, "uuid": "89fc1534-b2b9-46a1-ac03-cf68e5848bd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764839736, "uuid": "77b4000c-e092-444c-8d88-ce671e683523", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e448d3-d109-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764850013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850013, "uuid": "d31f051b-b976-4f9e-b493-3f5373151b3c", "comment": "Malware payload (njrat)", "value": "414872105fc996d8faeef4468a64438f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850013, "uuid": "19f94974-ca4e-4af3-b042-f54e894617a2", "comment": "Malware payload (njrat)", "value": "fc9003092baa0c5121ef92753ac46c2372620f423fa700896b52ae1413ebe75d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850013, "uuid": "5abf836c-e86b-466a-9026-1a178f57f1e9", "comment": "Malware payload (njrat)", "value": "9036f57fc420bf882f4c7d02f7bc7ef7add1d497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764850013, "uuid": "71783bfa-058c-4728-8b38-621b66abfb06", "comment": "Malware payload (njrat)", "value": "917751390516a5fd4862bd1ca0ce0de678389d6c12429cbfdfc50a8e5870bfa96db19daedff1c3167a25509c4c702039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-KronoRDP", "colour": "#B834F9", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850013, "uuid": "559f362c-3b8d-4fbe-a34d-9925e60b63a7", "value": "T14625C09173F8850BE1FF1B79E4B249094BB7B5069A36DB4F09C890AD1EB37418E117A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850013, "uuid": "fe64f119-1b07-4085-ae14-c51004744859", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850013, "uuid": "af9cecdb-8d6a-44c2-8357-7d8cf69ef6ec", "value": "24576:sF/p7xJzck+uGW/yFoBkkAQB3Wpi5P3M:sF/p7TYjqqanTZ75P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764850013, "uuid": "b6cdeb52-09d4-44f5-986f-8e79f774f5f8", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764850013, "uuid": "20e61112-08fe-440e-864b-ae328c8ffe41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764850013, "uuid": "e266e222-04ad-4d23-8b98-4eeae12c0f4d", "value": "System.Service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b949f90a-d0f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764840565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764840565, "uuid": "2f599df2-3e8d-485a-884f-d6d060614791", "comment": "Malware payload", "value": "c645131b8a0bbff30293ec5c9d31b180", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764840565, "uuid": "0447ea57-6b08-4953-b658-d183dd3ba9de", "comment": "Malware payload", "value": "fcb15ff4b26c9429998793d42ca6f33e2ee23d1a7afe64377d2f8de10f400536", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764840565, "uuid": "6b36f1a5-fb57-408a-a0fb-a72dd6c82ca9", "comment": "Malware payload", "value": "b6fc9eebea40eb54485de7292254bcf22146c20a", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764840565, "uuid": "6af1fdbf-c07a-4e7a-8ea0-2fde3242bd52", "comment": "Malware payload", "value": "297a42496af817b9e378ffa0ea256f8967894b4ffe919d6d039cc3378cfbc2a109c082ef69ec76d9584ce8c4fd73e341", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764840565, "uuid": "3458c9df-7257-45c9-95da-08e0088bbac4", "value": "T1F618334CA5EB0E77FE19FAB6111A889C88B44F1ED323A457C7753AE5CD7A812245CF80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764840565, "uuid": "ac6f55de-4349-4991-96ec-54cfa2668f7f", "value": "1572864:pqcu4oNxodUhG3I4Khy7s6bcQol06Tb17Zbqywy1/9BEJ11eMe7Vcfj4eTNCYa:pqTzoZ3qhyN6O6Trbqyd/rAmDcf0eTUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764840565, "uuid": "7d0d3d9b-b602-4798-b231-d18cb1803d0c", "value": 86114304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764840565, "uuid": "77ac6715-ca21-4492-ada9-5a7a8288ebe1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764840565, "uuid": "2519edf5-a852-4250-8ffb-2e72b8f5aa36", "value": "GameSetupV5.2.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f039cc3-d14a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764877860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877860, "uuid": "ff79099e-1583-4cc8-872d-f22ca0aedb56", "comment": "Malware payload (Mirai)", "value": "885c53dbf53900d0f2ea15d126d23b93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877860, "uuid": "e6298504-2437-4790-a407-b603e3d419f8", "comment": "Malware payload (Mirai)", "value": "fcf6e9fb58f448648c31bd57755c077fc7498989097ec9eed35770bc1a42283c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877860, "uuid": "66079029-7548-48ef-934a-c6e4355d6b3d", "comment": "Malware payload (Mirai)", "value": "b8a3823b3b066e9a6b5ef432719d3309a37972ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764877860, "uuid": "33186aaf-7267-4cf0-9d5a-721c95b8ec13", "comment": "Malware payload (Mirai)", "value": "1be93048635be4cbbe18cc63db08269581b786458836eba9a2aedd720a2c6b90729c97b2da89733eda510e64d6110ee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764877860, "uuid": "2c16b51b-30fb-4d23-8250-793b387e0d7b", "value": "T1FB23F986FC91CE57C5D43776F79E125C331253F8C2CA7302CE145A247ACA69D0A6BD92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764877860, "uuid": "65c63dc5-7d17-4b5c-a0d3-ca482fd42c0b", "value": "768:HRqqIrf4EcEUpqgnRqQmPSWcGa69TGvkiaeUxmk6eUcdZphekwLCuk5/QVi5cU8n:HIqfBhqCRqQmKWz4RaMXkdZphBwlfoT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764877860, "uuid": "f5b5c445-5634-4c40-88c7-ec3d0c8f0b7c", "value": 46496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764877860, "uuid": "e4c4e51d-7e43-41d7-bb9a-55bc1a1dabde", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764877860, "uuid": "c4711006-436d-4ded-a5f9-4ce4e0751731", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa1be13-d161-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764887901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887901, "uuid": "97e5e7ab-8e31-4ebf-9944-1832982512cf", "comment": "Malware payload (Mirai)", "value": "e132d1c87da2ac1f96738748703d6a13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887901, "uuid": "ee19d990-4813-45be-9ff1-9fbd9e14e926", "comment": "Malware payload (Mirai)", "value": "fd6556974a56cf76b2cb4b898109e62f3a35bb4f6b92b4bca3e5808d4b36a095", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887901, "uuid": "56c9d1c2-34d5-4713-b194-e1f346b85a95", "comment": "Malware payload (Mirai)", "value": "f0b6bdb895918e5b27eef96f4c77f11351875028", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764887901, "uuid": "7e56d02d-5d08-4ab4-8c02-ba79db617334", "comment": "Malware payload (Mirai)", "value": "a4cdaa817e7ab9160a661dfd16772f07eac6cf50c967e13c33a859db64d27b690f9c075b610c41dd1c4110af18fffc32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887901, "uuid": "d9c990ba-6e5e-4eca-87c2-11dff8eb118a", "value": "T1F3A32B54F793E0F5F29304F18217A36A6A709E159115FBE8EF0AB779FCB2711890A21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887901, "uuid": "b6738051-2ee0-41fc-8f37-1f3ab5bbe928", "value": "1536:+fSNnK+HNpBkdEQY1k/mHg7gsZhet0MZabXik+LSv9DorXoCdvS:CStDelY1k/eg8sU0Yabn+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764887901, "uuid": "bfd2df00-738d-48fd-bebb-47b0dfe89ea2", "value": 103832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764887901, "uuid": "5c908382-a722-45ce-a68d-ff2084d2fa02", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764887901, "uuid": "47853a0c-f4d0-429b-a6f9-0fdcb43a3855", "value": "frost.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9ab9b9-d123-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764860973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764860973, "uuid": "ff196abd-ba96-4d9a-b75f-c1a820d3af9e", "comment": "Malware payload (ValleyRAT)", "value": "d5a17a71185ebbe10787f40be813171d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764860973, "uuid": "17fd4af8-1882-4d9b-bf39-0f07123555dc", "comment": "Malware payload (ValleyRAT)", "value": "fde101333a3b602551c815e5d5c82224885eac27d1b6fd6849747ec08cd9d9c3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764860973, "uuid": "d937e1ad-180d-471f-b664-c50f06343392", "comment": "Malware payload (ValleyRAT)", "value": "c17a8328542715623be1e24420fcabebfff919ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764860973, "uuid": "78e1b838-0768-46da-af93-56c38f5928d5", "comment": "Malware payload (ValleyRAT)", "value": "f8d410241faa310a897f2f98ad2065342c947b5098d0e2c44da4868a174abf0f12a6c68951ffe49cdab456548eaf8d99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764860973, "uuid": "bdaeda0c-ef0c-4318-842c-590de24c616b", "value": "T1AEC5BF0BFF8781A1D9DF417C11F75B7F4E3949188724D9E3ABA118AA9C316C0523E39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764860973, "uuid": "b038c53f-d8ec-46c4-9cb4-5f23b233e7c5", "value": "063f35f0d08cafa97cac7521df1be0a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764860973, "uuid": "24a56130-a0f5-4ff1-a0c0-2aea985e4ec6", "value": "49152:khiOHcHyhYNs6+kHkUGONrxM8yhOP0jPEKlzGsqnfeOaeFAWoZBDKNYr:khitaSTEQGUcQKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764860973, "uuid": "753e5d57-b941-4c5a-a81d-eb8d39cc81d3", "value": 2727424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764860973, "uuid": "3d2e210c-7105-4638-93b0-ad5ba61b1ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764860973, "uuid": "ed1ba362-3db2-4c44-b123-ad4e4567de22", "value": "libsh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2618ff-d0e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764834370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834370, "uuid": "6e71e918-a166-47eb-adf4-24f221d227ce", "comment": "Malware payload", "value": "62af09825a8b4bcb57434dd0bfae0dd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834370, "uuid": "20cba666-ea85-4b39-b6e4-82445cc80b11", "comment": "Malware payload", "value": "fe12266ba19573b9696736023cc719b7d297e5534a56006cc6631a4295876065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834370, "uuid": "b7dfef63-fa72-45e9-96ff-a18e758759e6", "comment": "Malware payload", "value": "ccefa074a929ae4f892d23f297152811b7b65561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764834370, "uuid": "784aacb7-4942-44ae-8a61-782a686287cb", "comment": "Malware payload", "value": "57f854a6aacfb909c6926cf694f9583f842946281be49a68c0f181527153d7eb193bdc124345285e9a9839638745867f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834370, "uuid": "5c034e3e-93e9-488e-8c7d-3bfeffdc2e5d", "value": "T169272221F241D03BD5632A758C5BC5DA5535BB611F29A8873AEC2F0C6F78BC17E262C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834370, "uuid": "5a53f429-b260-48b8-862e-1c31ec92e05b", "value": "9536dfce195f94fad99f3590b71bda91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834370, "uuid": "e0499ac2-6cc3-4884-b7cc-51faf8b6db8c", "value": "393216:nZO3ePGQRV20zIzCAw9AaxWyxCejBhO+JP3NV2:9F0CAw9vxWy/jnV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764834370, "uuid": "1f8aeee2-2ebd-4fbf-af46-9024398c8c78", "value": 21961340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764834370, "uuid": "2a058d38-b19c-449b-987d-963ae897398f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764834370, "uuid": "d8ac4d89-cbdc-4f1a-adfc-184cd9725b1b", "value": "\u8840\u96e8[\u56fa\u5b9a].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0642ddd3-d13f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764872906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872906, "uuid": "939ce023-e2c4-4314-8adc-9acc0d66fa5c", "comment": "Malware payload (Mirai)", "value": "459961a690c7f46f6a87c06a9bc2b01c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872906, "uuid": "2e7ca4af-5b7d-4b5c-9faf-405d21c5d4a4", "comment": "Malware payload (Mirai)", "value": "fe3db3cda5a71d7ec12a8cbb7bcc6aa085f92316d56fa4ecd794e7d7e8da9261", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872906, "uuid": "9a88a09f-465f-4f1a-bd1f-29862542131b", "comment": "Malware payload (Mirai)", "value": "18b0cd2895edb7140cd3495a017eccae85df0c17", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764872906, "uuid": "5762511e-2f3b-4b0c-baa8-14ea2ccf7fbf", "comment": "Malware payload (Mirai)", "value": "4fc680d9eaee4295478c65a97efbc3c35e9da6c3d706875ad4d2d858c7d28c752c392e1243eba84d1b2e05e411c2dbf5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872906, "uuid": "e89bf49d-ba33-4c48-a8d1-c73d2fb51bb0", "value": "T197215BFA02A2EA42045C0F843099442CB5D9BFF4F0B48E9DD9CE54B578F5A197389F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872906, "uuid": "1cdefdc4-011a-47c0-bb41-d92363b65cae", "value": "24:1mLVH1VpNIBbVVbK4VA3VdRVHQPrVtNdlNwaVCs6oflVaRilEVlstLGgVlNtoMHR:1mLVH1VibVVbtVA3VdRVHQzVLdT3VCs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764872906, "uuid": "91f819b5-abb8-426c-b075-102db1e9d76c", "value": 1174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764872906, "uuid": "1e4a401e-7e83-4ae0-b283-da7eced4e956", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764872906, "uuid": "ec3994f6-fedf-48eb-9403-944a8a7af42e", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b564486-d133-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764867975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867975, "uuid": "8741161f-2abd-4b8e-9a5a-28cd0f76f9ac", "comment": "Malware payload (Mirai)", "value": "6bb197ebedaf062209bc6b0a3d89d249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867975, "uuid": "499472f1-07ef-4b71-99cc-713c51f46ee1", "comment": "Malware payload (Mirai)", "value": "fea4021d674134be9550d0b0a2c3ada45506a6d255f81c40426571d3f812c9d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867975, "uuid": "f03edfe4-659f-43b0-8011-3bbf1e766639", "comment": "Malware payload (Mirai)", "value": "2e1c6dc43f411c6e04f19b903857f184f6c5903c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764867975, "uuid": "0d60ff45-f282-41a8-8a0e-7677fdca04d3", "comment": "Malware payload (Mirai)", "value": "8fb3a855e15aaaaa82c42543e2a9df4a5ba6f9e698c4d78fc7f41ebeeac859e1ccaaef42d07e26f907b286ce2d25195c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867975, "uuid": "1e4ce7db-8a38-4ff1-808b-7c5f9e6b9162", "value": "T13504BF73B34F2091C86202F80BCF6B5D262321125E5B9BE76C6E763E6B375D945063E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867975, "uuid": "8f76b7b3-e23c-4c90-a5bf-71d5eb32c622", "value": "3072:Vw10rDNCxspyIlw747UK8UBsKHSRdsAug7CqvJVwdJH2tq:V1MscmUWBsYmuAjCqvJVG2tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764867975, "uuid": "3ebfa8cc-c51d-44e3-9c14-1e2f3502e806", "value": 173696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764867975, "uuid": "0bce971f-170d-4393-af2e-17fd06ecb920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764867975, "uuid": "660cefde-e094-4e99-be53-d2a482281491", "value": "Polar.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31234c8-d0e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1764833280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833280, "uuid": "01685713-c8a6-4c5b-88ee-1f91f490c660", "comment": "Malware payload (Adware.Techsnab)", "value": "acdb960d392553414e74ca4c0c7a6a28", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833280, "uuid": "1da2db3c-699c-4b9b-bf15-8943df9fa66c", "comment": "Malware payload (Adware.Techsnab)", "value": "fec2ca2210d1f07ddec3372dd51562f26ad27a2723b8e88d40f5a864b487e624", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833280, "uuid": "5f0c5af5-04c0-4356-b44b-aa67f4739264", "comment": "Malware payload (Adware.Techsnab)", "value": "1f3497eee7e53622494c027c9ac0f8e75de26e58", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764833280, "uuid": "8a7287d8-8aa8-4691-a417-3b752ceb7248", "comment": "Malware payload (Adware.Techsnab)", "value": "fbd9289ac829a346b205bb9de169dfd46fc98877c0382533fb2d2d98809ef24a65d27f686b84a0f9c90b820f26aa36a1", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "seomorry-com", "colour": "#C1E37A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833280, "uuid": "83a45a59-7afa-4deb-949d-f418a9c490f0", "value": "T1F7120A2B36568DD193D3276FCAFFE049B876166325457D94B0ACC15ABF20930C3E8A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833280, "uuid": "1c21ac37-b2fb-42df-bc96-5fdd4aa2b586", "value": "192:9qnCSAEYcvf1vXIiCz7zv9hJiJKuuFrCPmriiq/xN0c4X6je7H9y15WOfsUjhx:9I1O3NkmNOac4qjuy15nsUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764833280, "uuid": "6b12c045-16c5-471a-9e7b-1d4e53f7d547", "value": 9676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764833280, "uuid": "83176316-9bc8-4684-baa8-afb68fc587ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764833280, "uuid": "7c97172a-2530-4287-8a6c-92f113afc868", "value": "boityq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cc8da8-d0d8-11f0-a129-42010a9c0007", "comment": "Malware payload (HeliBot)", "timestamp": 1764829043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829043, "uuid": "1d62f225-f171-4879-b988-6501b48dde7b", "comment": "Malware payload (HeliBot)", "value": "d9324ed643f1b59bd03173f6246f90f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829043, "uuid": "bb59165b-3129-4c44-900e-55c41c9c1997", "comment": "Malware payload (HeliBot)", "value": "ff23c876a53c366630b5acbf2d2b1d9afc4910c77528fd46b3c65baa346cf2a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829043, "uuid": "71992b59-390c-4679-9f37-af013976c32f", "comment": "Malware payload (HeliBot)", "value": "4ba184e33d64d3d7bcf1d0bb44d84a96e8d5dd36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764829043, "uuid": "abf7fef6-2b40-4150-9947-191a8d62dfce", "comment": "Malware payload (HeliBot)", "value": "b6f323e56698c9e6dd375130451e679d6c4d9bc874ffd93ff494e976ec7266f960a10da2bcefe7b29ca7812e6849cc53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HeliBot", "colour": "#0B7454", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829043, "uuid": "7c31e22e-7608-4626-98a7-9062f61bddef", "value": "T1F9830A41FD418B57C2C327BAFB9F435D37356A5497D733026A386EB42BC67982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829043, "uuid": "1cdbf817-f300-4dda-aaad-827ac03bd83a", "value": "1536:GDN+IBSIzNENYx5OklUrpB3ndi4Oj+cmZhBQ4Kb3RXFFj:KBXoY5U73M4OjNmZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764829043, "uuid": "1751b306-0505-4325-a00e-e768b7120166", "value": 85241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764829043, "uuid": "5caa5989-ce75-49f4-aeb1-625f2c948f60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764829043, "uuid": "2c929011-cd23-4676-99a1-8eb5c86005d2", "value": "bootingworld.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86998e3c-d0dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764831031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831031, "uuid": "5ce2a37a-0195-4cde-92a5-731f4d74a135", "comment": "Malware payload (Mirai)", "value": "1e46d2d75e27be039319c78e06668c5c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831031, "uuid": "e2f51bdf-80dd-4f5b-9f2a-9f663409139a", "comment": "Malware payload (Mirai)", "value": "ff64027d0e9fd4679826652bf21d0aba332a5c0683f2baa404e92f966cecd55f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831031, "uuid": "027e53d7-f5e7-4297-983b-d308658e055f", "comment": "Malware payload (Mirai)", "value": "792abf1c44fe3bfc62a54f2890a85f2f03f37377", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764831031, "uuid": "e6ea4f69-1092-4f43-a086-cd307f324822", "comment": "Malware payload (Mirai)", "value": "7268b08b4a7e917939763ae05d9c0013765230b8db566fea1a5557392197f6de3f11ab6d8fbf2e98ccdbb3dee80e60d6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831031, "uuid": "4182ada5-6142-489e-96c8-0bd7418c45ee", "value": "T15D2138CA2813DB06241C8B80305E843DE19A9EE020EEBE5EEDCD5CB1BDC491871A5F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831031, "uuid": "003c9bcd-8097-4a74-8288-94e8cce89891", "value": "24:1RuLVRHVRBNI5VRXKWVRwVRBzZqqVRvQVRq0VRZlVRYVRxgVRFHR:18LVVVAVtxVSVtFVlQV5V3lVeVMVXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764831031, "uuid": "1f2f78bc-875f-47be-a053-859f65eba801", "value": 1150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764831031, "uuid": "72c0f4c4-74c7-4704-897b-aaa91dc8356f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764831031, "uuid": "06d329f0-11e7-4621-b6bb-c0947ae793f0", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0fb2f0-d162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764888267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888267, "uuid": "e070130d-d842-48f4-8684-1dce1b04fd2e", "comment": "Malware payload", "value": "f1799ecfc1b4addfbb9d31d1c89ad4b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888267, "uuid": "c484b1fd-83dd-4c72-b06d-478ca4258061", "comment": "Malware payload", "value": "ffcaf18b1e39d22a7c293eea35e6cbc152bc08c8c096c14c187fb94b3fcff973", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888267, "uuid": "ade105b2-a9e0-4c53-9c4e-f0452b119159", "comment": "Malware payload", "value": "7693609512e514685091ee5c076a76cf04483321", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764888267, "uuid": "b4738922-206d-4ed7-941d-97ac98b29a61", "comment": "Malware payload", "value": "8f8c6b791261de8ddb8404431774a3e985bc89afefb081168ccb6f4dac4f4f1d5c42c587abdac93feb606a59ade5b2d0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888267, "uuid": "2f5949cd-490f-447a-8b92-c309f8f2a7f5", "value": "T19211DA9E3460E940C1B8D7043CB6EB40A74BC2D159D4BF3A9AFBEA31809D7247D02F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888267, "uuid": "2b18e705-6d4d-44a8-bd98-2b7c1069a0bd", "value": "12:78ZB+UqIZc+UqIZ3+UqIZpD+UqIZXW/+UqIZ1+UqIZ7/+UqIZ7U+UqIZ7n+UmJj:ezjkjljphjujXj7tjwjJmJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764888267, "uuid": "dc270a78-52ad-4503-a905-21f3cc5471b0", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764888267, "uuid": "3f4bc696-98db-4f3e-acb0-3150ca2a7647", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764888267, "uuid": "eaeaf26e-e721-436c-9680-2c827342c5a2", "value": "dvr.tbk-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }