{ "Event": { "published": true, "date": "2025-12-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-22", "timestamp": 1766448182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8ddebeb9-5932-4d17-b4e2-be95e6bf27a3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049d5820-df68-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766429829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429829, "uuid": "18257ec2-0d92-48ad-99bf-7619de0b5ba9", "comment": "Malware payload (Gafgyt)", "value": "29a4d992ac2ed25be0b305dede032e9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429829, "uuid": "9311e0b3-f6a2-45cf-86d5-e74488fb728c", "comment": "Malware payload (Gafgyt)", "value": "003ed20df0a5074d4d7db6000fa73a3a12d6fa4e10712ff4910be8bfe45780e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429829, "uuid": "5b29d83d-2a9f-4485-90dd-d1832a2d85a9", "comment": "Malware payload (Gafgyt)", "value": "92c03cda6f23a804cbb2440979f610186545f39c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429829, "uuid": "5f77036e-a51e-4e08-9582-3f0e5d7ac850", "comment": "Malware payload (Gafgyt)", "value": "28e32b512d31f5736e7827df842e04896e93747a61ee8befa8d18200a156f4f6e90ab90195a81367b377813dcd5eaa5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429829, "uuid": "885538cc-b2fa-4c01-abb9-104f87e1ac56", "value": "T19C836E83EA63F8B1F861107A167A93A14A33F2352421ED4BE7A42F75ED55700EF0676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429829, "uuid": "d9a704c1-0db3-451b-9cab-9d2cfaf6cb62", "value": "1536:k/4Cm3VO75fh47eypRbgoXcF44rJ7NfEYCBs4ZhDfNc/PD3+Di6K/ZR:JwO0oM/7N6hfNCjIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766429829, "uuid": "a3a7771b-3399-4438-88d5-d7e586999b06", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766429829, "uuid": "d765b941-e01f-4332-a11b-cc2ae0d8dc0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429829, "uuid": "d254e1ae-14e8-45a0-bb23-c69bc6b7dfff", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d27e95-df55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421667, "uuid": "8f76bf74-e709-4f44-afe8-3e6cc8cb7d5e", "comment": "Malware payload", "value": "4b022bf148edeea3f7cc8cb33008d8c1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421667, "uuid": "ba00144c-098b-4e51-99b3-20f1d93e56da", "comment": "Malware payload", "value": "00b9891e563d57484eb3fb74b168b4b37e60bfb3bce93adbd0bb978844097eb2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421667, "uuid": "1d031a2d-dfe5-4fe6-a9b0-ed52bac023c6", "comment": "Malware payload", "value": "b1a99ecd4bffe5c8c449d5024d9aba8f919c2364", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421667, "uuid": "2ba4693f-5171-4e82-8da5-215ccd4c14b1", "comment": "Malware payload", "value": "084261fcff4a633c183f066d098ea01d0c1a3e376f358a4a275ac4b4976db7820ab423fa5b69033b5c41b58983e71d01", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421667, "uuid": "f58ffa1b-7591-4cf4-803a-1abfc3390e8c", "value": "T1D91151DF042CDF23918C5A6A7E91783660F807A5387B07BC7FE5489A188E540236CE63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421667, "uuid": "a4532d36-1ead-47a0-b4aa-d69c59beebde", "value": "24:6LM5f6BXAyGhciaDpFh+GUIKtprkhwiZxAhbL:BZ6BwELF0GUIewjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421667, "uuid": "c832101f-df00-4f17-9c8e-52ae3b1eceb5", "value": 998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421667, "uuid": "54b5305f-788d-4c54-ace6-b2d888f29813", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421667, "uuid": "234bd429-9425-42d8-96f4-478f033f17d5", "value": "wg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7d99bd-df54-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421657, "uuid": "5af32c38-524e-42ea-ac66-8d6fa8960d68", "comment": "Malware payload", "value": "f17b69fa5b2c1e3fa96ae5bf4b86f6b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421657, "uuid": "a4f5c6ee-9d59-4d25-b06a-a88acc2030ac", "comment": "Malware payload", "value": "00f24eec43a1cdd502029173150e1553de4a552a77a1e719fd0232948b888dc3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421657, "uuid": "d3716c16-2d24-468b-9524-e8621df8f6ab", "comment": "Malware payload", "value": "2f2fff71239a41ac4a2133215085e44e750520b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421657, "uuid": "ca2c45b6-1ed5-4d63-b78d-e6a137332400", "comment": "Malware payload", "value": "ae14860fab170e97dbb9f9c2f5e987f9741890c34309eb2841a8109f3e14a285ec313fe79f082d86683cb4af0f571fab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421657, "uuid": "9e63d6b0-ad0f-480a-adb7-4ff46957803a", "value": "T13D11845F01459D90C08CD43A37D2850DB4D44FCA187B0AA69EA600BE10F46CE7738E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421657, "uuid": "a40e2b26-1149-42a9-9ef4-356ee72a7dff", "value": "24:k7uSa7M5QSa7iSa7/Sa7V+Sa7PSa70Sa7bSa7XSa7kSa7beSh:knawHajaOaxa2axaaaGaZarh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421657, "uuid": "0d97d4aa-ed24-4358-b2e4-183fb7583538", "value": 1038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421657, "uuid": "6608223d-698b-4bce-9b1a-a53b6b8a1597", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421657, "uuid": "ba1c5d9b-80ad-4594-80f3-8905a25ae38f", "value": "pop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763322ae-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424866, "uuid": "df992b06-4e16-446f-948c-1c5429103863", "comment": "Malware payload (Mirai)", "value": "775db7d6e7072356a10a338fb248e108", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424866, "uuid": "2f89c604-8476-428f-8718-0374feaad60e", "comment": "Malware payload (Mirai)", "value": "01d47efb913c862f75871f9c4775ff4e5e2f8d9ff10de0da8bc6199ca44ed71a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424866, "uuid": "5bb0e3a1-5e58-4a25-b49a-1389f4f363f0", "comment": "Malware payload (Mirai)", "value": "2edeb4cb53b17bb870e72ce5bafa934eb2f6d789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424866, "uuid": "344c02f0-b296-4e6d-9b94-e4ea47b89eb3", "comment": "Malware payload (Mirai)", "value": "af26bf8528760fa5f06a55a5858dd6e164115fb03f6fb96a2298cafda7d51fe511b9a932bbae15dcdeb69c3f0192685a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424866, "uuid": "5bd79eff-fdfd-45ef-b5f7-305d878c6098", "value": "T18804C80AAF660FBBDCAFDD3706E9070135CCA50722A53B753674D528F54A90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424866, "uuid": "9c818a0f-f79c-4920-8b6e-52395b1a1ed4", "value": "3072:jy3lv7yOz7HQdFD8bPg/lzb6vsOd+AtJ:jy3tyOzAFDG+xeEK5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424866, "uuid": "6b4b6ddf-f9ca-4e88-892c-f1ea4fb36a31", "value": 173700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424866, "uuid": "c47e2c90-cc5b-4550-962b-5e1924511552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424866, "uuid": "2d96bc8e-5770-4b2e-aafe-6fb2b594bb6a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a2301d-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388874, "uuid": "1bbed8f9-ac7e-49f3-b825-b9a55314fbfd", "comment": "Malware payload (Mirai)", "value": "0d97d6323ef05e9ce8872bf4fe349e8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388874, "uuid": "7888853a-79e3-45aa-b3e4-16bcae8104bb", "comment": "Malware payload (Mirai)", "value": "01f6720310393103058edd5731e4d2e63cf09fc9cc43e8e7efe7dd5d84f51b59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388874, "uuid": "6081b066-54c4-48aa-9067-7a8fae08240c", "comment": "Malware payload (Mirai)", "value": "145102d16ee233871817d602370715a02ccdd9e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388874, "uuid": "c1e1f585-1587-4cd9-85fe-e6b3b2a4e63f", "comment": "Malware payload (Mirai)", "value": "e1e7865024f73670affda85eceee17ce4cc9f7fe1a654f8ac43faae6bcad8b687d3fd3ebdf52bcd12b7d02097d402e78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388874, "uuid": "cbda93ed-08b8-4e8f-90ca-d667e55984d1", "value": "T1B763951E7E259FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388874, "uuid": "e47abf60-d605-4e09-aa01-e8d88d7704e9", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatA8:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzXL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388874, "uuid": "d18f76cc-b340-45cc-8d1d-6a8a6c21577e", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388874, "uuid": "2263411a-8d8a-41d2-8ffb-cea6e00b6286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388874, "uuid": "a1485c01-cfd4-4950-b933-3b9c5747c16d", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8e6612-df76-11f0-a129-42010a9c0007", "comment": "Malware payload (DeerStealer)", "timestamp": 1766435855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435855, "uuid": "b18e8545-a8ce-4a0e-bc63-fcdbdb2f76f9", "comment": "Malware payload (DeerStealer)", "value": "0ac38358211f1a1ce9f21a27ed7e5dd8", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435855, "uuid": "dcc5f9b3-c462-41ae-9151-61f5599fa431", "comment": "Malware payload (DeerStealer)", "value": "02a9692c6ae6cb862657390e9d1adc6ea21ba810e73831ef3dc973b40f8d8966", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435855, "uuid": "6ffe5586-94b9-44f6-a526-33e6e899576b", "comment": "Malware payload (DeerStealer)", "value": "46300aec8676d55a95e0eb8197e7b32a218c7c43", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435855, "uuid": "642f0709-9e79-4bb1-ada4-d2b92bc7000f", "comment": "Malware payload (DeerStealer)", "value": "1dea5b6020a89ddf8d2889f414e54daf5c960ff1d8fa36b77cdb20ba854455b708e5f26522d5c3223d13db8505619532", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435855, "uuid": "5901ef8f-7a2c-4642-8ab3-b12d2ca5ad55", "value": "T19A36335C66187AE3C117B3320152B7B54869DE2C6B48DE6B2362740F7C7AA5053F3BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435855, "uuid": "0917d453-f7e6-497a-8617-3e0e42b6df9e", "value": "98304:jbrvzaKw6HApjjlJ49aBnRgHsGNBoK8anLhVyTZI3rf8Pg4Ag:Pr3gpjhJ49onRgHsDzmzylID8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435855, "uuid": "0f0c3a9f-2ec9-47c9-b044-5e05978962e9", "value": 5046272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435855, "uuid": "dad65202-a186-4f25-818b-88cb12f97ff0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435855, "uuid": "238375f1-634d-4ff4-8aba-809349f95acc", "value": "OIVPGEXM.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d583f1-df66-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766429192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429192, "uuid": "2d897f4c-6560-400c-9031-887c7dd3a336", "comment": "Malware payload (Mirai)", "value": "7e0c799b032e96ac74849b9799800601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429192, "uuid": "4e2a2bca-4aa1-4761-b087-83c54f409e03", "comment": "Malware payload (Mirai)", "value": "0322b3a225a6273524242d0a1c06f6e5ef2500979520ef795ab0c4c4588a661b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429192, "uuid": "734d8912-74bd-4b32-b8a7-a5def2bbcb3e", "comment": "Malware payload (Mirai)", "value": "5d488d440b2552e93530b5b704eedf5c983857d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429192, "uuid": "bb808e23-0768-497a-807e-94c38111df0e", "comment": "Malware payload (Mirai)", "value": "390b1e3a9ce1589135b31e570fb1fb5731770b1856469eb565a50c55967cf094ea00df829f2390df60f2cb173cfa8b18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429192, "uuid": "e8d298d2-6075-4e37-9740-2636ab204c1c", "value": "T1B7D3AEDB734B0911C46106F01BD79F8E3F6362168E4BC9E72D0DB67A287A5CB191A7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429192, "uuid": "eb5f34c0-3ec0-472e-a2c8-519294879beb", "value": "1536:DHSKo+wP2Ypcc35EUQu2LjzWIXSeDqrlU5YfxrEq2ipgrns/LW6:DQ+74/Q/nvSeDqrEYX2ipgrnsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766429192, "uuid": "42d5d842-74b6-4e7e-94c4-bf74e903228f", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766429192, "uuid": "c17e1f86-1805-4395-aaea-f3c4b4a627cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429192, "uuid": "15e3bc53-5185-4763-902e-ed213d9bd0d7", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64417ffd-df8c-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1766445451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445451, "uuid": "8e5dfb00-7f86-460a-9fcf-3ef963901ac8", "comment": "Malware payload (OffLoader)", "value": "f3253627375d8e590575a6eeffbdb3ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Yomal!rfn", "colour": "#08DB2C", "exportable": true, "hide_tag": false }, { "name": "Yomal", "colour": "#D3EA97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445451, "uuid": "644694d9-6b4c-4f74-a01d-3969dd593f3a", "comment": "Malware payload (OffLoader)", "value": "03ab56b665e2af67093e123e177dffde21404adc81dc07223fb2b51c724a8eaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Yomal!rfn", "colour": "#08DB2C", "exportable": true, "hide_tag": false }, { "name": "Yomal", "colour": "#D3EA97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445451, "uuid": "30c01a25-0036-4491-a2f9-0e00d5d0ab8c", "comment": "Malware payload (OffLoader)", "value": "8043c7a7c83858a8ba8a416d32d07135d0edc6f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Yomal!rfn", "colour": "#08DB2C", "exportable": true, "hide_tag": false }, { "name": "Yomal", "colour": "#D3EA97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445451, "uuid": "5d7fcfd9-b719-460f-ab7a-3eb9a278788d", "comment": "Malware payload (OffLoader)", "value": "f5050dbf2b29362b96cddcf4244ba29e2e5f35b24477bdb2022ad67ba03a671c5a2b7860a8499a72d2accfe4e5dfef01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Yomal!rfn", "colour": "#08DB2C", "exportable": true, "hide_tag": false }, { "name": "Yomal", "colour": "#D3EA97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445451, "uuid": "dab93b03-93a1-4a6a-a63f-081604fa645a", "value": "T13EF63327B28A233EE06E4B3B49B7D1600D3B7A51A55E8C46A7F04C8CCF691601D7E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445451, "uuid": "99a9b28f-e5df-4e23-a5cc-985237de219d", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445451, "uuid": "dfe23f1e-93c5-438b-b7f6-8bef07287b0a", "value": "196608:hmDAXXzXvgiKxE7hfOK6qtz1XhOe5guqeyASnJLd7heIcQSpwmlIBj35w+Bt5n+q:hmqUigeOKZN1XMjxLRhAQ3Xw+d+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766445451, "uuid": "90510643-e2a6-415c-b227-10405e552723", "value": 15562304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766445451, "uuid": "bce3af73-34c5-47ea-b9c9-ebc8bdaffbda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445451, "uuid": "d1b0bdcf-6304-4954-9f36-baeb538c16ae", "value": "Egzgxemc_2025.12.21_07.39.29_SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43808c9b-df67-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766429505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429505, "uuid": "000ddf33-ca5a-4822-8282-e40f4706e767", "comment": "Malware payload (Mirai)", "value": "a668872d37f788b38142fedd453bdf01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429505, "uuid": "aca4f76d-e89c-471e-8395-713f76367930", "comment": "Malware payload (Mirai)", "value": "03b1a77b1be92b3907d3e9f9eeb28daae6621bf273334f38511a002f1b0981f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429505, "uuid": "22a5ad3f-3faa-4c11-ba1d-6b44c327634b", "comment": "Malware payload (Mirai)", "value": "5c594dc2836abad2503347665c5a3a18a0384e91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429505, "uuid": "f5659c58-174f-442c-8305-b763201fee4a", "comment": "Malware payload (Mirai)", "value": "0fa44fc1aa015286b2e74b077a55f51c832ba21a716194c748761fa888baf7bd70d787a3e69e5edeab0d973880c17b87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429505, "uuid": "5f0c479b-b674-4d0f-b390-8419365f4f66", "value": "T129B34B53F804CD7FF88AC7724683CB35763273A18B731662B652A537B92D3A40D26E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429505, "uuid": "98cc01f8-532d-4847-9826-43e16834b946", "value": "3072:kzf/8wNbp6qdkkZwiMV434wHBRu7lFcRgWSr:kzf/wqd24owHBRyUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766429505, "uuid": "0d0e3b5a-390c-44d1-b973-eab45c20650f", "value": 110324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766429505, "uuid": "f348cf22-5504-40d2-bf4b-ac84eb292ac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429505, "uuid": "13a7d654-c230-4903-8025-a5b0d99a466c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d83b70c-dece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766363809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363809, "uuid": "ff6ec0b6-7985-4ea8-9b0f-f9083cd145e7", "comment": "Malware payload (Mirai)", "value": "77a86e40335c4d9c029f0dff70b82e23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363809, "uuid": "40ad608e-d63a-4da1-9db3-b6212448fc9d", "comment": "Malware payload (Mirai)", "value": "03def24efac35afcb5bff190716f80d32dd7847c4b0940c91e3cabae228d0861", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363809, "uuid": "a981f39d-f4dd-4c18-8370-35bc86f36388", "comment": "Malware payload (Mirai)", "value": "731feb10db30c91a87761d5866fb66b308d098c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363809, "uuid": "f5485adb-760b-471b-ac96-1f78c6351d02", "comment": "Malware payload (Mirai)", "value": "6034ceee2edb5a48322bb453d6218eb8a89383036eda59c2a405a03c339b8a7108fb25661e73f22005398a1fc1866991", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363809, "uuid": "98fbb878-51c3-4c38-9f68-c6c5bd1667b2", "value": "T141833C86A400CDBCF84EE67784574F10FA35B7119F520F27A665FDB3A9720988E1ADC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363809, "uuid": "8c694209-ea03-458f-9718-f5346629e333", "value": "1536:AsFU4rgdrwKD4E5m5hzDCmNFxrBY/8QjOEnBkXc2MqxKR3IginETPN:RFU4UwK8EO9dbxr6HOvXc9qxKR4VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766363809, "uuid": "8089d695-aef5-4b4c-aa92-53d54d4faa3f", "value": 83760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766363809, "uuid": "27960c42-4161-45a2-ba47-df9290fe7a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363809, "uuid": "da451f9a-273a-4e48-bbca-d949d4063827", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd0fecf-df0d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766391032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391032, "uuid": "c7c767bf-10c7-4cb9-a525-859e2ba0059b", "comment": "Malware payload", "value": "fd4b940c64ff839dee3d86404eb8cf70", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391032, "uuid": "48447c3f-5b41-4131-8a99-0332f5fa4302", "comment": "Malware payload", "value": "04acd327ce54821ad42c247a072a047b12c6a76b08adb80d0cfeb22595f3b0a8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391032, "uuid": "0aeac27a-4df0-4253-a01e-9f3d59263af7", "comment": "Malware payload", "value": "02bd2ca107a2cf5f2c8ef6b0d15bb98b465d595d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391032, "uuid": "5f2eb028-668f-414e-8aaf-c4c5c6a7fe7d", "comment": "Malware payload", "value": "10cfb473cf33085a137a7eba46ed6ac287aa07ce8377864bcd5814562da06bb228dae51eae088bb4a3cc2e6cfb523cbc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391032, "uuid": "d406dc4a-66b1-4801-aec5-054e525271bc", "value": "T1DD864B93FE50466AC5DFE33DE9A20285B3747844177121D76A5027660E3BBC42B3BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391032, "uuid": "7cc93210-97b4-4512-9e94-3c561492d38b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391032, "uuid": "d65ca620-a093-4f48-9665-fb06aaca2d87", "value": "49152:9AJbhSGI49gKLLgbs48vHH30fWaTKz60pmB7Ssx622DLDySxAXG1G8xS/I3dyo3g:9An9gGH36TKz6AmB7Ssx8xEyel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766391032, "uuid": "1f481129-7f37-44c2-ba57-7991addfd287", "value": 8124552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766391032, "uuid": "d846778f-5947-4ced-b20f-2c8e44ef7eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391032, "uuid": "0fdd37fb-b7b8-44a7-8e14-cac4bfed5665", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fe5b17-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387474, "uuid": "1d34c3c2-3103-4b7b-8781-7142aace9811", "comment": "Malware payload (Mirai)", "value": "602e5e94ec51caed5a5262f8bbb3a00b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387474, "uuid": "7ba3d4c6-ac16-48a2-a3e3-4c6c6243d3e8", "comment": "Malware payload (Mirai)", "value": "05fae73efc1356bc66de8543d49d2b8ad09b0aa8fa8446c27dfe25a5fbac8160", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387474, "uuid": "68c285ff-861f-469e-ac96-46398f4801c1", "comment": "Malware payload (Mirai)", "value": "65dd9697663fc4ab044f86aedb0b0f4b1fd05825", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387474, "uuid": "c07a1548-7911-4f6c-8dc9-6024fef313a8", "comment": "Malware payload (Mirai)", "value": "6d40b96b7fc1b98fec2d1fab9b1dd2b1fa447a2acdb72f9fbda2009b19364487627e8e450a4c3f75b8476590636095f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387474, "uuid": "47a0078b-5361-49ff-852a-96de34b7a485", "value": "T13E6302E7B06124A2F76A5DBF2C05DB12887311B9FC839F929453B18A71385573EFC942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387474, "uuid": "367697bb-5571-4055-a9c8-31059846c284", "value": "1536:vNxYC0GI1RrP+2FTbaHtdghilwQ3GJ7turt85e2K0/9qNp:/OG++2JONKhilJ3GJ8rC5eGVqNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387474, "uuid": "b5e0ae42-233b-4c68-bc91-e711400d972a", "value": 68976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387474, "uuid": "18da0d77-16e2-496b-bda1-de682ecbfb4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387474, "uuid": "79743ee1-2604-4e4a-b0e6-c9212f62c714", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbe5f70-df70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766433493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433493, "uuid": "a8c72404-062e-4b4c-b0e8-82c4048e0cfb", "comment": "Malware payload", "value": "7c5dccb5130c963b89574fa9eab58239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433493, "uuid": "b1e2de41-0910-4ad8-82df-c2c421c0cb28", "comment": "Malware payload", "value": "062a613d328b3d2c9de5d27a6eb14595b97324de5b78e2d5e40d907331b9a389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433493, "uuid": "21f60afe-362e-4eaa-8178-d371bf93dc3f", "comment": "Malware payload", "value": "16f0b2b414199342d4e353f9d9448f0cc5793675", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433493, "uuid": "aaf22109-62a0-4fd6-9d80-ae9b02ba1b7e", "comment": "Malware payload", "value": "7819394930a6e326e0d2557c6edb5b0bc8e613c3df968d8c0a798ddef9d0a68fdd79bb8db3798861cedc2b7aa7654efc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433493, "uuid": "84dbc577-1744-48c9-ac56-ec0bf5d1c15e", "value": "T116E3430EAD219F3FF228C33547F78A64B36532D723E3E24AD25CD5251E6438A582B764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433493, "uuid": "7b487a62-eb9a-4f88-b7c3-1edad1de333e", "value": "3072:VcOuPCo4SEIHGTjDxd0oTxql0GrLlAI8xQkteRvTIRfkVFy2dT:aOub4Sdm/Fd1tNtERYV2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766433493, "uuid": "2a219dac-b71c-46c7-98fc-4f994443a49f", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766433493, "uuid": "763a30c7-a1a9-4685-a6c4-6d97a3e21d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433493, "uuid": "349de461-b956-4b63-860b-91511c16c97c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e0769d-df24-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766400644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400644, "uuid": "85a24d0a-a70d-41eb-b5a4-276aa9a5f2fa", "comment": "Malware payload", "value": "41ae75b810b22510b14a2621f670d812", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400644, "uuid": "7f65e920-4823-45ab-b262-49277016db5d", "comment": "Malware payload", "value": "068476276613bd967303b1fb4177d013933f1ea2f16c5903ad6463a5a9ec48cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400644, "uuid": "648b530b-06d8-4e3e-9305-a407a92f22e1", "comment": "Malware payload", "value": "3925286122bfb2dc4fdda71a28f769a3796ee4f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400644, "uuid": "3aa6a23a-5d82-4381-8662-306f731a8b5f", "comment": "Malware payload", "value": "2a75ea86e4bb483ad66fe5351130e30459b82311fa09e5e419510fc6857a7617e14f6afa41bdf34ee67a1d501cb0a2a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400644, "uuid": "0bb544b5-5c21-4f9b-bfdb-d16441ec55af", "value": "T1C5C54B07FCA504A9C4AEA231CA669252BB71BC481F3123D73F54B7382F72BD0A979754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400644, "uuid": "c8c3fbef-ac0d-4241-b5d8-9a83a5490836", "value": "24576:1iOPQ2Wqb/V69wfNvMADJy1FS5ygHvrtcefL8llEd/cxgNX1ambgoh9YmgLCSt:82WG/V7pMADkYzuSOgBN3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766400644, "uuid": "cba2204d-3d92-46c9-9138-5c83b32a44d9", "value": 2646168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766400644, "uuid": "5cd16c8d-df32-49f6-94e4-36fe0c16edcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400644, "uuid": "745d5b66-3108-4be8-85eb-80688213c2b0", "value": "agent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e4186c-df8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446790, "uuid": "de6be907-0192-4c2e-8bc0-d08e20f9e313", "comment": "Malware payload (Mirai)", "value": "4f6f7bbd5deb119c9508d46ee4935d67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446790, "uuid": "f8beee70-f186-4ab2-a57f-289255fa1135", "comment": "Malware payload (Mirai)", "value": "068b149939824539fd6ede07625d175f76ebcda67d3816f1591fbc57e5e8e0d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446790, "uuid": "c9b9a975-f2e7-492d-8fe1-b32a79373ff9", "comment": "Malware payload (Mirai)", "value": "6b54a7625e8867896c62d6385600a71752eb3464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446790, "uuid": "17780be2-2b28-436c-97d9-903025978367", "comment": "Malware payload (Mirai)", "value": "cb62af2c3ee87391abeb171e30c0f03c3d4ddb6d9b87d1c62fadb3ed93c7405fd0e51caef861e442215388df152b0866", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446790, "uuid": "19bb1675-2819-4fb1-8faf-ad75ccf5b7af", "value": "T159A3188AFC819B15D6D522FEFA1E518D331347B8E3EF72029D115B14778A92B0E7B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446790, "uuid": "bdb6f976-32cd-40a5-828b-8ff111b498f4", "value": "1536:e9nlCdZwyxYiTZMEOmQI/ChQ6FepCsoD4QNpfcw3sM9o5EO3630Nlu1iBc0027+7:bohRPsoD4Cpfcw3sko5EO3+ah77+xWqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446790, "uuid": "cef69fa3-894b-4b1c-abc7-1a8ad1fd75e3", "value": 98288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446790, "uuid": "59641b04-9263-4de2-b911-e30b7dc15f55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446790, "uuid": "c2870dd4-b9db-4da0-982b-7c0a8d87bb34", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8d8c23-df54-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421518, "uuid": "759023ca-488a-46fd-9ee3-da35b0f8ee26", "comment": "Malware payload", "value": "aa3804744ef482e6c509a77511f98667", "object_relation": "md5", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421518, "uuid": "0f1247db-3df3-448c-84cb-2f26f902a56e", "comment": "Malware payload", "value": "06c74829d8eee3c47e17d01c41361d314f12277d899cc9dfa789fe767c03693e", "object_relation": "sha256", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421518, "uuid": "f5fbe26d-ade9-4443-b633-042e93dcaffc", "comment": "Malware payload", "value": "45dcb5465339573540dc540b6e7b824a42db6f35", "object_relation": "sha1", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421518, "uuid": "eb448ae6-fdc3-4b70-8290-b893f03a0807", "comment": "Malware payload", "value": "970083ff3854dfc1e7f0425f70f9cde5028a67d11d459b4ad76edd51a6995d08bc343029c7ced734eaf977599abb2a14", "object_relation": "sha3-384", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421518, "uuid": "c3704f4a-aaf8-496d-963b-ccdc5ba191e0", "value": "T1D4547D13B71C6494C52E607C4EABF3915532F90D6B11A3AABB60E0141EFF7A4B2179CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421518, "uuid": "eb13c400-628e-4ff3-a54d-148d821f3c90", "value": "3072:noFEPx0lEgljF63GiuqLpDbYPhYBMyl3jJ8VlBxulLpwL6A:noFEPqCgtF62WJ8Ph+l3jWVXuiWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421518, "uuid": "2144654d-13e2-45c1-9ea0-d52302fa2878", "value": 285488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421518, "uuid": "980dcf10-36a0-4d4b-9788-ae9334ba287b", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421518, "uuid": "e10c9fff-7f14-4f37-ace2-527033d95f42", "value": "runtimectl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5597555a-df5d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766425240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425240, "uuid": "37b1b015-3244-4aa3-9cb6-890d23c78dc7", "comment": "Malware payload (Mirai)", "value": "595fae656fcc7f91f0a5c03c35d58b0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425240, "uuid": "aaa3860e-a4c3-401b-8253-ac84d20b06b6", "comment": "Malware payload (Mirai)", "value": "078b891e0a010760d08de62ed942f9597993de63b78e4d9398f5920b2e159d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425240, "uuid": "c4ae7f4f-2ae2-4eac-a56f-4d6b1189f99d", "comment": "Malware payload (Mirai)", "value": "d2c8450ce681dc29f63c09ca3025c53cb7068210", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425240, "uuid": "2f80d50d-c5d2-4df0-a347-9ee8b3499478", "comment": "Malware payload (Mirai)", "value": "ba8f17f9adccd189c0e7c34e68bc6bf7054049e7e07495701c08b17d7680059b1df2cfadb2089683cc97d3cacd207790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766425240, "uuid": "e2898156-365c-4c0a-a8e0-dcc855ff7c13", "value": "T175C34B0A78D230FCC287D131566EDF61AA36749C42183DBB9387AE711D36EE12E16F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766425240, "uuid": "1e97de61-d1d9-45d3-bcb6-2ce86f4cb440", "value": "1536:vKYP3dUXwT5hfLBjeOuR0YgsQkdVT7u+OHey1/HjxHPYMbVSl6/HBxnc3oJKCc9f:CYlBLFeBdzdxuL+y1Pj9Rc+yE1yVSAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766425240, "uuid": "345ddbd4-c9b9-462a-8ebf-06bac363ba8e", "value": 127904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766425240, "uuid": "2001e553-2854-4a25-9622-6ab5637a4cdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766425240, "uuid": "ca9defb0-36f5-47e2-b496-7245554eff9d", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32058a04-df30-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766405853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405853, "uuid": "8698927f-37c1-40cb-bd40-0cb91b3bba1a", "comment": "Malware payload", "value": "7d9bc01fdb3d26e99195fb2c743292d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405853, "uuid": "08e0ad7f-1493-411c-a8bc-41b2d17d5f3b", "comment": "Malware payload", "value": "07b740bc561692f9cc10221571dfc5933c69f5786b648c2e1c53ad9bff4b4064", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405853, "uuid": "e29dbaac-84f2-42fa-9038-af2380291957", "comment": "Malware payload", "value": "ad0b4b0381f2f2d0fad62b10c5f04657844318f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405853, "uuid": "d9dc81d3-1d30-46bd-8c68-f7c77c1cc0da", "comment": "Malware payload", "value": "b7ed0041ec6e0450a8617afbb9ce6207270cd5175bb326dc20efaf8a7f6d4694032b44893c99d2bc24a59beb08012963", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405853, "uuid": "4f5c1f23-4737-4c28-9f66-45a3867bf2ac", "value": "T1AF93D60BAB10EDB7D85BCD3309A9874224CEA41771547B393634DA1CBB9754E8EE38E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405853, "uuid": "6c1af496-d2a0-44ab-b970-0674cdd31245", "value": "1536:Y/nuu2y8VnKb3FLdfQTF5ChJkYgDgN1GN7E9GsPg4+MDeKxg+u:0uu2yanm3FnhJkhRmtDeKNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766405853, "uuid": "79476e60-ed5d-4e7c-b289-0dccb3d85863", "value": 94275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766405853, "uuid": "d836b62a-ab17-404d-a1e2-ee14b0424653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405853, "uuid": "5f570b2a-f12c-42b3-9c57-b5b83ca6c7f3", "value": "n3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559002bc-df46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766415362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415362, "uuid": "5b0177c3-d6ac-44e8-85a1-e6316a1328fe", "comment": "Malware payload (Mirai)", "value": "e642d097dfff496d2a0aa1736b26f8b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415362, "uuid": "cdb31f6e-25df-49fe-a6b3-239112b921bf", "comment": "Malware payload (Mirai)", "value": "07f235bd2f413e3717c177ee8c55b159d98499d42005f9136ddfd6085f93e796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415362, "uuid": "31d0a64b-4e22-4603-84d5-3576aab060ec", "comment": "Malware payload (Mirai)", "value": "eee048f14efd3317a343d8a7940e0fdfb90d43ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415362, "uuid": "a0020fbe-9ae4-402f-b277-8c10791e7159", "comment": "Malware payload (Mirai)", "value": "3e6e53e6f9b3c3f5dd839691be0cc162ccd56785ca540799205d1718135829ea2e7fed63ec1cae3c209e5afaf02a2611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415362, "uuid": "d5503ee2-71ad-4415-ac14-800dc75a16b9", "value": "T1D7B3AE35D1A95F84D0ACD9B164F4AFBA4B33E400418A2EBE2AFAC66D1043DD8F54B375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415362, "uuid": "da2ba63b-e0ee-4fb0-8d23-602040aa5c3f", "value": "3072:cUQN1p5bqW7PVBpA9ztGuxvCPpPIXhMX:P61ptTPe9zL8df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766415362, "uuid": "1480c1d7-f7b1-4dbd-820f-22cef8a39f39", "value": 117392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766415362, "uuid": "9bf89189-27f1-46bb-aad9-c7f7fe722411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415362, "uuid": "c48e1607-e4a9-48cf-a2e3-1ea56dc2d436", "value": "rondo.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427818b6-df59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766423490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423490, "uuid": "0bf6ddd3-dae6-4166-9ad4-d3a5ac8e1064", "comment": "Malware payload", "value": "75cab5539c1f09ccabe48abd035bb09a", "object_relation": "md5", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423490, "uuid": "797dc8e6-b923-4585-a672-5a6584dee5ed", "comment": "Malware payload", "value": "082b14ced3ab54ac7b32bb453eba660e5a92db6ddcc979127610f24f1ff7809d", "object_relation": "sha256", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423490, "uuid": "b27031ca-bd24-49a4-bcd9-c243ca8b50a7", "comment": "Malware payload", "value": "c99d0953beba5026a33f0d9e9016fe32bfde3a6d", "object_relation": "sha1", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423490, "uuid": "95fe9e15-1904-4dc3-aed8-b5e27689251f", "comment": "Malware payload", "value": "31f89a513692bd294ac4e0f91b6f1e493ca5e460042b70f77c7befe2be7e358e7da6cb20285b214a544afe7f030625ff", "object_relation": "sha3-384", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423490, "uuid": "2399ac78-abbf-4e02-bd43-d9a1092e1ec5", "value": "T177C02BE00E1AC3022042732300B69188B09000CF0076E0EB23098AFF72A1040480D86C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423490, "uuid": "02c06e06-f395-4ee7-b2fd-dc3d696ce02f", "value": "3:lP/ErUnbQ6oEAKdRqTIJ18P53yXPxoV7W6WFL5vhc7yn:lP/ErUEZEAOoU2pya4Jc7yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423490, "uuid": "57b763bf-f930-4d40-b76b-c19b6d6f9ccb", "value": 137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423490, "uuid": "a59ac0dc-1337-4c92-85ae-d79ecc693feb", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423490, "uuid": "fb40618a-687a-468a-88d1-4749a32a0dd0", "value": "Scan67409427743.wsh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d28afe6-df20-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766399161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399161, "uuid": "dcb2af23-0448-4d47-a884-d5f4f4832afc", "comment": "Malware payload", "value": "b0b49ffbf351584ece5b7387c61c3cb7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399161, "uuid": "bfd2ef8d-0732-428f-86ea-47d426bb14c2", "comment": "Malware payload", "value": "08441dd93ffb203275fd7369e9fc42ae75e93e8d97494e471466a30a9d209a7d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399161, "uuid": "2c1f894a-644a-4575-8030-6edf512e3aff", "comment": "Malware payload", "value": "5d84cd9112e3bd4197f6ebe7a83b2f5cd1580860", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399161, "uuid": "7beeec08-ae23-4290-8b6c-2e999684417e", "comment": "Malware payload", "value": "c967190ccfde0380d17be6a78d28c1468e405ca1e0e76dcf44126bc85d7a02a661b25ed55ab0f277d6aee2be1e7ecfd0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399161, "uuid": "70bd8472-9b14-4954-998d-ccc62c447ad7", "value": "T171747C1677E525F8E177C639C8624A02EB727C225760DBAF0760458A5F237D0EE3DB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399161, "uuid": "0109f8d4-87d9-4c0a-afb9-6e2123240ab6", "value": "0da62d5f519ce5d13fc7eaa002978cb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399161, "uuid": "beeb1853-15dc-4200-9322-64e65d4ebb5a", "value": "6144:VJRj793i4Jm2LfxmqtFseUvzYb/MC3agajVoLhDibB:Bpu2LsqEr8jMCQoLyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766399161, "uuid": "7ae5433d-b5ca-4338-8744-afeac4bef30f", "value": 354928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766399161, "uuid": "670dc528-5c8a-4229-93a3-b19ea6ec6518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399161, "uuid": "8016c30d-ac0a-4ee7-a8e4-0f3da3b1f766", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045a8469-df76-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766435842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435842, "uuid": "fdcaccd4-c337-4e55-aeaa-2a84e9d021df", "comment": "Malware payload", "value": "c4e4b71ff06a91c05a0f600d1da51c91", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435842, "uuid": "933fb6b0-ef20-4493-89d6-0af5450ed42e", "comment": "Malware payload", "value": "0896b4c8623a8c517db214f1a853cd5ea410d29ec43a5f09d451531efa3c485a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435842, "uuid": "56a8b157-5c2f-46d0-b11b-06c87071135b", "comment": "Malware payload", "value": "9739195dccbf57fb69c70c7a4818e01d0f5ca435", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435842, "uuid": "b481d9a1-4a18-4914-bdd8-2e3220ba0875", "comment": "Malware payload", "value": "bc1c9529164f6aaf8818860834e8252d268e25250cb70f252b005249f5315a5563ec955c906bc3f0cfc264193cd94220", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435842, "uuid": "c266d08e-34e8-4fce-bb96-1cfe6cfd341b", "value": "T132D6334C69F106FEFAB3417CDED02150D6A878A247A5CBBF87F49651AE130D18E3A706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435842, "uuid": "315e8e76-ca09-4818-bf5b-8b813a8af606", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435842, "uuid": "a38828c3-9420-4e91-b680-1d32152be722", "value": "393216:wE8sXUpDNDhOeiL+z9SEXMCHWUjpcuI3/PjuUw:wFsXUpDyYcEXMb8eH/rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435842, "uuid": "52710403-a34b-423e-bd3c-ab407e2858b3", "value": 12614971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435842, "uuid": "e444428d-7ae8-4be3-8eaf-11d4589a340a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435842, "uuid": "1252c608-49e0-45fc-bf1f-48fe4f765745", "value": "zinfoz.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f649730e-df0c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766390721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390721, "uuid": "de8e64c2-7254-421a-bc08-d73d654f7e31", "comment": "Malware payload", "value": "58bd46f23fec7ba76f83a954d25d916a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390721, "uuid": "124b89c0-76a6-423e-927e-dc195698cfa8", "comment": "Malware payload", "value": "091868a217955a41e0ff5f72b3af5afe38277ce2de1a3a42117051f94ea46787", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390721, "uuid": "72ebcef2-fbdc-4ddc-adcd-9c8c14d156f9", "comment": "Malware payload", "value": "4998f512b63aeaf81ce37088fbfc8ee33cde9a27", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390721, "uuid": "08d69b0d-45e7-4899-9835-af659ac5edfc", "comment": "Malware payload", "value": "b5b0df80f2c7e8707fab897c21e716b0082fcc651b402ad683af94bed2079c374a8cc86e98ecbc074cb373480ffa4f2b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390721, "uuid": "e066d253-48d4-4c05-b23c-435e5555be51", "value": "T1FDC19E81A771AFAB91991E721987A20BB45CF213DC50FB2D7806F46707721B1C950775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390721, "uuid": "ee1d07d7-21d0-454d-a249-a1835777654d", "value": "96:ZS5C8mavo0p6ytD+x5msne4sDl7pGoEwYkwke6f5GbnHz6tAp9d46fw+DRN8UNMk:/8mavo00dNapWBkwprTdd4W5DkUNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766390721, "uuid": "b68883e4-e675-40eb-bfcc-41379867e76b", "value": 5600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766390721, "uuid": "21c9104e-fcbc-4989-9023-0b0990d97bae", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390721, "uuid": "77f91f78-28ea-43db-90a6-00eff401d977", "value": "5_18_5_1980_22.12.2025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e531247-df75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766435509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435509, "uuid": "2a898e6d-06ff-4a13-8353-e2c542ec22f3", "comment": "Malware payload (Mirai)", "value": "d928c872cbb0b78cd46b53b453e2af0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435509, "uuid": "f65f2874-58b4-4353-8a14-d6e74cd111b6", "comment": "Malware payload (Mirai)", "value": "093c2c02d6d83d671ab434c95465e6d765239f344813812ae5513f7f4d0dabd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435509, "uuid": "f588074e-ae91-48d0-bc88-5fa70563ce0b", "comment": "Malware payload (Mirai)", "value": "a73bb4930e3ba853d759e71ce3aed4e51fc5d02c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435509, "uuid": "d1e12532-ddb7-4401-b1b3-3ae404b915ae", "comment": "Malware payload (Mirai)", "value": "d36fd3e38defb60c70a3ba68d0a86ac78774d5bff45b652c20517aa0783f7f26106c6fec1b8f3039ec294d02c9c59567", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435509, "uuid": "75deb723-d955-4633-861f-3854797fdafe", "value": "T13EA36C46EA43F4B0D84A0479124BA3798D35AE322421DD5FF7E47B72ECB1B11D91A32E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435509, "uuid": "feb66c85-df7a-46d5-a98f-99221e8ea940", "value": "1536:/4wTR2b5viwVnkDTKNbueDSDqShvqFHyUYYoxCPy+1Ug31U+uoIAj4gwEYiISVqr:pdOkaNueuqOvwHyUYYoxCqkCiIW1HS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435509, "uuid": "312f63d3-c83d-4cb0-bfd5-423c83f8e863", "value": 106084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435509, "uuid": "7bb4b037-68ac-458b-aaee-65421746948e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435509, "uuid": "bc0e2e30-7225-4c95-9dea-322748ce767c", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0bc62a-df02-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766386065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386065, "uuid": "3f153929-eec4-4d7e-be59-780bfa3574be", "comment": "Malware payload", "value": "c8650ccea22f81d40b5faa9659215989", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386065, "uuid": "e0f4f8c3-37d0-4f42-a05b-c322c2910732", "comment": "Malware payload", "value": "09c0b01267effde638740f756034cdfb1c086baf3e53f563d3bbd5a11918d547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386065, "uuid": "347a76db-b54a-4ec8-acd2-1981be0f7767", "comment": "Malware payload", "value": "95373de0da3f7c4c47a7d27baa95ed96abc62c9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386065, "uuid": "7013507a-1e05-4496-89bc-3d149eb56852", "comment": "Malware payload", "value": "57a1d40dbdcbc8442ad6f743f295b98a70c6354c5867978f45d6caa52047ce83d6789447334ee10363dda2e62d9df3a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386065, "uuid": "5be7fee4-8871-4579-9d53-a1faaaee7ee2", "value": "T17E630746B8519A17C5C10F3BBA1F438973324B4CE3FB73029A196EB46F9B61D0F2A255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386065, "uuid": "997fbd57-75bd-4871-a571-e41036bfab2f", "value": "1536:bwrOebmjWTBynAI4RB0QLSVwYLdF/0CbwdGr9GsPgt+LfAOPd:de64BymBjLA3LdF/0CbA0td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766386065, "uuid": "b0a3b09c-59e5-4892-88e0-9ac0a4dcfaa5", "value": 71876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766386065, "uuid": "ddf9725a-8087-43eb-8ebf-0a08a2b2f21d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386065, "uuid": "14229051-07d8-4c06-b679-0880d35c5c35", "value": "n7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f416e1d-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424854, "uuid": "8803717b-85fb-44f2-8e9e-e1b8a8961eaf", "comment": "Malware payload (Mirai)", "value": "db3f9ffeaa72de582874424a95900697", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424854, "uuid": "47797b66-dd2c-4444-bb18-8e6b1a4c4c01", "comment": "Malware payload (Mirai)", "value": "0a26951863678bb3258f34d385756234041f1ff54be06c0cae885928a545a89e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424854, "uuid": "2b03ceaf-e4e0-42fc-ab20-19c468cabf63", "comment": "Malware payload (Mirai)", "value": "f590106dd854da3048402191d2bee6f98146722e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424854, "uuid": "1cfe5940-5a82-47f0-ab43-1584ece6d948", "comment": "Malware payload (Mirai)", "value": "1394faa1c2ff415ec086129f718dcfc33a40f40d0f32cbc65057b18f2653afee6570486151ae12356006f7f1ae4b4682", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424854, "uuid": "ff948efb-0abb-474b-8074-cb2da686d21c", "value": "T154C3F849FC515B13C6C612BBFB5E428D7B2A17A8D3EE720399256F60378785B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424854, "uuid": "aae10545-8df5-40ab-8534-55fa8eb0f15e", "value": "1536:uB25fCAgGyfFxAdZ54VPkOeITsxwtaysu4A46/+0Otl5N9wywmO/BFBAs/x/7TLG:uB4xoFxy4eYQxwtayMInjn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424854, "uuid": "c6187e50-f77f-4ce2-b1a3-f2a826442aea", "value": 129420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424854, "uuid": "7768c27c-d396-4fb5-b1a0-b44e7ea987ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424854, "uuid": "dd01f05e-b5be-4681-8910-da4cc8772eeb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec69aa2-dedc-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766370012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370012, "uuid": "d5fcd5f5-d52b-4154-8f7a-c52a5bf439b3", "comment": "Malware payload (QuasarRAT)", "value": "3ab58d54d30cd44e9013a95573d0d528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370012, "uuid": "98807f56-6ec5-46ee-8a40-9c7efe9a0802", "comment": "Malware payload (QuasarRAT)", "value": "0b2b62e1b05659012daceb08af36da7011b14c5978be5985ba93827047f4da21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370012, "uuid": "2401d1cf-0a15-414f-b4ba-412faf0408bc", "comment": "Malware payload (QuasarRAT)", "value": "b37d4e0b96d067d1397fddcb290d6bd608b943f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370012, "uuid": "ee410b8c-e067-4fb6-9510-3e57bb07ab9b", "comment": "Malware payload (QuasarRAT)", "value": "44ed56ce8891aefcc2649a17f1c26d00c73ae2b00d6eb86c2ea4f6628fdad8c49b5fa1f174266e048b4a38e13e310853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370012, "uuid": "6abe3e03-6e58-43c0-9863-d06f27166c78", "value": "T1B727BD6303B26755DB2477FB1F48E0E22F75C6447568019A2F85E72AA48FDB00F62B78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370012, "uuid": "1bb09eba-f340-435f-b19b-be1e52994f92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370012, "uuid": "355c8412-bf0b-440c-bba9-627f14e4db74", "value": "24576:QABSzalKvEPfpsHQ+dC0SzcqzWhSwHOnFmSJJWtW8YFfBpS7HVmxZmtXHP3:DyvEZdcYdWHVmXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370012, "uuid": "96ed51d5-6a5d-450e-83df-13323389049f", "value": 22078592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370012, "uuid": "08d4878f-c735-406c-be03-3b837e5a297d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370012, "uuid": "81a4685a-bd27-4a17-82a1-0afcc1532b75", "value": "3AB58D54D30CD44E9013A95573D0D528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7086c3-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387481, "uuid": "9a3664c5-2819-4ba5-ba6d-3e83fa497e30", "comment": "Malware payload (Mirai)", "value": "b35e959be8301cfa6d99aaf1047400c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387481, "uuid": "9b9429af-83d2-4351-8863-e50e86f3688b", "comment": "Malware payload (Mirai)", "value": "0b8d2a649987fca23d0e1965b42a2c7ed29040c40c990fb8861d4c728aa28103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387481, "uuid": "b36fddea-a0db-4960-8555-0ce37b65222a", "comment": "Malware payload (Mirai)", "value": "92bbf0e16fd3881a62c6dbb3f477dddd356327ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387481, "uuid": "d64bb048-1b2c-4087-9a15-94f4dbf8dc11", "comment": "Malware payload (Mirai)", "value": "1481ac3ff7ea9f3f4fdb9e53d5318bfbc930bf9d9df05ca774c02f3db112a2b8bb78b11dc13106c790598783433c5d35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387481, "uuid": "5ac1d54d-c246-4dcd-9aba-66aa83cbf88a", "value": "T11CB3E085B210AE55C02672FCB1870A90A3B17E7B4B9A150B4473F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387481, "uuid": "1935e288-cff5-44d6-aa41-48273ca44642", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuA:as5zqhr5Nzy7w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387481, "uuid": "9c726031-bc0a-4c9c-974c-1deb3086d264", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387481, "uuid": "026a5298-b8cb-40fd-aaa3-a570e64c3ca1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387481, "uuid": "5039a193-cdb8-4b34-a28b-6ac692e1ccb7", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b866fe26-df63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766427983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427983, "uuid": "1adf2a6d-1b46-4e75-aa15-b77d5141c84b", "comment": "Malware payload (Mirai)", "value": "d525950cdcd65a43bfc95e3ca33bfd2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427983, "uuid": "180c5986-bf3e-4dc5-8564-a7868a9132c3", "comment": "Malware payload (Mirai)", "value": "0ba7845ee2207c593aaafaca68b8b5e91035556bbda426d81eac5b1edfbac1ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427983, "uuid": "272b5645-edb1-46ac-9195-c9571881a89d", "comment": "Malware payload (Mirai)", "value": "1d07f18ec275c14c9e5ee797375d799a244297d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427983, "uuid": "519f7a04-c17f-4401-88bd-2fb83017934e", "comment": "Malware payload (Mirai)", "value": "6bb8ae9baa3e993ab147502b827902db0a3926d906460682daa9f7ef63cbb887b5fa1b989d1470082bc8aab2bac100e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427983, "uuid": "73042cf7-a139-49b6-8293-f88b503a5de8", "value": "T139A34B02E31C840BE6E70FF427BB53E1936B6B4126F5E282760997454675B329B06FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427983, "uuid": "03aab920-0ec6-4f7c-8c64-eab6a7639297", "value": "3072:yTfwNUUyt3Nl467jlN1KdJjy7ychVtRyN:yTfwN0l467/1KdVy7ymVTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766427983, "uuid": "533f891d-b9f0-4678-8d73-9430b9ca0f69", "value": 104832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766427983, "uuid": "e4a458de-c26c-4101-9f4e-b25e78258a2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427983, "uuid": "e55462b8-47fd-4660-8730-f07a2d5a0de7", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2d17e9-df2b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766403701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766403701, "uuid": "0666f2df-82d1-44fe-abd6-84eda8869860", "comment": "Malware payload", "value": "76c6bcde3c66ca1f41ff479e153775de", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766403701, "uuid": "47161d43-34be-44e1-b561-927facc4c828", "comment": "Malware payload", "value": "0bdb3d2a14bf39bdd318623ef2a0a0b0658ccdeec45b60e5da61bec14b7e2ad8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766403701, "uuid": "9e0e2cba-ad6e-4540-9b61-c02ae63049ee", "comment": "Malware payload", "value": "e6dd81331058b17aae3c3235b7be155a8dd4aa4b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766403701, "uuid": "8d9e9de6-2200-46ce-ad3e-0563cdf6cf77", "comment": "Malware payload", "value": "cc74b9509f734dd7bd7307ffa88f2e34e0bc6872c946a90725460f4d2bdc5a72b7bbc3fa2dfef61a420316b9f6f3d80d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766403701, "uuid": "12b5dfe8-f039-41db-a3b8-2174d752674a", "value": "T116821A0BF204A4A7F149E37E8C1542545A22DD319903F4E37FB5580F1EFB2EABA852D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766403701, "uuid": "ce784d39-4232-4e11-9a57-473bbe4ac457", "value": "384:eS5myJeUkLNkR3Ef62RpwUhLwZ0bZSjaK91n8Scn:wAU6R3EflpwUOZ0bwtlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766403701, "uuid": "d7abc750-3902-4973-a51a-284005224995", "value": 18285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766403701, "uuid": "f6a5f293-e017-4a46-8e6e-339f7cc5bb9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766403701, "uuid": "776cdc2f-e43f-4e0c-aded-3fbe26afd216", "value": "dupe-mod-v2-.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfe4a70-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384692, "uuid": "d9fbf8ac-e5d9-46fd-a13c-229b301663a0", "comment": "Malware payload (Mirai)", "value": "afbbcbdf8538744ca16e7d03e0768c90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384692, "uuid": "94a59a83-c243-47ac-918d-8e4911bca747", "comment": "Malware payload (Mirai)", "value": "0c28efda8a6e58fcf9890089fd567470afeb8ebd8df3b78f8260f6e978d90d60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384692, "uuid": "d6644006-b8e5-4e72-8c75-ea66f7ce6756", "comment": "Malware payload (Mirai)", "value": "09215dbee07cf721e178930356580f11857042ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384692, "uuid": "267f1137-0647-4ab3-b428-6827de8e4567", "comment": "Malware payload (Mirai)", "value": "70fa3a59b4e9e69bbdf390e3a0ece8aa3ddf35a6003488221963cd7e45c9f02f32f0815ad76aaa3bf6e77ed2788264f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384692, "uuid": "7a557b41-8172-409c-bb3b-1d41e8b50597", "value": "T118530856F8818E11C5D412BAFE2E118D331767B8E2DF7212DD206F247B8A86F0E77916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384692, "uuid": "db12137e-f913-4c7d-84f9-0c2e22d903f0", "value": "1536:4UnrdBnwI7JD8CQcI5r8LAlhzQI8iuH3v1Gn:hFwkD8cgrCrH3v1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384692, "uuid": "dc62f122-a345-4da8-b268-4c3763665888", "value": 62984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384692, "uuid": "e650bd66-3202-48d9-9be3-c4d9e0a94f87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384692, "uuid": "ccd5b30f-da3c-4d33-aad6-d6ecb6c9b937", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335b00b2-df3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766411439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766411439, "uuid": "80b750b4-6467-4b5b-9bc5-487e936d4525", "comment": "Malware payload (Mirai)", "value": "d9f49a4260c1edb415dc3d1364d2b86b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766411439, "uuid": "5020b52c-3224-4139-8a81-0b9e42b0b972", "comment": "Malware payload (Mirai)", "value": "0d5da657212d9b1e7581f2ee3a92642e4bf6265c8d6ffc7eb3483f40f5ccb79c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766411439, "uuid": "a9449125-0943-4c27-ab93-ef7d418689ee", "comment": "Malware payload (Mirai)", "value": "7323ea98e8b4d011ab2dd38f15dc23b2b1a39ea6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766411439, "uuid": "b3d1fea5-108f-4a27-969a-5c02db739483", "comment": "Malware payload (Mirai)", "value": "9fb647096bec682cb667563fcc9793fd625b79c64910c04b28683296c258efce4cfb5e562f0e3d22f4bf0d51a10e41d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766411439, "uuid": "9d95efd0-d3d6-4d79-b7c7-b728dfd2f3d0", "value": "T19CB35B53F804CDBFF88AC7724683C735763233A25BB3166276526537B92D3A40D26E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766411439, "uuid": "439e64ca-a1d8-4097-b66d-045a78edfe2f", "value": "3072:4iTWqXJZLR+NdIkZwqYVs3MQfR5u7hxbRBw:4iTWqYNJKscQfR5yrPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766411439, "uuid": "3611af47-a0b6-48f9-945a-f44f46299a69", "value": 110328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766411439, "uuid": "d2858e58-0e85-41ec-a586-70f692ffc2e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766411439, "uuid": "1ac7bbd6-bef1-46ba-9236-a62cb1d5099f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa94253b-df54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766421652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421652, "uuid": "0381f675-cb19-4bdd-9ac9-780414b54651", "comment": "Malware payload (Mirai)", "value": "360d28ea2c64b1bebe349b1ee99e4780", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421652, "uuid": "efcc7783-d53a-4f40-8b11-4d57823a5cb8", "comment": "Malware payload (Mirai)", "value": "0d8a7f6b11489d14c3d880c282469fff9fd7ca83dd1f88489312d5cfe350c99e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421652, "uuid": "fab57964-1025-4238-8f0a-8220bd24445f", "comment": "Malware payload (Mirai)", "value": "ba091e259ea68f75ae32b913a25fab695799d527", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421652, "uuid": "b40c4926-e7b1-4749-9cf1-3c57af27802a", "comment": "Malware payload (Mirai)", "value": "d66d1c5ec04628111f2f78eaa9ee3ad5aecc167f9c45513e6467e07822a3b63b8133050c4d812114bff379cc559307e4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421652, "uuid": "c01c5663-8312-4323-beda-3d5bf13b5a35", "value": "T10BF01D8E03037A16911EDD7976B11BCAB461FB4E285B6F997CC180FAC0C46C07658974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421652, "uuid": "a8ed2609-aaf4-45e7-b5eb-95212f47bc24", "value": "12:eJAMHxnRzTwAe0YYnRmnAW1s3nRm4AcnRm6NIlAiYnRmSaqAWnN:eOMPn1DYSLW1shwGJNIaiSvu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421652, "uuid": "e63499a2-7b2a-43aa-a09a-795d5450bb07", "value": 636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421652, "uuid": "b4d7710b-e771-48b9-8033-d48257afd87e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421652, "uuid": "814ae3ab-f876-49f2-8e91-6749aa352c34", "value": "zxc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4953ec-df55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421844, "uuid": "285a8f47-62ce-4eaa-b7d0-878a4b3f3673", "comment": "Malware payload", "value": "0cf2b57111bc34574e9405aa9aacad58", "object_relation": "md5", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421844, "uuid": "46b9926c-c0f1-458f-a481-fd51ee45cd59", "comment": "Malware payload", "value": "0d9c9204ca58d57a76d753bf4ef8a423177bf7b9a9294e49baa0f3067a8cbbd3", "object_relation": "sha256", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421844, "uuid": "cd967383-3680-4f7d-9db8-a0296196a2a7", "comment": "Malware payload", "value": "a26f57ea00c04fab5be7ae7f9dbf29665878a355", "object_relation": "sha1", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421844, "uuid": "8fdf07d2-1c0b-4153-9590-67e9211c355e", "comment": "Malware payload", "value": "f606f9b29493e7ead9fc8db333e85d8c5a44ec51256388d34c8cc5293aeec099740e49124a2d40e0d19b1258ddb901f6", "object_relation": "sha3-384", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421844, "uuid": "f4ccb3ec-acc6-4b8f-9d33-a67f542dd7a2", "value": "T12E21504E3879024C584023B3390C5ADF8639432EBA3902F0CB9B987A691D052B5FF78D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421844, "uuid": "c305d32b-bfe2-4532-ba33-742401fe359f", "value": "24:hTTf2SWRef2bf23Jf2bf2UmGf2kKyVf2UcLNU3f2/ifwqf2U8xnQEif2IJ7EHMfL:hnflrfmfAfmfhPfxTfh93fIif5fh8xnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421844, "uuid": "7fb0f642-40b6-4c68-86db-fbd6c98fb39d", "value": 1393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421844, "uuid": "555c95ba-041f-498f-9aa5-de4ed5a083fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421844, "uuid": "7c0b8c8e-a53c-4e26-b3bd-f203d2e0348f", "value": "second stage.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e278b9-df2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766405533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405533, "uuid": "3ba07823-3948-499c-9fef-3d3f6581ebee", "comment": "Malware payload (Mirai)", "value": "7085d532cce121b2f641ecdd5b06744b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405533, "uuid": "6f925a7a-8da8-4889-9fcf-71887c4c8885", "comment": "Malware payload (Mirai)", "value": "0e571eaa740bcbb03d1d7d93df6630cbcedaedd0c3bdeabdf4df6f54fdacc248", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405533, "uuid": "b156b6cf-c417-43f8-8b34-9a25b81c8b7f", "comment": "Malware payload (Mirai)", "value": "8907c15bb105c7900524a437112df9eaab6fa3e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405533, "uuid": "bce2a5b6-60cc-4231-999a-ab17db12f372", "comment": "Malware payload (Mirai)", "value": "07096b334f1785faff9d2694032627917bd47e83f15dd3c2501e44f2d8c1a89be7c0ee46de14bf09c6a4c7de6c66ad29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405533, "uuid": "1b111746-8e1f-45de-a02a-acca357ead2b", "value": "T1C5D35B86B440DFBDFC0BD3374243095AB236B76472620BA3B62BA857ED311D6582EF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405533, "uuid": "71b23446-8b5e-433d-b468-9f41201a7f7f", "value": "3072:3cFpPCNNtk5f1yTycZ9uRJCJ17F4fjlvCtF:mpPCNN06ycruRcn7KtCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766405533, "uuid": "61a93c62-163d-496f-9163-684ebfddec0a", "value": 130848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766405533, "uuid": "8e13538c-02f7-4002-816e-a0b4f29ee2ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405533, "uuid": "38875be5-5d91-4624-986e-fee202286733", "value": "rondo.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5521c2-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384695, "uuid": "55732193-681b-435d-b42c-b09f2cb7c2dd", "comment": "Malware payload (Mirai)", "value": "784e410a5778bc7a24ae9132e8977d76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384695, "uuid": "62770526-b448-4778-997b-f09a00eb1a5c", "comment": "Malware payload (Mirai)", "value": "0ebeb6035d83cb19af3eb645c026c40e2e89f3bb6fee549f93c3241edbcdc6f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384695, "uuid": "72b9eab3-93fe-477a-8773-168f224f32b9", "comment": "Malware payload (Mirai)", "value": "d8a98fcda76258d8b1039ba321429f177f99262c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384695, "uuid": "4256d1e3-f393-4886-abcd-4792c7792ccb", "comment": "Malware payload (Mirai)", "value": "c20f0a48b97360e1dbc6a220e532b3bcb20e1bc973d796bb7df5031abfb49301707c99ad43d12fe05d06ef41e9762d7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384695, "uuid": "815c9535-e705-4acb-aa2e-66021e1096c6", "value": "T1E993E90B2B62DBFDF6AD823487B3877056D8229226D1D389F65CD60C1E7420D591F3EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384695, "uuid": "4ba40b5c-f357-4ed1-9cd7-2e85219bfc4c", "value": "1536:A4NO236j+3LGXFOrduCGi63kFmzQFCpXiBcLHIi0gMXFyQfCZbr9GsPgBT2M8G4O:/NO23+oGXQc/IrXLDTe5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384695, "uuid": "c4cfed07-38b9-49b1-b4db-c0d823fba944", "value": 94195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384695, "uuid": "edb62a48-bef0-40bb-9849-41c8c626055a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384695, "uuid": "6c37c938-a0d2-4709-9553-c3976ed9418f", "value": "b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f498241b-df91-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447841, "uuid": "9c298545-f377-402b-a0c7-4702d1c94f07", "comment": "Malware payload (Mirai)", "value": "bf7e63c8f04baa3cb5abade1552552c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447841, "uuid": "b7be1899-fdf3-43c8-ae49-ee78c639b496", "comment": "Malware payload (Mirai)", "value": "0ec6dbb5439ea5ba5ada4f80e8a2ca691f5e7c1349e62b377e023f14b9a12993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447841, "uuid": "ec9466db-a3af-45de-a4b1-aeaa77e4835b", "comment": "Malware payload (Mirai)", "value": "0836fb57bf41ba1be17a77c93884b0287f2c6e17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447841, "uuid": "13230b78-6c54-48c1-b645-018947ed0222", "comment": "Malware payload (Mirai)", "value": "48ae85de5d8c53826aab26a6ab5f1cd221de8847c55a295d5ec9e6be101027c2b7c7d96a78ab967f5087593973d08aa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447841, "uuid": "f04238cd-0ec9-45c4-9a56-f0d002894c62", "value": "T1C9B3E085B210AE55C02672FCB187099093B17E7B4B9A150B8473F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447841, "uuid": "82e191cf-4060-4432-b429-61c8eb3750e4", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuc:as5zqhr5Nzy7wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447841, "uuid": "360696c9-3039-4f53-8243-1f5f4bdbd891", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447841, "uuid": "36bbc3e0-b6b0-4246-b978-680207c16318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447841, "uuid": "a5e7407a-0b87-4aaa-89ef-5c2496936874", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8071d9fa-df8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446787, "uuid": "e6d7eec8-65a8-4ebc-aff0-fc8d7241a5e3", "comment": "Malware payload (Mirai)", "value": "e53f9e91ed00ed31f681846fdfc13f50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446787, "uuid": "61f642ee-80f9-4283-be16-88677a52cafb", "comment": "Malware payload (Mirai)", "value": "0ee3bca3679107e3d0dcb9a3c5f22a1c45dd084bab747e63f73a98ee320f36b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446787, "uuid": "4fe54252-290e-4955-9b42-c0d1666e2ad8", "comment": "Malware payload (Mirai)", "value": "ddf3efcb9fe69374568837a0345052a38e496e1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446787, "uuid": "43640b76-3fae-4fc7-81b8-d228d7fa2ac9", "comment": "Malware payload (Mirai)", "value": "2c20ed12b01249f55ee11094189349be5fdbd74fe852fa569d36c95c3aea9e2d42369a0e0e42e03696ea5d0fdb8b0b5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446787, "uuid": "b8bb84bb-ec64-4bab-88bf-22ae038b2464", "value": "T145438B26CCAAAEA4C55C91B5B4328B768B135101AAC63FB65166D9748003D8CF6CE7FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446787, "uuid": "4e5244b6-9235-443f-8582-e8dc2c1d3687", "value": "1536:U8Q2jJziO6HwQyUjM5REJZCRMBxKT2bVRr:zbz6QYjiREJZMCIT2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446787, "uuid": "486545b0-775f-4fac-856f-822c7d56951f", "value": 55516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446787, "uuid": "083e2107-a600-48c2-81d1-875503c7a542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446787, "uuid": "e475121c-2842-4246-8a36-debbd9c2d068", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb98e187-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446564, "uuid": "11a92228-0b5f-46eb-bad0-2385ebc6509b", "comment": "Malware payload (Mirai)", "value": "b34df7f906d736fbbbc5cafe5c337e6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446564, "uuid": "b14db527-07a4-4a78-8dd7-abd0193b00a4", "comment": "Malware payload (Mirai)", "value": "0ef5a1d743d381c57fa136d6a9e7f7e1fa679718ddb240bb5129c5e99c911f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446564, "uuid": "e05d5ad9-76ee-4a12-86fa-b81ade83d1cd", "comment": "Malware payload (Mirai)", "value": "0078233c4d03a5959c82f92707977b6ec7966ba1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446564, "uuid": "279834ce-32cd-445c-93a5-fc0f93b05ef1", "comment": "Malware payload (Mirai)", "value": "1f3402043569b6767f8ffe514cad26221fab767026e3f960320ccba86519c2d4fe0fda6631d409a713fee23f1ea9ff9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446564, "uuid": "cba8c11b-efe7-447b-9c6d-3d834aafcc0e", "value": "T159935B21BD7A2E1BC0C4747B51F30B35F2F6274A21ACCA1A7D720E8DBF156102557ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446564, "uuid": "69f08f07-4712-4103-9f74-3bdd0991dd46", "value": "1536:I+X9xScBoZQfKekrtSZea2VWc7H1gn/URC9UH1bNltP08zm7uhq:ZtI4ieNzEc/URkUhm8zm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446564, "uuid": "0c7a2672-e5ce-444c-923d-845569368771", "value": 91340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446564, "uuid": "b1a68fcd-2714-4b19-95c5-40dd5c5d2d67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446564, "uuid": "053a6d70-25ff-49c8-8bea-5b41931f0401", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade12ea4-df78-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766436985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436985, "uuid": "ebceaa7f-8e57-4560-8fd4-949759823db3", "comment": "Malware payload (Mirai)", "value": "a816d6a73813ff4affe14c55191e1ab1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436985, "uuid": "45a55884-fd9a-4272-9699-cbc542ca2ee7", "comment": "Malware payload (Mirai)", "value": "0f40ed2651f3f8e58522a837f4227bb886533edea06b3527a70153f1c55daaef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436985, "uuid": "e57f4fa2-d04b-4fae-8794-5ff5a903f375", "comment": "Malware payload (Mirai)", "value": "95a7ef6f4768a8d34312dd79051cb7ab3db4f2b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436985, "uuid": "29c2b7a0-92b1-4036-9002-b276719e7283", "comment": "Malware payload (Mirai)", "value": "11b057bf8c315409ceb700e9e65a8e7057ea2c8fa4d73cd7f1ab026f064ca0b7895284bb28f09536dd29b6c0eecf43d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436985, "uuid": "64b96f50-679c-45d0-86c2-fefe4fefc6b7", "value": "T176C30786B8829B20C6C2567BFE0F528A331357ACE3DE73139D181F64278B55B0E3E516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436985, "uuid": "7adf3b56-58e7-4985-99af-71df5b35ec67", "value": "3072:KKX80HIt51P84Swa/TQEhFzrVG2zYTsa/a2o7jU8O7jOfuZZYnz1:KKXYt51P84Sp/TJzzs2zYgaY7j0jwmM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766436985, "uuid": "2204f77a-d2e5-4256-8e6c-19a7c67c9146", "value": 119936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766436985, "uuid": "39737e60-2288-4cdc-9b0e-fd7ff173372a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436985, "uuid": "30fea113-40f1-4054-8e2e-8e56fa83f15a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205555f3-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370176, "uuid": "696e1e28-5cee-4188-aecf-c512d7da3019", "comment": "Malware payload (Mirai)", "value": "fe387b4c6f422c653c0fd5a153992d77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370176, "uuid": "dcb88aa3-84ae-43cd-95f0-0219bdad2973", "comment": "Malware payload (Mirai)", "value": "0f902eab3ec0c7d154eb45301a314295b4fef2fb81f67fee039e1f5fa9334f62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370176, "uuid": "731105bd-fd24-44b1-999c-26be6af8d8d1", "comment": "Malware payload (Mirai)", "value": "034525b28774bcf5b753aca70e74c4c55a8e2369", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370176, "uuid": "74965760-791e-4460-8a01-bf0e3d776673", "comment": "Malware payload (Mirai)", "value": "9591e50ac11ab0e5b05af2462ad7aa54aaba3cf20e09e00e90370756587b69272b569872443c32c16c56d6de6ed3f4f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370176, "uuid": "5c6fde90-75bd-4932-afc6-8650300d4d58", "value": "T1FA433B31BA760E27C0D1A8B621EB4B24B6F547DE26E8CA0B3D710D9EBF715402553AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370176, "uuid": "57d700f2-80ce-43b4-9cdc-2aaa0bebff76", "value": "1536:/fPucFQm4/g1We/ubY0qIQpu75nta1Njw:fucSbauVaNjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370176, "uuid": "1f778f72-a958-4041-a937-884c172c4fb1", "value": 59872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370176, "uuid": "7de458cc-839d-4930-b484-9e4c539731e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370176, "uuid": "afe97e4c-fb3e-43f6-9a36-39e9bc73d638", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd7d672-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766370517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370517, "uuid": "649f123c-0bb9-4675-a19c-68ef61d902f2", "comment": "Malware payload", "value": "613613e5a48eb3b902c0193749e83011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370517, "uuid": "780eba62-80ba-417f-86dc-82ece99bcdc1", "comment": "Malware payload", "value": "10492446f200b51172974209a8f8d2b747e09c48a34af5a8d163f114e962d578", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370517, "uuid": "10b0bcfa-cbd2-4ae0-addb-5d2c08c83de8", "comment": "Malware payload", "value": "3548fb356141ed795ef86d94c11238cda6846056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370517, "uuid": "89e30cd7-8ec4-4b67-99bf-93369481abbc", "comment": "Malware payload", "value": "e2799cc0809e675036605c0e1317edb083b10b44fcbccdf5782ccf008507c7508a5ad3f179a56f94531b941006a49104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370517, "uuid": "14417814-d458-4d43-94bf-3bfd7a4afa30", "value": "T12993E8867440B62BC7C24F37FE1F435933254759A3AB335255282FF86F8BA5A0E26346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370517, "uuid": "75bbf143-2dfd-4260-a531-78325db7be3b", "value": "1536:H0DRej01t0nR7j6jWIz5ftmiH9GuKDQAVwHL3FZsJ8cU9GsPgQ+cI9uTlbu:/0OSz5Vl9L+QmYL3FZsJ8RJDbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370517, "uuid": "26d1605f-99f3-42ae-8044-a306575c2841", "value": 93632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370517, "uuid": "e50cb199-d329-44e4-88c7-ae5783d1064a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370517, "uuid": "5f75f288-18a4-48fa-8719-4a0413099760", "value": "n7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209b634b-df65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766428588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428588, "uuid": "441e6626-7758-4b50-bc47-168f2d7f511d", "comment": "Malware payload (Mirai)", "value": "dd1cadf0ae52eb6f9212263ea554273d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428588, "uuid": "9f275999-31c8-4990-9fc2-4a19a0483b5d", "comment": "Malware payload (Mirai)", "value": "107d8276a13b59557c642841e44e497a1fde00a1f2877413017a570c61a4f10c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428588, "uuid": "7edfc91d-d74e-4d1b-a120-5f1b3e41de88", "comment": "Malware payload (Mirai)", "value": "ad4e91670fed9cbc5c1d71de0df6abea643d752e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428588, "uuid": "77ed13c1-5bb4-4680-b258-862dce473108", "comment": "Malware payload (Mirai)", "value": "786fbce47b0498428685c438d7c6adbbd603932499f3148d47315b895f52370aa7091e280b2d943da2494897714335aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428588, "uuid": "540bb9b1-b90f-40e3-a1d3-edc597aefc6a", "value": "T174B31917F6D2CEF6C08352702ACF9AA25C23F5FC1762711733AC6DA42B1D58A2D99E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428588, "uuid": "db51f086-f6aa-489a-9ed5-c77dfc7617ce", "value": "3072:YowlDZRxCi08JsPO1GkphaUeDCDOlOmnduJXLBYZGSKe:axCVfkphaUeDCDOQmnduJXLBYZGSKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766428588, "uuid": "39de0928-604e-4e00-975f-1f2dd3af110c", "value": 112456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766428588, "uuid": "b2726ef7-a20a-4a6e-b2fe-283818c08d20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428588, "uuid": "0bae93bf-2d48-4ad7-b303-61a32e54421b", "value": "chernobyl.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cb97d2-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387465, "uuid": "2a8391ea-7add-4d58-8757-d6151220442f", "comment": "Malware payload (Mirai)", "value": "643e61dfccab71b6167f8991d3218c90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387465, "uuid": "5c679a8b-bbcf-49a3-aabf-68f8f40c9fad", "comment": "Malware payload (Mirai)", "value": "10ddabc05fe89e6a9ecc5365944ab5859cfeeac4104f945665b4ea87a5a23028", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387465, "uuid": "f4b5986d-67fe-4291-a758-54dcd2e0867d", "comment": "Malware payload (Mirai)", "value": "64aa0ae9bda70d4af9ef3589576b06326f9ac169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387465, "uuid": "db6c92d7-40fb-4af2-9cae-df591d7581cc", "comment": "Malware payload (Mirai)", "value": "a393d8b597c46fc52ea6ad76673f6219db11ddfeae0e926702f4404a73f92eb42f4be57a5a86462b453175f59cb144d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387465, "uuid": "9ab73342-26dc-4b3e-a7c2-45a2e9b22fdb", "value": "T18B145C2BB3C3ACE6C11163305C312362772FDB051958EFFBDA1B3794A9977225A24687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387465, "uuid": "b2c78dd9-2730-498a-b686-5dd6a45b1407", "value": "3072:19dOm515qt9SmkIs+U36Q5wHYbRMhkSzw0n51XYrP1NZy7XXs7IKZ5tA:19dOm515qt9SmkPOhkyvYo7Xc7IKTtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387465, "uuid": "b302ead4-689c-4506-b4dd-fd16f2ce72bf", "value": 197448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387465, "uuid": "93f947b8-886a-4b2c-8316-3120b8d0ac39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387465, "uuid": "bd144b51-a465-4df5-b7bd-804b537fe1c7", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044b0453-df73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766434553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434553, "uuid": "273bff3c-30a4-40d4-a6ab-c730d1bae12c", "comment": "Malware payload (Mirai)", "value": "5ba81a4432faa9c37a3d220da46aea69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434553, "uuid": "e10ba219-f054-49f0-9b99-9c385e4d1d88", "comment": "Malware payload (Mirai)", "value": "10f992184f51ddc712629719ba7ee7e27f097ec91a63c5db9d7a1d10e53a9770", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434553, "uuid": "bf845563-f110-456e-86ec-e551b511922e", "comment": "Malware payload (Mirai)", "value": "365bcafe06662697ef183d8a0fbe6652ae4bf2ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434553, "uuid": "a4836c08-b989-422e-bed7-fe001ad584b5", "comment": "Malware payload (Mirai)", "value": "acf7d32ec2ef1a5a8b50d7db3dc4455914d86d8e944a25b032bd6076258b0b559abc10bf80ca3f1ccbf9c637e47060be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434553, "uuid": "112ccf56-801d-414e-b72e-526de57db667", "value": "T106D31845B881AF10C6D625BBFE4F528A331397ACE3EE7202DD145F2423CB95B0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434553, "uuid": "2194f037-eb3a-4362-8a61-a5ceb7b14561", "value": "3072:U5WutV4JmN92a7fu+hRVrVH1/x+wjanv2sG5XYEFBKy0Dd48Tf0nzE:U5WutV4JmN8IfpfVx1/xVjanv2sG5XYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766434553, "uuid": "e6dfe8db-204e-486f-9d43-30331c38182a", "value": 132688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766434553, "uuid": "239379ec-3b34-4471-917c-eeed04b2c155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434553, "uuid": "3e2ec8b0-5cb0-40ef-8bee-8ab740603d16", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfff98d8-defd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384241, "uuid": "198cccf4-f2d2-4f72-83f5-a0d820d21463", "comment": "Malware payload (Mirai)", "value": "5fbe580d7a1461e822d705c4a3d0b96b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384241, "uuid": "d378cf02-5403-4db2-9b88-721ab14f4bd5", "comment": "Malware payload (Mirai)", "value": "112bc066cf6ce2a4e4001fed70a1aa7f847dcb4e6a54dc5183766e4316c1a385", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384241, "uuid": "ed9ac2b4-c21c-4676-afe6-d56ba546a23d", "comment": "Malware payload (Mirai)", "value": "a665fd14d302e70ce776e50ce5b0fe13f0a223ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384241, "uuid": "1d69b791-0b9f-4eb4-acab-965ba67e1b3a", "comment": "Malware payload (Mirai)", "value": "787b290c71cbe1715539c85451057f29224d7e52c06651eadb4eded5c5220b7d831e221ea34b977821ab6d406f24686f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384241, "uuid": "1c2b8bb3-29e7-4bc4-a97f-c093a781b124", "value": "T1321151CE12959311484CCF84766E882CA55CBFD074B0CF6DACDC84BEAD89B1C7166F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384241, "uuid": "2a7986ea-ff66-483d-9481-0ecb2d4dcfc5", "value": "12:IYjUoWqUoyNNIl5zAUo70LKjUoZgOsUoneCUo9ON/UoRSEUoktaKAUoejUoSiAUO:1gX7BNI75RKgJilDv8UE1tBlQ3apHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384241, "uuid": "25441073-3db1-45f0-b3da-631cf68bb6f9", "value": 924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384241, "uuid": "cdb9b7df-87f9-4223-a6c0-a768a2506730", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384241, "uuid": "9c4a6609-8920-4d43-8db9-75b570efaf66", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202c550d-df40-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766412695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412695, "uuid": "548b211c-5807-4930-9f43-6a467b43d459", "comment": "Malware payload", "value": "4101fdba55a143a7f2b681dd936206da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412695, "uuid": "326b9d62-2ed1-4443-b5ba-a8f8cdb91a04", "comment": "Malware payload", "value": "11d6fb08e81a847374b87854b3ba29596b068496cc14fdb033ed4591b679b844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412695, "uuid": "2182f80f-8142-49c8-a5f2-24836436bac2", "comment": "Malware payload", "value": "9f103931d9ac9b21ad735ad2cb35f1c6f94aabfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412695, "uuid": "dc405469-0024-4104-996e-da83bfa0bf29", "comment": "Malware payload", "value": "afd6c5e315c6876cf8ca7e61a2ef00feed466e05ab57cf0bffe65fec7fa528a0a36318e902a809abf76caf5e0ddca031", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412695, "uuid": "6802c09a-ed1a-475c-b898-552e5ef89229", "value": "T15A565B63FE908266C09FD179DDB2918176307C48077026D72BA12B751EBBBC4267BB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412695, "uuid": "242f47ff-1cdc-4ec4-819e-7cf026a87755", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412695, "uuid": "5e73fae1-b429-4129-ab37-44cd5ef13796", "value": "49152:Q4/E8QgOZH+Q7DAtmF/kMm9jaMTJDTGfqdmJH3vLW:QLgil7piVGfq43vLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766412695, "uuid": "598401cc-de3a-432c-858c-437f1b604d75", "value": 5903496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766412695, "uuid": "b3808fa6-8102-4db4-92df-0e81939c330e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412695, "uuid": "719310e2-c97b-48b0-ad74-bcab114336ca", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22894e41-df59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766423437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423437, "uuid": "bfea5a41-aa0a-4d7e-b270-24d492c7e8bf", "comment": "Malware payload", "value": "cdfc737aff586d2f0d5bdd75ed25cbe4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423437, "uuid": "c38171d1-fbca-4ab7-bc38-2312e42c7a31", "comment": "Malware payload", "value": "11dfefebcb7fc59fff9ebd78bb55676f77825d5919ce6f65a4376760e18154c3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423437, "uuid": "08d57b8e-b208-4a38-b3c6-0fb9b9d79d98", "comment": "Malware payload", "value": "f66364a3566d48e0588237e288003c541ae0fd73", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423437, "uuid": "4c39657f-232d-4140-b598-16484b5b0153", "comment": "Malware payload", "value": "49a6675c74325f09f3fb08f1b1c4d2e3f7e9d9f314255f57ebf75ba5b03e99cd527614efbc0164ed75a670c235b81c1e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423437, "uuid": "e1986fbf-d0ee-45dc-a049-e8aa3aff4626", "value": "T1546155862DDA830D0674C177B62D02D0FA39F2EA432579D425A0CEDC199E1CACF8E29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423437, "uuid": "0b3dfa19-4ad4-4cba-900f-f8866c6b0cce", "value": "48:igX7hc8NTfDVc+3E6Np3YPTzkwAiB691Kc3jA1K2A1KUGQA1KUmLc1K0yA1K0c1J:icNTfLUwymfH3CFmgfoO1N7nF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423437, "uuid": "8bf63285-9282-42ae-9ad5-a1134b51ff2a", "value": 3196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423437, "uuid": "b65ac317-ae0e-4e94-80e5-8f88d2cd79e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423437, "uuid": "db88e9c2-7a9e-4423-b445-a8137bfdcaa2", "value": "UKBB1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a00dc3c-df59-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1766423530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423530, "uuid": "3e9d5edc-3f15-4fbc-b658-b9155c139dbe", "comment": "Malware payload (GoToResolve)", "value": "e62728c367ec3508d02f258c6673434c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423530, "uuid": "99414a0b-8bc7-4572-8dce-eddc360cbac3", "comment": "Malware payload (GoToResolve)", "value": "12c03ff1d6bec93dfcc6aae026517a84556a4b058ace4c66080c233923a73645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423530, "uuid": "6e1e98b5-ef13-47fc-b1b0-d01908c14a57", "comment": "Malware payload (GoToResolve)", "value": "1ac9865354e7ad83db86f6efb5eea184a87ec7df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423530, "uuid": "a4028295-7e4e-47de-bc55-0d25af162ba7", "comment": "Malware payload (GoToResolve)", "value": "bbfc5d7c7b05145ecee99a6a409ff1e124cf178d37d23ba7a067323f4815f319be0706c266b03b5e68e3f4b9e1bde6a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423530, "uuid": "8455e94d-9091-46aa-84c5-1676fcfe9ebf", "value": "T107373321B155C032D85221F2A928BFBBA69D98344B7119D773EC5F299B301C33B36E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423530, "uuid": "dd374ade-f23b-4750-a642-be08b504cc92", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423530, "uuid": "b4446a94-4b45-44f7-9e66-ad271ab5d350", "value": "393216:fUCnUEBz6o1cXTQPw1OP15IP8EH5egBMYjZSteu26Gg8Lxiy8zgvXw1TT+WY9:hnUYSsPly887otT2zg1WvXw1TT+W+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423530, "uuid": "197c6260-9ccf-4800-84a8-8e93026badb4", "value": 24444392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423530, "uuid": "b98f319f-d9ae-4204-85a1-357f17e40c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423530, "uuid": "87c543f2-88d4-4774-afd7-f6dbebd9efa5", "value": "openyourinvitenow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5c946a-ded1-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766365122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365122, "uuid": "ec23d063-6c3b-46bb-b3e8-b28ce77dea6e", "comment": "Malware payload (AsyncRAT)", "value": "a076ec0e876675f1840e874aa5bd1775", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365122, "uuid": "f1be49f1-e425-468f-ae94-363fac2d9685", "comment": "Malware payload (AsyncRAT)", "value": "12f560b4d0b129ff8e09d206f34bcfa8789d03a130c2cd90be0d828de7401333", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365122, "uuid": "56061f2a-6f8b-4934-ab1e-4fcf4bd2175f", "comment": "Malware payload (AsyncRAT)", "value": "6489a83a02acf44b6b567bf1673832bbcd332df3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365122, "uuid": "c01a067e-ace6-4320-b441-246f278db65e", "comment": "Malware payload (AsyncRAT)", "value": "f61b9d2e46e90e305b9ffcf747ef49f141a5426f1a02629bc5dd603e08f3ff02f76b685d5cdbd40671e7a0aab1cefbe5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365122, "uuid": "88a75e64-4aff-438e-9ea8-14518112b569", "value": "T1F2C22A0473F48266D1EC47BE4833A200D375E68B5D53DB9F6EC495AD2A33BC98621BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365122, "uuid": "1147a061-62c2-4163-bb71-85fbc4a95863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365122, "uuid": "e078570e-0530-46fb-bd0c-43221da6e58c", "value": "384:34eMn+LbqY3zgetmQkLAMymrJhxUHqqbuUsJQxnCJf+BWfXW0/eu+:34nncb/3EtQk8MyCJhxaFbHBFBJu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766365122, "uuid": "5b60597a-de8f-43e1-8a6b-dd06df485121", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766365122, "uuid": "f26f565d-ff24-4ee2-a542-5b668cf4e898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365122, "uuid": "dc9be14a-2235-4019-a03a-277595a5985d", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c19de41-df91-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447585, "uuid": "ab05325c-59cc-4590-82b3-bf9ee5d4aa7f", "comment": "Malware payload (Mirai)", "value": "f28cc4b3d57dc769d941b592107b19c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447585, "uuid": "21139a7f-ca72-4b40-a2b3-5889551bb4a5", "comment": "Malware payload (Mirai)", "value": "132f1f1e3f1cd0fccce32d9e583e72085be07b68be1b4dc10528cb20708bc91e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447585, "uuid": "947d7305-ef18-4f3c-ab07-3d313d1d3e8d", "comment": "Malware payload (Mirai)", "value": "7cfb2f4f520dede42d0e362037b21329936104d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447585, "uuid": "14abb856-da63-46e1-9c47-373573b12f39", "comment": "Malware payload (Mirai)", "value": "3b1983e1281687712c1b9b621a7cea07a01e313cb0f25604aff2c33389f3f14a1b7e60cdae7d6b8f6e4a61a4bcc0f439", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447585, "uuid": "6cb204ac-17b0-4ae4-971b-f883361a5c8f", "value": "T1C9631257ABDC4FADECD916B807EA71DF12515021A4B341F80DE64C8A85AF9B120DBCCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447585, "uuid": "449dfcbc-88dc-4d32-9571-fd8ea2501bc5", "value": "1536:37MbwKNGjjH+Xq34n/q8Zu41zmX3sDgByerPk:37Mbp2L+Xqdfoz2suzrPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447585, "uuid": "5252b089-3b3a-4f96-86df-ccd7867137ed", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447585, "uuid": "1129765b-1ffe-4868-a2f9-4b95db33c183", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447585, "uuid": "a411e0d5-4b1e-406b-8f84-30a75d8c16bc", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233d65b8-def9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766382206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382206, "uuid": "792a74fe-44e8-4577-a48c-3a90fc059232", "comment": "Malware payload (Mirai)", "value": "51b8a253460a11eae834b12f59b1d0aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382206, "uuid": "c3df4d7a-8ed7-4d82-9188-d8d24d297ad8", "comment": "Malware payload (Mirai)", "value": "137180c258a5680c572d618115d269a02fd7e3f4d55e342b3db666bf68be7001", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382206, "uuid": "a803a8f0-862b-427a-a4e7-659238739895", "comment": "Malware payload (Mirai)", "value": "664189a00129a5d9ec4fa4800ecbc73a52753dea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382206, "uuid": "54c6c89e-be10-4a36-a211-c958199f86dd", "comment": "Malware payload (Mirai)", "value": "ca3a839eb8c00a28f77c2864ed002e0ce2211b7358b7ef7929a72a1153cfce7078c95ebdff92209f55c93ffcbb1d8fb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382206, "uuid": "1d13c1cd-5bc2-496a-b379-a664890d6e6e", "value": "T10DA3AF87E250FABEF4646D3F84038E19BB249F705A831B15B17AB4505A7A3C473A7E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382206, "uuid": "bb4d3ae5-a895-48bc-a925-77794603f142", "value": "1536:9Wj04W6vWOVZuGQskP8adn0nKHaBSJSiq0jjAsOsOiNp4ct8rSu:YjJ+OvuGQ3ddzS10pOivUSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382206, "uuid": "776ab14e-2b09-4fbf-b0f4-efc0321b7b3b", "value": 106968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382206, "uuid": "6bad1a26-018c-4593-a74d-90bac3144574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382206, "uuid": "48c6e7cf-5959-4530-bef0-4ef32bfa3b97", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260cbcee-df59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766423443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423443, "uuid": "530d10f2-b88d-4d4d-bd7d-5fea9a81c8af", "comment": "Malware payload", "value": "d0c96e87ee74d6d151e358c8f15b6b1b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423443, "uuid": "edfb0618-19f3-43c6-b0a7-eaa250d69ab4", "comment": "Malware payload", "value": "13a79243f5e9329746bf40985c6917ab5b1d8e30231e7984113bb8141499dba6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423443, "uuid": "6cd7d73e-9740-4f56-bd9d-773c479d97bf", "comment": "Malware payload", "value": "a0552d7daa10253ea9afacb74f3ec680197b9cda", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423443, "uuid": "5bf75d6b-bb23-4967-9070-53f4a7877175", "comment": "Malware payload", "value": "6b19d4a2f4301b5f9da14d26452552f330ec77608effbddc123e160c20ed11f97594779226fcc915016f54a946c7e154", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423443, "uuid": "c360a2eb-c15a-40c5-9ddb-01c9587456c7", "value": "T1895533732F917C9FE7D795D1F38A12287C6C2FA6CEEF9030957092C600644A651B99CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423443, "uuid": "db9ef88f-68d2-4713-8047-978ce9ebd290", "value": "24576:l6zDiVkgEq9zRhop3FN8LLP3I1sO7+I1FCD9ih4tp6/o4DtceqKlhd8FWVz:l6XiCgEq9zRhoJALfI1sO725u4z6tDxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423443, "uuid": "aaee32ff-97c5-469c-a3d0-3e4df4f45952", "value": 1292228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423443, "uuid": "928afe32-6239-4617-b435-cba40e20b1dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423443, "uuid": "e2ecb341-a2b9-4860-9e93-a77a49eb11b8", "value": "sp_DocAdjunto_943.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5371dce-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766424998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424998, "uuid": "b951f2ec-c9a2-4f3e-b93e-84f7d23c7f46", "comment": "Malware payload", "value": "060916b7ad4fa90f05f346bddbcf95c8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424998, "uuid": "aaa72397-e426-4076-8d55-d61e6c5c9572", "comment": "Malware payload", "value": "14105e30cded8ebd3419637448eedadb6f4cfc0f17407ce7c4ab508846922ec3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424998, "uuid": "d7f446d5-c0e2-4a8e-8c54-14378f00df76", "comment": "Malware payload", "value": "b155a6165e15b2c69825d8482cad9a74e34304d4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424998, "uuid": "044f6d3c-00fe-42a8-b9f7-4a85432972a4", "comment": "Malware payload", "value": "4bc1b768e6bad46960321431560a805fbfdd7d2195d79d55a93039fd851d58302211b9ac7c91305705186e7d26362b24", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424998, "uuid": "1b666a6b-2ae3-4893-a1ba-dd887e62ab09", "value": "T1298733EA868262E6ED3FD57ACCF13905C23EF27A05879D3FD4A4031609D8FC26A76505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424998, "uuid": "ed53f3f0-7aaa-45a8-8d32-8265815a2a13", "value": "786432:GcQlQRK8HIYLWTityYtNCi1QyoPfzgVGySV2tCDdHzWX2Tvxi4tRmO9rPa4Ks:GHlQhHGMtNn1LoMI2mdHzIovxZRt9rPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424998, "uuid": "5ee36ce0-7a1e-4e4e-906c-bf145543f6e5", "value": 37886274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424998, "uuid": "dff0d9e0-a09d-4afa-9ed6-ae5b7afcafd0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424998, "uuid": "a55b049d-c122-4388-9e36-a37d313b6cf0", "value": "New Version.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776b8798-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766446343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446343, "uuid": "5d02d4e5-d8e2-40c2-8640-9202ea4cf2d1", "comment": "Malware payload", "value": "e6ced23f8266e971d869ce95caa31629", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446343, "uuid": "0f221642-e0c5-4344-92f5-ac30d9e8abbb", "comment": "Malware payload", "value": "144a6923fbe217ff7d79e17a67bb322603626269241d00adad67c8135083e4ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446343, "uuid": "19ad74cf-401d-47dc-b521-1b1ad9a06360", "comment": "Malware payload", "value": "28f97c54c12faef245053a5209ad3a0601625925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446343, "uuid": "75bbbc18-27d6-46fd-82d3-eca36845e880", "comment": "Malware payload", "value": "66b0ce5ed0239754a8655f7bd41daf35c3aa726e84a49aaa75465b1084b182668bc5615b9fe5c96732f1bb5f8f6d9764", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446343, "uuid": "df22107c-1193-4177-aec1-df247118bd97", "value": "T13EE3530EAD215F3FF228C33547F78A61B36532D723E3E24AD25CD5241E6438A582BB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446343, "uuid": "f5820bed-4fa2-4db0-b982-c550376fcfbe", "value": "3072:uPcreCHVWHXKFXr/xqUEjMHAFZa88kV6iZaGPWgGGRvDQ:UcrLV+XKk1FgIhZ36kv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446343, "uuid": "264d78ee-8817-4a91-90fb-2b2e5d4a8056", "value": 145040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446343, "uuid": "31694059-5bee-4843-ba0d-827462e202c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446343, "uuid": "a1113e8b-4dab-4895-b345-abe0e976871c", "value": "SecuriteInfo.com.Linux.Mirai.9821.26946.20321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bea9fb-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397854, "uuid": "79d5fe5b-7b1d-45ed-8e0b-0ec8dd97241a", "comment": "Malware payload (Mirai)", "value": "9331b62ea79bafc3be868329068f7876", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397854, "uuid": "bdd5d101-071a-4ed6-b55d-d7d78522324f", "comment": "Malware payload (Mirai)", "value": "14c17e79b257baf12ce29e91084f5bdab9033d3e6df89228bb701639cdcabc52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397854, "uuid": "8d75a7ec-bd2b-4785-9225-384ccd0e2460", "comment": "Malware payload (Mirai)", "value": "e18f34e98cc33e9c35f0fd0cd037020310d08ef4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397854, "uuid": "55040e70-5a6f-450d-a91f-8a30312481e2", "comment": "Malware payload (Mirai)", "value": "45d6f185208a417072f452302915efe35c68d8ccdcca5d7e62304c6b27200de9255711001f8fc9593565c7cc2b723f14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397854, "uuid": "e61a7364-80a6-445b-8669-faef0db80111", "value": "T1DAA31985B841AA12C6C556BBFF4F428D7716579CE3EE3303CD195F60338B96B0E2A642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397854, "uuid": "dd295760-946c-4cfb-86c4-d8ec63b36732", "value": "3072:IHPnPtG11XV/QiOFb+C8Wk0S/Pa+9BCnVXnzR:IvnPtG1lVIiOFbn8Wk0oPa+9BoVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397854, "uuid": "5d3d3b05-974b-4f34-9ab2-ef54bb807ba6", "value": 105004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397854, "uuid": "9e2c0ce1-f9eb-4811-a74e-cbafac61f9f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397854, "uuid": "732e6526-258a-4337-b08c-7e8518655fd3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c0ab18-dece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766364098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364098, "uuid": "c8ff70e1-7018-42a4-bf3d-2e61705eee1c", "comment": "Malware payload (Mirai)", "value": "bc1639b9cf17150333caa443d2a0581c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364098, "uuid": "b2380c17-0802-4689-b1e9-df68dd4549dd", "comment": "Malware payload (Mirai)", "value": "150d3385013eb3f5cb651780e632d1bf3aff388acbaa091358a14da6d7f542da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364098, "uuid": "bff91a4b-add8-42e3-8cfb-a5c41ec80514", "comment": "Malware payload (Mirai)", "value": "af2bea457e99358cb55796ae71a3072f1b6e5fe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364098, "uuid": "71118bb9-319e-41e9-ba57-ea0215dc4777", "comment": "Malware payload (Mirai)", "value": "70a7e96dd14bd7ac542bfdf4ffe894f86349b65685baf671901102171429072a42dacdb95a7b6201ff8facffbb95e649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364098, "uuid": "c78ecf9b-d30a-449a-b8ff-ba5a0d0655e9", "value": "T11683E549BBA14EFBD85FCD3705BD4B45359C924722A83B7A3A70D418F24A14F4AD38B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364098, "uuid": "9b392db8-2961-4b1d-b007-440f663e52c3", "value": "1536:EAvOXLnBWipVnwdsd5YzRPJ+DZo79Dj3erB/T2bVRw:E9XlcvVerlT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766364098, "uuid": "c004e226-d552-49d7-8a12-67435e869a4f", "value": 80740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766364098, "uuid": "c2802d8a-6612-4b42-9cca-26589ed7bed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364098, "uuid": "ad743fb9-4e9b-41f6-9e44-e20b96d8a1d6", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244e5646-df59-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766423440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423440, "uuid": "df539fb2-8021-40ee-b52b-2af9f30833be", "comment": "Malware payload (Formbook)", "value": "616bfb81f56e3e0f08fbc311a7e15af9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423440, "uuid": "c49e7acd-da2b-466c-a10b-9d3e2769eb79", "comment": "Malware payload (Formbook)", "value": "153ccd5ab35884fa93c7c6536f593266ae81149be560be70d7a405b3a6f4ccdc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423440, "uuid": "cc2da228-1661-48a2-8967-f69683794239", "comment": "Malware payload (Formbook)", "value": "2f5fd9d3efe65e776349ae8d564b996752621bf3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423440, "uuid": "cb4e6d00-eed4-46f7-ad09-82d6cf4ecd42", "comment": "Malware payload (Formbook)", "value": "e1593fd7975b8fe184c357880b03979f9a6d5b6ee92a685616e49829faf3a59e9f4c2bc925f506071b5cb8989677c073", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423440, "uuid": "f8c15fd6-ff3e-4165-9d1d-74a4a89dfc6c", "value": "T1AF85338B69F3D38C394B8B7A2CA46E5049B43FAF72B02D8CDE4561784B97748847DD24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423440, "uuid": "08c3feb1-c3b2-4ed1-b610-bda4393e4e9e", "value": "49152:4hnm1l8i3xrdASnaUmTSNWANrfkbuDk07Tw956:481ZZdAS6TeNAbYk0Q9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423440, "uuid": "dd06d8f9-9259-4b01-980a-121402dce0ad", "value": 1711276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423440, "uuid": "a0216789-377c-4816-b5b2-66c335b2b322", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423440, "uuid": "554ab68d-75e5-484e-b8ba-14230a58167c", "value": "aod8qj.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6a0c28-dedf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766371374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371374, "uuid": "6548ede3-c486-4eb5-a642-6d41fef47bdb", "comment": "Malware payload (AsyncRAT)", "value": "8284e85fd05a4b32a3052537694bd41b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371374, "uuid": "d0ab5fee-6606-4b89-b653-b6773875f23f", "comment": "Malware payload (AsyncRAT)", "value": "15d69b417aee5eeb8d7602340d370785112d459e7d99f82c65c6e0f7da33cc51", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371374, "uuid": "fdb860ee-cc48-4853-9fda-a7fad9f428bc", "comment": "Malware payload (AsyncRAT)", "value": "6644b2340219bc3ef2c0daabe9deeebfc0a55ccf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371374, "uuid": "192a6294-d0f8-4a5e-b3e3-440556b33c2b", "comment": "Malware payload (AsyncRAT)", "value": "29e86827e37d78bb8608bf6d84a6e3f6884d3afa111e220e83f6579aa7cac5ccb4669997ceab3862b04b4f352c07ad9b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371374, "uuid": "868f0b8a-f0e9-4bf1-bf53-66d33d21bbb9", "value": "T173034901BBE4C277E7AC0B789473430846B4D9976613FB8A5CC854FB2A17BC997017DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371374, "uuid": "640879ad-2672-4c53-82dd-249101af0026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371374, "uuid": "ba568570-3c88-4e90-bbae-9160ffde6141", "value": "768:dXaug0LrCc4d7VtOjkR2e/XgNhRwguQdumXHUituoRnXUWu+:9afSuVtOyfgTRw5Q2Wu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766371374, "uuid": "118603d0-913e-4ea5-a0a7-16c916b9770b", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766371374, "uuid": "c992f910-3dcb-488b-bb4f-50f6b7c56389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371374, "uuid": "2d73f7ab-70b3-4d63-aaec-0cfe6ea50271", "value": "ksiketm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc546b0-df07-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766388213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388213, "uuid": "08bc8a7a-a9e5-407a-9b31-35b574c4391b", "comment": "Malware payload", "value": "6dc3e4d6cd3258fee1ab66ae83e6a00e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388213, "uuid": "41533782-09e7-45bd-b650-2c3805aa1c19", "comment": "Malware payload", "value": "15df77cf2b37b0cbed352caedd9bd71dc564f63a8e286f8ed9cfb3cb00070a03", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388213, "uuid": "468ae237-f6db-4221-8d13-7bd5fd867afc", "comment": "Malware payload", "value": "190aa97a3b5717d43a21688410e1897a9fbd3fc5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388213, "uuid": "50ae163d-eb97-4c7e-9a9d-da946b681458", "comment": "Malware payload", "value": "d4782dbf5eb7300a966658da192372293cf0e1dacb75f355f73e998904219e080fe06395d1ab5490fd6da461420f4e85", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388213, "uuid": "8c6a302b-62ff-4a23-b31a-a574ce130551", "value": "T1B5E502BB98F268536A904663E70F2C1A33AB19D53758D341EA41919C6F3B1D3CE92733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388213, "uuid": "610c8ae4-c426-4ca4-bc8b-596ef35ce9ef", "value": "49152:VOc2yD4lTPIIm/RvMYqyB4L0oK2JPBgGWburwTg9Bvr/5lNIl8fPcUJ5fosEt4Hr:VoyEFPIImZzq64TJprfU+L5lilUJ7Qvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388213, "uuid": "f25f2a76-f9c5-43ee-a404-124455dfa0a3", "value": 3032156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388213, "uuid": "c56962b8-1493-438f-b6d0-248e282b1d56", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388213, "uuid": "8ef63404-72fd-40aa-85e7-d9382f58853c", "value": "Invoicedetail_INJO202512210004054-OR.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6374566-df02-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766386426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386426, "uuid": "bb91af01-2476-4940-a7ab-d2b2532f3880", "comment": "Malware payload", "value": "1c5e648b77000a12d4c2ac19d57045b7", "object_relation": "md5", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386426, "uuid": "5ba38c44-649f-437e-8bce-74d7c1d0be7d", "comment": "Malware payload", "value": "160f3c4aaf73679194094d2f12dd287bb412d4a1353a760f33505e2bcfc72775", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386426, "uuid": "5d78fcbd-8e7e-4b71-a967-ad2dc0898f0f", "comment": "Malware payload", "value": "9dcfb99678120cf251e05f72e31d719bea1292e2", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386426, "uuid": "88fb9eb1-9f5c-4fb2-8c62-8fc3ae852379", "comment": "Malware payload", "value": "ed9291caae567f1a12a7b6aa12bbf248b75864577b9edbd2bb3729a8ab554cf213a2dac67a4c4a52a67f82c53cc79e63", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386426, "uuid": "ea4a3f13-4f6c-4c3c-ba26-0496065ccf38", "value": "T1CB52CEC7F3C45BE7E216B72722D66D2D970E17D8C0BB50883DDAD20B26ADC604219D97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386426, "uuid": "51f54b1f-df93-4b66-8ee2-195d21dc3882", "value": "384:a27AaUdoz2FtYomZI+s28P3YL63wpTTdge3RCCaQOCR:T7DUiz2FtxmZ9p8P3a3TTdgegQOCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766386426, "uuid": "e608fc0d-3d5b-411d-970e-c2af21c5d1e8", "value": 13597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766386426, "uuid": "16a1ecd7-c44a-4e80-87a9-daaa31b53da0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386426, "uuid": "976c766c-67d5-41aa-bec5-987cec41774b", "value": "xluhlq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c7e92b-dee7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766374632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766374632, "uuid": "19aa3c33-51e9-4b91-9c1c-7b42ec5ed1fb", "comment": "Malware payload (SalatStealer)", "value": "fa6b80f26fd78268bc9be7915afec52a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766374632, "uuid": "55ca7056-e3e3-438e-8948-d7bf4a067d82", "comment": "Malware payload (SalatStealer)", "value": "16e6b7df460a86b040cbebacd1d8a4fa5e521e9f0f03c2c3ffcc94ee19067b0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766374632, "uuid": "bfad6e35-1cf8-4e8f-bc43-31e003f4d229", "comment": "Malware payload (SalatStealer)", "value": "4cfb343f2d44d6cbb6927a659d8512f828049c7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766374632, "uuid": "b0422541-1f67-41f6-9bcd-ea6dc55f9e5b", "comment": "Malware payload (SalatStealer)", "value": "86399b27c52984e9fae59abea2f5049db745f7198c9b91c81e3e48165415f1c58f59024d82a733fa9c550ef3f6faf8c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766374632, "uuid": "9953001f-1fb0-47ba-9515-2ed77574f127", "value": "T10AC65A51FA8B54F6E9071831805BB23F63305E048B28DBDBFB547B6EFC77681186A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766374632, "uuid": "49188c3b-3b90-4f62-8ab4-b60f052a2dd6", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766374632, "uuid": "e9aa139b-9cec-4fab-a8ef-59a0972b7034", "value": "49152:AFK8mq/6EBxOBoI45zeQHzQs23EG/k1vu8gI11OnBOb/lmR9NQuTok4wYMb3JhYU:I5mwbx5J0FeflmpLRwwz9yJoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766374632, "uuid": "8dfd8696-ebe4-4908-80b5-9de31ad7fe8e", "value": 11657728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766374632, "uuid": "c7f4aecd-1f28-4501-9172-bb9f3f27a118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766374632, "uuid": "77c9221b-7e93-44e5-ab33-61cae97b9d76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a8883a-df04-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387126, "uuid": "4f721048-dc03-4778-928e-fba27db168bf", "comment": "Malware payload (Mirai)", "value": "2d16c7a9393690150053c65506c76ad9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387126, "uuid": "ec9e5f22-3c22-43cd-a36d-5d2c785ab7d1", "comment": "Malware payload (Mirai)", "value": "17d81812e7b630388fb61ca8f25ca799cbdf19f70f9e77dc734da837ecc80780", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387126, "uuid": "cc118e27-0088-43ed-83b3-976f60ab520f", "comment": "Malware payload (Mirai)", "value": "014f6f8919883ed2192e00f5e236ebae2ceb2de5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387126, "uuid": "7a2cfe0a-c4be-4361-b50f-47d4d1cdd7dc", "comment": "Malware payload (Mirai)", "value": "c02c8ca82e5f40421b8038afe0871e3fdca2f337733d72e3b8a8ba63f2e54a9ffa87be93be0c2644049fec14639be031", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387126, "uuid": "480c5951-1dee-49e6-8724-56dce9b36eb0", "value": "T19B513CC545860D341DA7EA17E7B7732C32A294D388FA7BA6D9F4BAE0124EC10F190B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387126, "uuid": "ea48dceb-35de-4d8f-8635-67e864efd179", "value": "48:v7747N7h7B6G7g5zP7xKW7HoU77H7o7U7fC3b7I9R7zcg78pV75SO7t+C7SfT7KW:v7747N7h7B6G7g5zP7xKW7HoU77H7o7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387126, "uuid": "a462e391-b4f7-49f3-94b2-f68a04a50329", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387126, "uuid": "1a475149-e605-4565-9cd5-a2c51f426736", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387126, "uuid": "6009a8d2-f249-4b4f-9a1b-9b1b25f62b75", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa4dd7b-df68-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766430116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430116, "uuid": "a39b04d1-0231-4d7c-a9a8-1a82e8f12d7b", "comment": "Malware payload (Mirai)", "value": "48e7cb8b33e1a1637ab186c3c0fab151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430116, "uuid": "7cb047df-6d1c-4c30-a3da-d056f2de812c", "comment": "Malware payload (Mirai)", "value": "1838f43fbd3fa65fa5c68fd654905b3eeac3d66c6ba1489b3d0359d87b368fb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430116, "uuid": "a59d7167-f92f-4689-bc12-08355eb303e2", "comment": "Malware payload (Mirai)", "value": "7577b3674e3b3677b909b7d777d581b0846d3897", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430116, "uuid": "a97aff45-0b37-4922-aa20-9df5a7c7f0ba", "comment": "Malware payload (Mirai)", "value": "76079bb8c570a344ed52983f1c20684b81d9b3381e03fe1ffd2ed5ac2f50eae822b07eb4cc2d6c8806d8509db3909f64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430116, "uuid": "104a56eb-7cb2-44db-979b-2eadbb354cbf", "value": "T123937C72CC393E28C19999B5F0B0DB79E753E951808B1FAAD162C37A9047D8DF8493B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430116, "uuid": "5697d6ce-bc91-410d-85b4-e984ff791263", "value": "1536:dBL8PAbH9z67Qv2bDh5GGSvqJnjs/WjCKNKFta+3ROLuQaknzF:vLkAbU7Ic957mqhjs/WjcFz3soknzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766430116, "uuid": "de8757a2-895f-4938-b622-8cf1e0771b89", "value": 91556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766430116, "uuid": "70a19b85-7935-4108-a828-eea13756838a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430116, "uuid": "75446d1e-db8f-483e-ac33-71b0103c4335", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b6844e-decb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766362621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362621, "uuid": "4b7bbcc4-0d02-46d5-ad38-b1c87d5b6ed9", "comment": "Malware payload (Mirai)", "value": "ea30c6bd3ed900942a3153b845b57cac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362621, "uuid": "18182757-e52a-460e-89db-ba29a678adca", "comment": "Malware payload (Mirai)", "value": "18b7b17079c872f5fec6948e370c4a959e2bd9602e819fa1d23953bb479a5d00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362621, "uuid": "8404198e-abee-47e6-acee-7067f3a84055", "comment": "Malware payload (Mirai)", "value": "b1d78743165155d89bff646546822c967a3b2269", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362621, "uuid": "38a9ecb8-4ea2-490f-9dd8-7d911c030fce", "comment": "Malware payload (Mirai)", "value": "ab96de20fea8e9214d3c4c70ceb4d6232e2f9fb87ae42d4f337b0a114f46c22b618adc4d04fe31088435e7a993d98839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362621, "uuid": "f80dfa92-556f-4766-bee1-faea7a6a7949", "value": "T1C5832986B881D622C6D5667BFB5E42DC332613A8D2EF7207DD25AF14378682F0D3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362621, "uuid": "438ce5da-c491-43df-b53c-b8999b0758dc", "value": "1536:6LwKjoi2P0PsX26e0G2c4AKKMSY0i6V6QgEEfMvqT2bVRw/:6LnsbOAAKKMSY+krXaqT2I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766362621, "uuid": "9525176c-3ddb-4762-bd23-dc3247826909", "value": 84696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766362621, "uuid": "f047e562-678e-4142-b31b-52ea22b0e4fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362621, "uuid": "89ca4563-f82f-4ad3-8b02-0867d7c55116", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97091c8f-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397862, "uuid": "e5aced9e-bb97-4ef9-bbb6-075cf8b837e1", "comment": "Malware payload (Mirai)", "value": "9478842ce5f7258207654f6bb10fcac1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397862, "uuid": "f6782608-1425-4982-8078-193cae4cbc4a", "comment": "Malware payload (Mirai)", "value": "19223629371f8a209a547a14bd7b2ee682356d288d04b3053e9749c986188d6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397862, "uuid": "d6fe8a3c-6435-47c1-8786-0264b30b28ba", "comment": "Malware payload (Mirai)", "value": "d1a072c3230ae6c767b2e528a6f10da8e9482cfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397862, "uuid": "68c661b8-c9f5-4fac-8a49-7f0f3c49fb81", "comment": "Malware payload (Mirai)", "value": "e1291e9ccf5ce8b2aef4af8792e6978f819584f5221791607359f9b0c0bd08dddcb0f41a8dfbb2bd4759db4a0f0acd6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397862, "uuid": "8eaa077c-bd4e-4993-aabd-ed88dee12520", "value": "T144A34B02B32C840BD6F71FF427BB63E1936AA79016B1E286360D93854575B729B05FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397862, "uuid": "ff8cd6c8-e8f2-4975-afe9-eed3daa5d587", "value": "1536:VC/4dg6peBQMiYETjhIGlorGoXZ56F/yXH45jCoPGR6Nl:gQdg6G/MKGe556ZPGR6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397862, "uuid": "4090c30b-f530-4f0f-97ee-f9ef4d82ac92", "value": 104840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397862, "uuid": "f865bd6c-740d-4a37-972d-facc5a348fba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397862, "uuid": "00d30515-2f34-406d-abf9-eee1ec7856b3", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd03609-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446303, "uuid": "a2dc47e0-de4d-44fe-8cac-306e143589a8", "comment": "Malware payload (Mirai)", "value": "56ff88569d7e254554b1e26774e1a76b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446303, "uuid": "5fd98291-2a9f-48c0-bff8-6235345115ef", "comment": "Malware payload (Mirai)", "value": "194711082f4415cf9ebcdd5c62d57e034af0a48fca408034b01b5c393d537947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446303, "uuid": "d9afbe82-738b-4901-a06f-56a2344085ca", "comment": "Malware payload (Mirai)", "value": "4dfb33d645e5d3466b89c3ae4632da4b65bcee1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446303, "uuid": "d59327d3-351d-430f-a77c-38761906072d", "comment": "Malware payload (Mirai)", "value": "6b6694e3a99c2cbf6f3e37b68e14eafed01444b91908728764ec86d6d659ceeea73cc801e85a96d056c8806ff244eef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446303, "uuid": "f916ac74-6a0b-4ab5-9097-52a99f891027", "value": "T1C15302512AECF836CAE2D5390B2841E78ADC59F498D2801F43CABDF44905D78AEDC9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446303, "uuid": "a3ddd1bd-7e34-44f2-aa4c-9c33b3dbfd9e", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/uVcAQ5:MaHJgMo8FwOA4zUFGUO3UhAVvQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446303, "uuid": "d8eb0cd8-79b0-45d5-bfc3-cabcb9f3dead", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446303, "uuid": "f7a21ae2-52f2-4400-bb71-108b2973f0ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446303, "uuid": "610b5554-bfce-40a2-8b0e-c166320cde6d", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6912c9b1-df85-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766442453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442453, "uuid": "f04bfaca-7d5c-4a61-92aa-fac569819091", "comment": "Malware payload (Stealc)", "value": "dfb71a28b1b4ec0a6da908de2501f5b7", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442453, "uuid": "594743ee-a92c-4e48-a3fc-4e504ae8e9b3", "comment": "Malware payload (Stealc)", "value": "194e781b99e5afcfcc5ed09c55c90b45e0d6e33b59c9bd687784094c555e2a72", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442453, "uuid": "f0563a3a-8e6b-48a0-8b18-aed162937c8e", "comment": "Malware payload (Stealc)", "value": "5ecb5c2890c4831cc008f0a7f6c6262e57aa481d", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442453, "uuid": "162873d0-cde1-4e6c-b93e-5f3318a04b5f", "comment": "Malware payload (Stealc)", "value": "b508944ba346b1aa6cf034a4b1217ab7b0ca51cf781532aae47bfa6954daad4655eeeb8864e053675106036541ff9faa", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442453, "uuid": "d1d38476-d65f-4bc3-9b39-5336386f7e06", "value": "T12FA65D93FED44765C5CFD33EE9A20285627074044F3121D76AA427654D3BBE82A3BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442453, "uuid": "d8d6d716-094b-40fc-8fb4-2b24c26d8113", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442453, "uuid": "56cb95f4-c9b5-4fa2-a6a6-682a129b418b", "value": "49152:8wIXWOOK+Qer5Hclz+s6/mSWdJJ+NxjCCdrGv0t3:8tZeac/UdiNxjCCgvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766442453, "uuid": "c0802a08-45de-4a45-887a-3758840116ce", "value": 9746568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766442453, "uuid": "ab203226-dce3-4efa-b643-2598f352f530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442453, "uuid": "1a3fef2f-fb29-496f-a7ad-a6d28bf7be5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8156697-df62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766427634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427634, "uuid": "dbedd8b2-2bdb-4f00-bd58-0e15f9c58b5d", "comment": "Malware payload (Mirai)", "value": "878b03b012983d34c8f7926135278192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427634, "uuid": "41efaec4-3345-4dbe-ba4a-0d55d489ec5f", "comment": "Malware payload (Mirai)", "value": "1952b61d66a299b49a10ca4d05c500e93e5135ebb429cb055cafe97e7bd67fc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427634, "uuid": "212a43bb-f1ee-48fd-b7c7-679eafd1b4c2", "comment": "Malware payload (Mirai)", "value": "8fd0266735b3be3cad8ec390a3a5d02b264d419f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427634, "uuid": "e77e6db7-a619-47d6-bae8-97bc9417f342", "comment": "Malware payload (Mirai)", "value": "10de239036e41d51eead94d4767407f09d53df5bd760fc2c23f99a53f3c5fa889910b88f2ec6b7d09bee24a4f25ed416", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427634, "uuid": "d206e52b-8c37-4c86-b69a-e53eb0ee8acd", "value": "T16CA35C03B58084FCC4C9C2B84EAEA119C932F56D2272B55F37D4BF263E5EE102B5B665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427634, "uuid": "e332c7e6-5081-4825-aa57-7c983dcfddff", "value": "1536:GUDlNkrpGwkYmttWS7jD1xsKrxo0enbPcfQSu64VNbIgCnEgC:Gz8Ym17jD1xsKrG0eb8QSmzbIVnEgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766427634, "uuid": "7b7b3bc5-82d1-4ce6-a696-1842c4e72c83", "value": 98688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766427634, "uuid": "f9c81874-050a-4b12-9adf-24a9e36ad16e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427634, "uuid": "d39af86c-9507-46b4-a27f-6968434b8767", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a12f52d-df0d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766390996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390996, "uuid": "024d1c55-734f-4319-ad74-f23e8b8fcaf5", "comment": "Malware payload (Mirai)", "value": "6694dadb21c4879fcd5f7c488a259e95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390996, "uuid": "c52a695e-91c8-444e-94c0-3bd2ca2316b5", "comment": "Malware payload (Mirai)", "value": "199380dcab2a4acf4d919972002884eff2d01a7e4f1b9228514bf187efef6ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390996, "uuid": "052c24c1-9255-4d43-9459-4ee71b69f897", "comment": "Malware payload (Mirai)", "value": "d5fb78bf44815812cf8b851565a849512c6ec1c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390996, "uuid": "8676f654-5826-4d35-8ad6-6bd184c92e44", "comment": "Malware payload (Mirai)", "value": "d2335998d35814dd516e794ffc2bd23396e9f3b74d6887d6803b7776a96faaa81ce59df81eb700148ce51fa5ea26c6dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390996, "uuid": "6174e3c9-6edd-4797-8606-37eb7cc7a253", "value": "T17B634935B97A2F27C0D1A47A20FB0B55B6E256CE26E4C61A7DB20E4FEF106006513EF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390996, "uuid": "d352166d-22c8-41b7-beff-30805e45ca6c", "value": "1536:ip5vuPu5ISwATH3ISxw+AkzW+kZF7KcTSJAQOKPL64:21hJW+W7t2JKKTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766390996, "uuid": "19ec1e48-7f6e-4f42-a816-667c5380a761", "value": 67248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766390996, "uuid": "6888a557-d536-4636-99bb-c3335a4a4bde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390996, "uuid": "f7ff87bf-a074-42c0-8e70-112fedc81a1f", "value": "frost.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a51d0e-df59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766423623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423623, "uuid": "84a9413c-8dbc-4051-81c1-d0d5253ae0b4", "comment": "Malware payload", "value": "2139f34c2a5a35607119d0b9eaa2fb4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423623, "uuid": "f12bc7ee-c187-4bc3-8ce9-a56a76a23f4b", "comment": "Malware payload", "value": "1a3a076196e07a9026c5bc490aac10c13ef2577aefc28e85c748763d49fd47a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423623, "uuid": "8b18d5ef-8342-4839-b968-0d5767708a55", "comment": "Malware payload", "value": "3e5d2204aad0011a1c0778b1ccefd147a47ba198", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423623, "uuid": "a07b3703-4bb0-4620-995b-7d428823e903", "comment": "Malware payload", "value": "5f0ff2ef95bdb5103711d385cc7431ce0140d325e00e46cfb4bb89f5d646f8075993ce06ec918f99ce9ea5f4b8a37ef8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423623, "uuid": "aee70fa3-0ba3-4986-a176-b8e6ac5b9162", "value": "T1C026D2CDDBB604518D061B72CF199C64AF225B8E0DDB5BBD363476CC5B209346EA38B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423623, "uuid": "31ca4bcf-ec8b-4788-b8f0-05f1523277ac", "value": "768:OpPCtPMZP+XGy5bV/+/tRPG9KuPM9Cd4g58Uj/nkwC266UVvxdFDsJ:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423623, "uuid": "4f09de21-78ad-4301-932e-a838e4bcfbd1", "value": 4566233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423623, "uuid": "fe6a21a4-882b-474b-b80b-fbd0ea371e0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423623, "uuid": "b6fb73d6-8158-4924-832c-b937dab86a23", "value": "Booking_Guest_List.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d8bb7c-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384685, "uuid": "4ac90b0d-fa28-4f33-9e81-41cb87748788", "comment": "Malware payload (Mirai)", "value": "2b836cc9de27bc2c4748b6db24f81397", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384685, "uuid": "0073e6a0-67a6-490e-80b5-5afb5b67aa6c", "comment": "Malware payload (Mirai)", "value": "1d1b6bdffdaa826ba2f409437e6c23d0eff0b1185223fb76ecb444abd27225e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384685, "uuid": "12ae04a6-b97d-4d89-b01c-63c70dae6433", "comment": "Malware payload (Mirai)", "value": "96f7817683dbd75f803eddd0f69718c484e6eb86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384685, "uuid": "a6317a18-a4ba-4ae7-b7b4-a979299b76af", "comment": "Malware payload (Mirai)", "value": "8a5525d755a153141d9239d3f9c5cfef77b96f660205b1282643c1b63bbe8d6145c9e9f6159cbf08702e5c8065b6f57a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384685, "uuid": "aca84b07-5459-4375-ad14-9cee2a40c2ec", "value": "T1F6331895B8819A16C2D413BBFB2E41CC372663B8E2DF3207DD216F14778A82F0E67655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384685, "uuid": "55155898-bf3f-4b85-b91d-c61396acfc1f", "value": "768:orESRTnFb/yeP87bWO1O7SRMTkLXeo9IZRTcSPvt5M/NPuBMLVDzx:tStnQbWFeRMQXvoRTcavt5MgBUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384685, "uuid": "964c6599-aea5-430e-944b-9f47e9c6a5cc", "value": 52948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384685, "uuid": "a4eb4279-900b-44ac-8ad0-a39e882aee6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384685, "uuid": "9a127bec-16b9-4bf4-ae1f-69dd02c9ec29", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac7ad8c-df90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447046, "uuid": "94727220-5b15-4ca3-9a06-cbd4cc3bc117", "comment": "Malware payload (Mirai)", "value": "23583b991481d342e4fdee3a969ec886", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447046, "uuid": "767465d0-9f75-4543-81d4-502d066e26b8", "comment": "Malware payload (Mirai)", "value": "1e53146545b3c903fc5ca0f5d7be95a2b241ca672f388a1e0aded9407d945768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447046, "uuid": "45d2161a-77b4-4ec0-914a-96b22a2c200f", "comment": "Malware payload (Mirai)", "value": "87f95c56a217f2ecee41a78d2ebeeeb94f505797", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447046, "uuid": "cba88c94-7aa6-4801-b799-0326e0d67485", "comment": "Malware payload (Mirai)", "value": "9cb58ecd3a98ae01daa5e8df11e14870c9b98f905e260f9f73bc629ef86919cc475e937d82f41850977bd92ed5dbc62f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447046, "uuid": "a7ae9cc7-8771-4e6d-9796-54630e7b614d", "value": "T1A7935B21B97A2E1BC0C4747B51F30B35F2F7274A21ACCA1A7D720E8DBF156102557ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447046, "uuid": "2e1ff9a1-28c5-4d26-a058-6f8c06e8a049", "value": "1536:I+X9xScBoZQfKekrtSZea2VWc7H1gn/XJC9UH1bNltP08zm7uhq:ZtI4ieNzEc/XJkUhm8zm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447046, "uuid": "abbe5819-8eac-4cad-b78d-d137fbe1371b", "value": 91340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447046, "uuid": "da6aa054-b6f4-4f6d-b755-363812f9efd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447046, "uuid": "7e5419fa-b7f7-47a6-bc61-8aa8e581e261", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7634113b-df8b-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766445052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445052, "uuid": "a111f3af-2379-4558-bfa4-e0f36d64f1b3", "comment": "Malware payload (QuasarRAT)", "value": "b80fc258bad22c296de39f25cec71370", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445052, "uuid": "1ae6cea4-f861-4001-838f-234e476408e3", "comment": "Malware payload (QuasarRAT)", "value": "1eae46bd4d829e8472160241290d4b3449f79c86d25f93df03bdb7babba1b407", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445052, "uuid": "9ddf0ebb-0cd7-4c94-8431-d7e192d80c8a", "comment": "Malware payload (QuasarRAT)", "value": "5c9449516095db89d753d806e3ec6a149eb03ec3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445052, "uuid": "dceea9c0-fac2-436b-a1d0-bd60cbf109d8", "comment": "Malware payload (QuasarRAT)", "value": "92a97518d199c8d581b1f6442c922e106fa88e878ea574d400c1e5fccd838df01339f3961e5374e547a14f2b8a6e9413", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445052, "uuid": "3b996293-0129-4136-87d0-12118a0e3a4a", "value": "T1ECC5238537FC1508E6BF9F702CB6666489BDB8B25E21EB6E05C4709C1931BD69C50F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445052, "uuid": "534e6764-9f8a-4fec-a814-6a9574db3e45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445052, "uuid": "4a61de36-8ee8-4410-910a-606a299872a2", "value": "49152:iJL+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcm6:eL+2upjBVGVl/lQrCSZ4183Dm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766445052, "uuid": "1d76c056-dd2a-494b-9f0c-0705854fc52c", "value": 2613248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766445052, "uuid": "3deaf5ad-a70e-4d26-a5aa-a4120ca4f3e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445052, "uuid": "44cab4f3-339f-494c-adb7-cfc8fa8ca3c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33bfd59-df54-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421639, "uuid": "fc8396db-1e78-4d40-ad2e-1a5d5c67ffd5", "comment": "Malware payload", "value": "95711725c9693e12f855b052d2bf974d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421639, "uuid": "0b150692-ee0e-4e5b-9152-0de8e4c757d4", "comment": "Malware payload", "value": "1ec387a244e0d28868d7ccee4398a601717f0609b648e74160eafd4fd7f2febe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421639, "uuid": "8410284a-9bf8-4453-a2b0-aab955fa23c5", "comment": "Malware payload", "value": "5c73fd6499a56044ff2eafc88396281fe1e35f30", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421639, "uuid": "253811e4-5a53-44c5-9123-198f680f39b8", "comment": "Malware payload", "value": "bf9c6f2f531b2920c29a112745bb8c3c5430e5418edec49ce752df98c9debde3704b978ab45bc85e3565a2b6f8a16caa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421639, "uuid": "53820d04-b7f4-4874-bb24-01121d1af291", "value": "T1D901D3CF10445E315DC845DC3AD354295C418AE319E4461D6EDE856359C6F1C7B5CE7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421639, "uuid": "644d8729-af55-4812-954d-00ea83a47ff6", "value": "24:/9ZOekRD3v6hLkRD3v6nRkRD3v6M5dM5nkRD3v6rOOkRD3v6rFkRD3vXw:FZTkR6kR6kRTI9kRskRikRTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421639, "uuid": "687afd95-be15-4300-add9-c40f64af873b", "value": 819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421639, "uuid": "2a4556af-fcd6-4c7b-94f8-2fadda4e0614", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421639, "uuid": "17351bf1-5613-444b-a03f-c9a1e12d24fe", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51f376b-df48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766416381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416381, "uuid": "3e6c46ba-7c51-4a9d-bcf3-b4aaf693599b", "comment": "Malware payload (Mirai)", "value": "4e352a106cccb8d3b65eace44fff9008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416381, "uuid": "bb3748d8-e22b-4251-817f-b9d84f8100fb", "comment": "Malware payload (Mirai)", "value": "1fc0b8915005e6ba6adc9e4d3deba1fcd5d1898c5200537e69fbcf0eb7bf2b4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416381, "uuid": "2222524b-938c-4163-a1d1-a86b8826f10b", "comment": "Malware payload (Mirai)", "value": "0e13d3af6e24ae915b18766bca2fadfc4778d544", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416381, "uuid": "79c8e67e-ac1c-4fab-9bc0-2523594efd38", "comment": "Malware payload (Mirai)", "value": "871a3f0921dc9be87d08eed917feeebff2a5540fb621da904120a5430838bec992b9468c2ae2ad17c3310dc6bc6f1dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416381, "uuid": "27833517-49d5-4530-8540-195a8d7eb337", "value": "T1FD334B59D787D8F0D94209B0102BFB76A632EC362170EDEBEB98F963BD71652900725C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416381, "uuid": "5716b6ae-7c01-4e49-8f84-5f264cab88b8", "value": "768:HM3VvMipqf1tVFK67vhH0uL8N2jxAYUSW06oS2dVx1exz1fonlUB2:Hmqf1tVh7v+9UOoSOGXfolY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766416381, "uuid": "8e9856f1-3310-49cc-9c3b-5333e8ae67d8", "value": 53956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766416381, "uuid": "df20c61e-445f-42f6-9cda-60e42b807e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416381, "uuid": "e1360781-53fe-4d86-b975-a08c5a05a669", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19dbaa08-df90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447045, "uuid": "383e3d70-1b1b-4301-8bcb-a3263d2ea0fe", "comment": "Malware payload (Mirai)", "value": "079bdb59381646b19d4f6ec7ff37cc8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447045, "uuid": "75823359-d6d2-486a-8c0c-9f5f6c575006", "comment": "Malware payload (Mirai)", "value": "203c418e5ef79e268ccc27f57c8c4a464132b72fe9d092d3464bcbf9dd6b23c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447045, "uuid": "e1b0a7d5-ded4-4604-a414-6e3325a91e80", "comment": "Malware payload (Mirai)", "value": "d86379f95c269f736896dccde4d6a8a9b8a0427a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447045, "uuid": "04886e57-78ef-45ac-b66f-4074c52a3f5a", "comment": "Malware payload (Mirai)", "value": "54bc60251894cfd555e071afc1144fa474514255e84773955fa0246360cb86cc3d177f0b58d2857699bf0b9d7b368963", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447045, "uuid": "1be9d510-a338-4154-8bc9-78652d4b9640", "value": "T17093C50AAE259F6DF36CC63547B78E30D74823D62BF1C645D26CEA014E6034D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447045, "uuid": "40641233-f96d-4b08-a32d-4f5dd979a5cd", "value": "1536:76lNj2+26u86RuiRho8VVI+rqEmPgiCePeeiYeee9JObR0K1B4LeTAbVRs/0:Sj/26gVVI+rqEmPg1OR5KLeTAE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447045, "uuid": "7a258815-4ebc-4ae8-88ed-2aec38f2cd90", "value": 97080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447045, "uuid": "14606189-4a55-4fd4-9edd-2d3399cf1214", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447045, "uuid": "3fb2aa57-5db3-4d0f-81d2-e71c302e7642", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afeec7c-df5d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766425196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425196, "uuid": "a406ce6e-2514-48f3-b376-41b19a772038", "comment": "Malware payload (Mirai)", "value": "7cb5279a9e43eeea4fa27ade0d19c73e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425196, "uuid": "2e14ea89-6cef-44a3-89d5-5a9914718449", "comment": "Malware payload (Mirai)", "value": "20733269ccae61113b68f468d8bf9a828457ef4127372ca9ec64717f09e3823f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425196, "uuid": "112c4059-dd89-4c13-85c1-a2c5ad5d2004", "comment": "Malware payload (Mirai)", "value": "84afd5fec5b74456e4be010c570da3ad3ce43d9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425196, "uuid": "0f8320cf-2d2d-4c51-8848-623bc343ae28", "comment": "Malware payload (Mirai)", "value": "9bddd690a5647dd49d902ccb5746d3ee1d2395a2fed169e2112d4b77be117da79f8e14003f527cb146ce8ecd9b0484bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766425196, "uuid": "3c4c11da-bcae-4a0c-a7ab-b9e0cb1a025d", "value": "T1805302924522337BF47C60FDB770959086C95CB09E65A29B77DC219B3270F89B12D0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766425196, "uuid": "a00219fd-4339-436b-8cb9-eec87e64ffab", "value": "1536:87S1symLz4ab7sU4Gpk+x5cpzT2M2h5cBELaQAQH:8W63jsFhzKME5AuarQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766425196, "uuid": "32b68a94-bc85-416e-bf91-515475c7c2da", "value": 60676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766425196, "uuid": "232c18b6-3037-4ed8-9340-608c078e388c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766425196, "uuid": "aca04e6f-49a7-4e0a-b960-1303debdc6e5", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dc6a0c-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424858, "uuid": "2bd5ce43-3c17-4343-bc9f-1d6406be6cb7", "comment": "Malware payload (Mirai)", "value": "56b984af87159ea540f3b165e19c3c22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424858, "uuid": "b66041a7-48f3-43f4-ac22-3e500453fe26", "comment": "Malware payload (Mirai)", "value": "20af1c259839712a6c2d243b4040bf8780f3de41adaff0a4327858055caeb4ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424858, "uuid": "095db89b-da29-4294-ba94-6509f47480ae", "comment": "Malware payload (Mirai)", "value": "1c3791df9ea5e72fc0ab618e848b1349aa504173", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424858, "uuid": "ea97d7b7-f105-472e-a6a3-ec9cf300b8d3", "comment": "Malware payload (Mirai)", "value": "d6358d02822efdc9b82d0972690c085bdbb77c78087cbcca499d7794dec17f17c0fc2dcd6a75ca7063b72b79024fa16e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424858, "uuid": "4774e75b-6ebf-489e-b97e-6a60add4e107", "value": "T123D33A17B6D1D0FDC8D9C1B44FAEE13ADA32B52D1134B25F2BC4AA232E59E205F6D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424858, "uuid": "35335948-a765-4eeb-ab43-7d9daee7fcd2", "value": "3072:uny+b833R7w3hgCVcvex+4i9H+3Y49ZTaTdS:uny+433mq+zag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424858, "uuid": "483df272-2711-44d4-9881-ec04504b3a1b", "value": 138920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424858, "uuid": "d5962f9a-b8f6-4e45-a293-1f677379975a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424858, "uuid": "52da7cca-27d8-485e-a09c-5e0ace255732", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55a393e-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384679, "uuid": "de548ba5-d318-46ad-9ffc-08f2e958d3cd", "comment": "Malware payload (Mirai)", "value": "bfcc65ed3699e3961921ef6de33c884c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384679, "uuid": "702e9ebb-3d06-42c5-8b3d-4766b0c5cf88", "comment": "Malware payload (Mirai)", "value": "2293262893fa3122583ca09e128fea53947932cc3e33a444ec787320d9d19ef6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384679, "uuid": "14b32eda-d21b-4d22-a05e-280cabb44263", "comment": "Malware payload (Mirai)", "value": "68570527d9dc079d2266b236503adb67a254741b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384679, "uuid": "2f9d79e4-79d4-444f-909b-fca395026af6", "comment": "Malware payload (Mirai)", "value": "8671bc787d79708b2f91ed2529e99262b6975cf6de44065407685a9143ca046a61bca5cfb2c4c8b22c3d8325405a4931", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384679, "uuid": "aa65fa2d-778f-496b-9e8c-24e2393fc4ba", "value": "T1BEB3E048B714EF4AC02123FCB1C50940E7A2ADB94B92520B9863F9B4397DCD97F0AED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384679, "uuid": "521d894f-7f11-47cb-af3d-c8ba1870125e", "value": "1536:axsOifZ9VuVtRYwqM0WGx9KQtU06q+yUSivh75/epXlZEsIPIC6ppWpRwgF9uZrc:sY9VuVtN0WGp6q+Nh75Gz5IPh6WTwuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384679, "uuid": "0e33b5aa-f681-4557-9365-5992373dd57f", "value": 107768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384679, "uuid": "01242789-36aa-4498-81fb-70a815c9d250", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384679, "uuid": "93af51ae-57fd-4734-85cb-5b6e333c5f3a", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dbb2b6-df90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766447043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447043, "uuid": "034248de-a9dd-46ae-905a-5396e03795ae", "comment": "Malware payload", "value": "f141fd20fb19aee4e0254cf4e842ca85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447043, "uuid": "bf0b2b6a-868c-4d20-bfd1-aaa81f106e6f", "comment": "Malware payload", "value": "239fca0dad6186371a16ddf5413f364753154ef451d7d927f21a7b0f457a9dd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447043, "uuid": "f6e4c03b-8c78-4fc6-9c80-f7af52226e95", "comment": "Malware payload", "value": "4d521a892d4f0f08c2d18155d7293deccd94e76c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447043, "uuid": "0c7d57a4-533a-4f50-a442-f22dab4f937b", "comment": "Malware payload", "value": "d7a9c21983c4d20aa1a7ebf086ad52c3f282578863dabbc94c82dcae0976327b54c42a8e18ce9f1362c47f9dda300501", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447043, "uuid": "e9c6a21d-6180-454c-90b7-bc9a5a61031d", "value": "T1D6D3BFDB734B1911C42202F00BD79F9E3F6361128E4BD9FB2D0EA67A28755DB194A7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447043, "uuid": "ed7efeb4-b62b-443f-9ba2-d8cf6df940dc", "value": "3072:IyVrq+O0TzfTQ5l6Ov9JnfJdQOgsnfqM:IyVrI0vm1vTnZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447043, "uuid": "fdb7b15f-330c-406b-b31e-2309c76f8507", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447043, "uuid": "7f0749e8-1623-4f54-b075-00b7f0a550fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447043, "uuid": "34fc02b8-15d4-4186-b516-2bbdceeafdc2", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095ce149-df03-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766386458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386458, "uuid": "3ce91865-debe-4196-b485-ce5a497204d2", "comment": "Malware payload (Mirai)", "value": "3c1f4317a77f2e1ce65fde5dffdc1211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386458, "uuid": "e4e6eede-a554-4d38-a0c7-81f56cb094d8", "comment": "Malware payload (Mirai)", "value": "26a9a9cad2af0557549ff09f68d2d5f7d12629e5485bf0d4ed56fc9651e7300a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386458, "uuid": "5a3f118b-51dc-46e0-9fce-a58eba618f1d", "comment": "Malware payload (Mirai)", "value": "cab1fa0534c86064da9c7484159ab6945a89a5a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386458, "uuid": "45826f47-87e4-4795-8813-0339169fcc7d", "comment": "Malware payload (Mirai)", "value": "dd790831c3fc1937881e8d86bc1a31d91546b4f448b1d4e41fb8d3b7e027d43f2fa08735a4fe41c531fc71d09b9ed885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386458, "uuid": "a1341328-d95d-434e-b6ad-4ff9a3f61d5e", "value": "T1C3D35B46FA814F13C0D6177ABAEF42493322A7A4A3DB730699245FB43FC665F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386458, "uuid": "e53ecb06-4ff2-49e8-822d-50c713f38d6d", "value": "3072:2AxgMSZie41EJIMBsUWQcZ72c7Yrgrbf9ct2J3zM/9nm9I:2AxgMSZie41Me1QO72ckErbyt2JDM/9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766386458, "uuid": "a6f99297-1a3a-445d-8b84-ef3a8882878e", "value": 141436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766386458, "uuid": "85384fb2-e267-4b24-9c59-198d8a7839d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386458, "uuid": "fb89bec0-890a-4bcd-8214-23d740be6325", "value": "frost.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356db64c-df79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766437212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437212, "uuid": "c4bb22ae-10ab-4dfb-a673-5d385a7a3a3d", "comment": "Malware payload (Mirai)", "value": "c0e3dae7a33946053c447602fe1d809d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437212, "uuid": "93ad2449-026f-4529-af48-d09defda6e77", "comment": "Malware payload (Mirai)", "value": "27c16c5bedc5f0d24edad558ccc1c1d09f4b00073dbbf62dbfcb8a20ec6a3689", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437212, "uuid": "e04f204d-227a-4799-a67e-6bb14b2eb047", "comment": "Malware payload (Mirai)", "value": "fc87cfc4eed47cf5b54e9790289099b2576b5a40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437212, "uuid": "e8fe918a-1ba2-4243-94be-43532bb70c64", "comment": "Malware payload (Mirai)", "value": "6bf2fdd024f0a1511fc3f2f3d94f78a8a4d2ab1b96154cd1d88afb9e060d3ad436b2bfa5d03d2bba393a15a5840f55e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437212, "uuid": "931e724d-9343-4a26-a068-8d60228d86c1", "value": "T17FB36D02B31C480BD6F71FF027BB53E1A36AA79117B1E282360997455176B729E09FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437212, "uuid": "2074e5a5-b669-4b9a-b902-9b6152a72c51", "value": "1536:fT3lY3dIaV7DESEU2QGrzpCoPF5XjlPKwDpmHBvlJQf3xlxnWVFyvC:b38d1nESuLnpNPRpFmHU3AVFy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766437212, "uuid": "8e89d926-bcba-4f6c-bfa7-263dd5177c06", "value": 108040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766437212, "uuid": "f51c6aa8-ba44-472e-a556-ea7691e032b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437212, "uuid": "80424fe0-817c-465a-9858-9c3fc4fd1d78", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea3d9f5-df28-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766402358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766402358, "uuid": "6e4cf4f9-46cc-42ac-8110-0f712afa792c", "comment": "Malware payload", "value": "8f64a468fb4940fa9efe57e342964b3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766402358, "uuid": "511bd939-033c-4d57-8e6c-0a5427f2ccd7", "comment": "Malware payload", "value": "27f8ee5c936e6356bd575bddc9dc5dac88f6d14004feccc9622da2862862b23f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766402358, "uuid": "ad282df5-d925-4d14-9149-8cb01baf3cf7", "comment": "Malware payload", "value": "d623d06e6e356061b5f7cbfd014f090f6cad086b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766402358, "uuid": "92b0f460-9ef3-4548-9665-2374a97af7fd", "comment": "Malware payload", "value": "afe84806c7edd4762730ef6aa8aaf689af8a331968ee6b999722219bdd229916918700651564ffa95f6c9551dba4086f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766402358, "uuid": "42b2c825-0cc8-422d-87a0-8eb40340d6c0", "value": "T18755124163E49453F4B3477548F287A35A32FCA45F30879F6A90B06E9EB3781AE31762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766402358, "uuid": "63fc98c0-0245-482b-9596-0c309069b821", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766402358, "uuid": "d4c88d1e-38be-4402-8bd4-2ee78a5398ca", "value": "24576:Sqi/IVPLAJxjv4en2GYpHXx2K8F2M1SDERxfDpaiN:9vCD4U2ZpHB2hEWjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766402358, "uuid": "5c819eaa-7e17-4f16-8b4d-827269827b3d", "value": 1394176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766402358, "uuid": "fc3de671-4854-4cbc-bb1f-10d583296fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766402358, "uuid": "8a2e0b42-aebb-4ef4-bc2f-07e23c68224d", "value": "Setup_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a97d78-df37-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766409138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409138, "uuid": "c9502cd5-d80d-474b-8fa5-1e0b3721a26e", "comment": "Malware payload (Mirai)", "value": "5507897e8889ec272dc3e798893f9ca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409138, "uuid": "f2007dc5-ea23-499d-94f4-490fb89a2ad5", "comment": "Malware payload (Mirai)", "value": "29326a9155e6a64ea787cd576899acddd87553767cd4c4ccc4c8de15c8fef0a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409138, "uuid": "2fd9b40b-08b9-4702-b0b0-d40644236402", "comment": "Malware payload (Mirai)", "value": "346850cf7c3c710b6a7b291e6724838d4b74478b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409138, "uuid": "2cc64ff8-a2e7-46af-9bf4-d35062a6cb4e", "comment": "Malware payload (Mirai)", "value": "d89e8f4dc05c3d5c4634c2f4e7f3795a9f458d0f0b4988779a8e181d5542e8c721c9e10fc19ea1b147a80c7a24f4abe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766409138, "uuid": "75a5bcfa-459b-4a21-a3cf-cfed6fc9e921", "value": "T1F583C60EAE258FBCFB69C33547B78E25964833C727E1D142E16CD6111E6024F642BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766409138, "uuid": "2e639529-1d2e-4d52-973b-366d5576c46d", "value": "1536:GPQXeit1xZ8JYgSV15UaNXhRNEHI/llT6mF2HGKGTlZ6kKx6LO0:8azwzSV15UaLp/jnT6txz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766409138, "uuid": "6ccd301c-6305-4a5a-8ca4-05c707a5fbcb", "value": 84756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766409138, "uuid": "4f745c59-f020-4a14-9c0e-86b41003da7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766409138, "uuid": "d6d8f699-c30f-41d0-a83c-a611a278f868", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d269d19e-df2e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766405264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405264, "uuid": "294a8293-d860-43e5-994d-5923bb2d89c4", "comment": "Malware payload", "value": "0132abd6995ddb715670fa54e69e8a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405264, "uuid": "9b479e4a-5e82-4a01-b763-96df8baab7c4", "comment": "Malware payload", "value": "295e472355f314720d5b9fd6f7f279837e4b22c5164c1d4feb1e7c5951378526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405264, "uuid": "62ec7b2f-e228-4809-bb0a-abd9a405944c", "comment": "Malware payload", "value": "75086ef73c6b0f6f0f6cb8d81f3d3ab2e1e0f26a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405264, "uuid": "e2f75f72-4bea-4d25-9b55-766d3b86d9b9", "comment": "Malware payload", "value": "5b7d6e091089320758e0abe328eeb3faf081dd85689f967946fb9ca18ebebafae2ff7f9342b2f85e142a04545ef0508c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405264, "uuid": "a8ee6249-7182-45e0-87d6-2100ac3a6aba", "value": "T165187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405264, "uuid": "2fd35822-8cfb-4fb5-ae68-3631f98b73ed", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405264, "uuid": "8fdf0668-9ce3-46fe-924b-540838be9119", "value": "786432:fAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:fAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766405264, "uuid": "9abe7ff4-6091-47d6-b4d7-dbcb6f642308", "value": 90451968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766405264, "uuid": "a1ae876f-4f27-4426-b20f-e6e1634e3d34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405264, "uuid": "6cf243f4-c7e8-4467-a501-9fec65a2e121", "value": "DrinkLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e486abf-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446300, "uuid": "9788fddd-10ce-4843-9b13-6e0fc1d505b6", "comment": "Malware payload (Mirai)", "value": "1ae737bd0f12956d4d38d448e5a0680b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446300, "uuid": "27c2fb8b-5b49-409c-94ac-583599490f72", "comment": "Malware payload (Mirai)", "value": "2aae78298e85c52bc9ab0000df4f455fa1da17eebcc1767e7c90a38e246be733", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446300, "uuid": "76d938a5-3738-4599-876d-ac9625ba8a39", "comment": "Malware payload (Mirai)", "value": "ff956f8d579c8db785e366baef307e44ebd0c382", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446300, "uuid": "bbc1ff55-1a3b-41bc-8615-442c6ffa567b", "comment": "Malware payload (Mirai)", "value": "04af5a85d07f1f285b7366675a6b1088a4c45bcafd28ec306cd4c5de7d38767f856f6e485e9cb5a39cfef02f58cfc344", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446300, "uuid": "034c1360-5cd1-4fa2-84fa-86f2a70a1c74", "value": "T1E3639D3AD86A9D94C94C52B5B8B1CB391713600087A22FF799DACA714043DACF69C7FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446300, "uuid": "303a6f55-c05f-4e48-bd82-922b085386a6", "value": "1536:XrSJsob2DG2T1JIUwKjUE0mjCgI8mdMTAbVRy:XRoaikQRE0mjR/QMTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446300, "uuid": "2296d6e5-309d-4516-a79e-aeb3285ff08b", "value": 67836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446300, "uuid": "7916fc29-7333-4cea-9f9d-a8d747087b3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446300, "uuid": "80c460bf-5e58-4c5f-a95e-aa568e1e9e36", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2cadd2-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384688, "uuid": "42962d91-483c-463a-9081-0af558cf8dc2", "comment": "Malware payload (Mirai)", "value": "17322677fe36585b7acd6a43f55bfbb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384688, "uuid": "bcf8f465-1d58-4179-a5c8-d449ae4717aa", "comment": "Malware payload (Mirai)", "value": "2affe0941dc897d5e66ada91e56e393592cb3280f73ac80512e793b598235446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384688, "uuid": "f9ff04e4-b9fa-432f-9ef6-7a8414a444cf", "comment": "Malware payload (Mirai)", "value": "c0c5a9c6e48a60820e31dba5858b99777d9fe480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384688, "uuid": "5abedb6f-dec2-4ba2-947d-06559f126da0", "comment": "Malware payload (Mirai)", "value": "25192ab37f956f884d78f7bc7eb2644e2a9c62df13c373ad0a520ffd3087aca9bc0a89696faca68532baf81b8d0ba59c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384688, "uuid": "12308287-47c4-4f74-bc0e-7d73610cbefc", "value": "T1F7334A0272280947E4675EB0653F1BE093BFF99021F4F688690FDB5A8276E371186F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384688, "uuid": "505a024f-2bad-46aa-82fe-031083372a03", "value": "768:1Wqr0OhKRFH3p6NaJuEbiUCbOHiOhVVZDS+0n+WCD:3rDgJ6kJ3b/CbOH/PZDS+0+WU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384688, "uuid": "5a92837b-0221-46f8-b3ae-5b37c15f1faa", "value": 51024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384688, "uuid": "0d4d0f0d-590b-4adb-92ce-8fbea8d654c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384688, "uuid": "c0c3846c-db90-4339-a5b8-e2b783f884fb", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b06674a-defa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766382756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382756, "uuid": "7a0f364e-66ab-48cd-8b8a-6a62fe2da60d", "comment": "Malware payload (Mirai)", "value": "798a5cbfefa1aa728c7844e133d2f15f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382756, "uuid": "2dd6d337-cfdb-4369-a5d3-b6dd2713c9ec", "comment": "Malware payload (Mirai)", "value": "2bdb5c71ddc686e9387663a1d114aa12f8c9f5466a47b3da0e9050c6694cd6c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382756, "uuid": "4a2ff0f5-38f7-49be-b715-5d79a7251977", "comment": "Malware payload (Mirai)", "value": "a774156c326feaa8596e523b2a3fe801db14af75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382756, "uuid": "543c46bf-a803-41b9-9f77-19b0fc08e672", "comment": "Malware payload (Mirai)", "value": "2c2df612b0d0ef26a0a2afc97614c5d6a2b402878a25267d8933279264b0a313cc21da11a261176d01bc32797cfaf2fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382756, "uuid": "d874f6a4-3c1a-411b-9955-b0e4ae914f01", "value": "T1D0D2E03E968A0B07D687C0F82C279A1B9C5FFD83095F6DAF5E24940156F74D0A57C426", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382756, "uuid": "4356bdc4-226d-4852-91df-ba11a5dd3cb8", "value": "768:8hAP7JIINnYOEzJgMoojSy6lp3h/e3RZ+dImO+J1sN:FNHNY30oOZhhmhcdWcqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382756, "uuid": "49f19bb6-d491-4b08-9c30-292531e62918", "value": 29248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382756, "uuid": "8d0da2d2-fc69-4a03-b643-2511f72d1e8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382756, "uuid": "8ed4a0e0-728a-4eed-a3f8-d527aae22b57", "value": "frost.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a02fa4e-df30-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766405894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405894, "uuid": "5371cb9f-1d37-4245-8646-d1ff11e70f83", "comment": "Malware payload", "value": "e98a8ec9853aa4fcff2d527014766ca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405894, "uuid": "adb0df51-7cb8-49ec-9599-485f9508c473", "comment": "Malware payload", "value": "2c1fe7d8fdb1bfe86cb3314a7c8460a1c9340736890a8b43e8b5797af664c905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405894, "uuid": "5862e9cd-554a-4dc7-906e-fa6ee3b9b859", "comment": "Malware payload", "value": "2719b779201a5878e5d7a01462eb5b7a9688a438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766405894, "uuid": "fb62ea1d-297b-4f21-8853-b867d9ba52ac", "comment": "Malware payload", "value": "86218117c5921c785631da020cba75ef7245460a908897d7e0e583c5cc7aae0be00bd8aaf3c3c26e20adc7e83c390887", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405894, "uuid": "d36c884d-041b-431b-9e65-2c06d83c6a5a", "value": "T1C1187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405894, "uuid": "05d0fd40-1f0a-4220-b7ab-28c359135f57", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405894, "uuid": "80cdac67-55e2-4300-8787-512532fe3ae1", "value": "786432:aAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:aAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766405894, "uuid": "3b9246c8-0034-4d42-9d59-0cf98f09b548", "value": 90423296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766405894, "uuid": "4239bef9-94ec-44ba-834f-bac8f1dcd4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766405894, "uuid": "e1d15cba-dbc4-432a-80dd-c6caa659860b", "value": "lnstalIer-86x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51cc57e-df23-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766400597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400597, "uuid": "f8ddb3df-5470-4663-97a8-9e861f09818b", "comment": "Malware payload", "value": "55b887df6e241df407c16a40a632cfd3", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400597, "uuid": "4d83fb58-a2a8-42dd-a2fe-2a8e807da04a", "comment": "Malware payload", "value": "2c5f5a977d1ac39ddbab31e76c114fb2a980e821379a7bbaebd721bd7acb662d", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400597, "uuid": "3c325fe3-f268-45ce-a637-65e94781a803", "comment": "Malware payload", "value": "945bd415520a04e71cda64f20fb8303b20a6aed2", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400597, "uuid": "0e470e9c-c9a7-4a45-89d5-f2b067887140", "comment": "Malware payload", "value": "0821fdf2aa6effd4491c5cb8fdd76c2083ba2d67f6493939f785b78284705e1ab166af652236f3a847edcb716b07dd7c", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400597, "uuid": "1283fcde-85ef-4ed0-b948-7674bdaa5447", "value": "T18965229893EA5745F2FF6EB43929505196B0BA16DC13D75EA3C020CD0EB3B05E636E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400597, "uuid": "dcad4cd8-1916-4d03-b227-24ab020c2d19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400597, "uuid": "52ecc006-fd75-467a-8d12-5a4ffc498783", "value": "24576:3+JEfJhZ8j53sY1jCeqm6qv80MaooQajSMpHYWOkEfW5EQJZrUVvsgMYHQgdUU2E:3+a5csqCeq08moPajSQY5HYryHACWRLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766400597, "uuid": "e4367726-c0c3-4bd4-a82d-a9acfe8d397c", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766400597, "uuid": "a4b0f6b6-73de-4928-a000-9fdbc0d97b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400597, "uuid": "a1b4c71c-ccbe-4890-b478-dbf838334828", "value": "svchost1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cead544-deca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766362009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362009, "uuid": "7d6d25f4-1543-487c-87e6-4464c352cd6e", "comment": "Malware payload (Mirai)", "value": "ff0b3257b4d92a8e34d0c780a02d4195", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362009, "uuid": "49ce64b9-0ff5-4766-883c-fd5e1d9baf25", "comment": "Malware payload (Mirai)", "value": "2c8be1e45c9010a07bafc3eeee379c5ab224aba447c15d94c713c455488fc577", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362009, "uuid": "67b57fd4-7c2d-4411-b639-ee6a09111271", "comment": "Malware payload (Mirai)", "value": "4b60e847bdf1038cf82093a72c467aff23fceefe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362009, "uuid": "3ac3febc-6fdc-4f5b-beba-114f0cad45d7", "comment": "Malware payload (Mirai)", "value": "56931c56bdb4e31ab4252db39c87b2815ee68b7e611a9bf2768ae836b386c25e76e0c7781546c5b76344d7a27459e332", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362009, "uuid": "4426d0b9-1750-4056-91eb-4adedf005216", "value": "T142219BFE8FA1103A44E9897068654C24D80C9DF16C48CA98B95F0BBB7B8CA25FE15B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362009, "uuid": "2f9730c6-e408-4760-a363-153b212e801d", "value": "24:DfIkXI8mDNIiIItKKII8lISfIdv7jIvls7gIsOb0WJI0fn4747InNs:DfIkXID9IItRIRlISfIdv7jIvlHIZ0Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766362009, "uuid": "e363f9da-d0f3-4593-810b-1d94af9e44e3", "value": 1122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766362009, "uuid": "7fa9af9d-5a90-48e4-8970-fa69b4b654be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362009, "uuid": "cbf25109-3232-401b-8f07-f607760c44ca", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391afe88-df79-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766437219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437219, "uuid": "06fc2a0f-e156-4c9e-b5fd-a0ef5c27d499", "comment": "Malware payload (CoinMiner)", "value": "7295b0110485fa71a438f9b85644f265", "object_relation": "md5", "Tag": [ { "name": "84c97c", "colour": "#5E893E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437219, "uuid": "9dea0c71-d8cb-4710-b984-0aa070338426", "comment": "Malware payload (CoinMiner)", "value": "2c9ba03205c9b5ad58804afe5b267f17e23d99585a62cb392fb99140175f8873", "object_relation": "sha256", "Tag": [ { "name": "84c97c", "colour": "#5E893E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437219, "uuid": "6e2b78ea-5252-49b2-b40b-971a375599fe", "comment": "Malware payload (CoinMiner)", "value": "103ea92bd9a3cd07f61fd99aca5b86640bfc0ae1", "object_relation": "sha1", "Tag": [ { "name": "84c97c", "colour": "#5E893E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437219, "uuid": "30b0b5b5-18ea-4977-8c5a-e0dc5c15d3c5", "comment": "Malware payload (CoinMiner)", "value": "20155a45e7853ba35076411e0cbd213976b947e815d749364d5603d01f6b88c595dc0fab6393f2b19db72b48d552e22c", "object_relation": "sha3-384", "Tag": [ { "name": "84c97c", "colour": "#5E893E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437219, "uuid": "ed3d9418-82f9-4e32-ae66-e9a7aa96e8d3", "value": "T17FE5CE15E39905A8D477E638CA5D9332D6717C467732928F0A98E70A1F339E09B7B332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437219, "uuid": "ae7b2228-551f-44c9-891c-519b0f3fdd7a", "value": "e97b5304d9e8717fe2653a0c81db501c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437219, "uuid": "e936859d-01b6-4e2d-8c81-27befc558c5d", "value": "49152:/FRyPmIpJttgw6dOijNDRZ4syFYNM4AogvxPJa6P9muaZ1F1kWsTSu:/FwMdvZ4pMAogdJaK8xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766437219, "uuid": "31096dca-aa86-40d1-a43b-6035a3d242d0", "value": 3151872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766437219, "uuid": "329a1ef0-be3d-4981-872c-c97e9edf5fe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437219, "uuid": "741ddadc-98dd-48d2-93a9-3d94866719ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6be54b6-df3a-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1766410425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410425, "uuid": "46944cc3-d8c2-453e-be80-39f4e92a0834", "comment": "Malware payload (njrat)", "value": "2030fa5f448856c95ac872a92849c8f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410425, "uuid": "5a9c5977-7907-48e0-bde5-7ac371b15c30", "comment": "Malware payload (njrat)", "value": "2d2534a659fbf1c44f9f0bc0082127d371c280f84eb7af9e979df681399081ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410425, "uuid": "e44c38b6-f6fa-4bd8-bd63-30b11ac73855", "comment": "Malware payload (njrat)", "value": "59ceca0441465523ee3a73afe7ba776638f27eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410425, "uuid": "0ecb58cc-9a4a-491f-aa6d-8a87669fbb7d", "comment": "Malware payload (njrat)", "value": "36b1969c4224db8ca04d883a21fefb24122fca213a5ecd57ea430084c9dfa2d2e03b0c56961dfd5fce01951196a5250b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410425, "uuid": "4a3c2d21-e9fb-463a-a2e6-bc89f4050a08", "value": "T10A93E74977E57524E5BF5AF75471F2004E34B48B1602E39E48F219AA0B33AC44F89FEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410425, "uuid": "376db153-72fc-4733-8d66-afc39423f787", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410425, "uuid": "22f84499-581d-45d8-8ab3-40c5b9381071", "value": "768:iY3mHkYbIMHrXsZ4mI8eGN/BbECGdpXgzPiJ1w0Ci+XxrjEtCdnl2pi1Rz4Rk34s:IHkMIIR8eGntGPm0ajEwzGi1dDQDygS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410425, "uuid": "7074110e-c97d-4e52-a69e-6e3d5db54820", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410425, "uuid": "763433af-b0b6-47cf-a625-f98b1a8f16cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410425, "uuid": "c9f0b1bb-3e4c-4259-adbb-d094142da1bc", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03acac10-df68-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766429827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429827, "uuid": "57e51035-b89c-4cf2-9076-60662201e4b5", "comment": "Malware payload (Mirai)", "value": "f4de467b46aa47d86fa54ec5baa89d93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429827, "uuid": "e505f8ea-2b8a-434e-8b51-ca2f8a91fdb0", "comment": "Malware payload (Mirai)", "value": "2e2e48d6013395189a4eaa97d0b6c9daba57612df6bd474607b8f21127a049f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429827, "uuid": "cf97decf-2bec-4309-902a-5d98fbcf0e68", "comment": "Malware payload (Mirai)", "value": "b49ea8d1266cb8c0941b763c68430edadb7f6d36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429827, "uuid": "2f3e443b-6b49-40f3-80ae-6025b2a8e89c", "comment": "Malware payload (Mirai)", "value": "d03e4eb5b757922a52d761363cae4f3c66bfe90d605b823cf9a527a056b3091b75296c48149ce48798e27c31632e57b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429827, "uuid": "128c90c9-0ab0-483f-a69e-a84afef2b6cc", "value": "T1CAA34B02B32C840BD6F71FF027BB63E1936AA79116B1E286360D93854575B729B05FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429827, "uuid": "4da3a491-f55a-4b93-a4f7-cea147a26218", "value": "1536:tWn82ZmSh2BtSLxOY0fj5IS5QXOE3V5q9HRrjwBbC/wcS9:c82ZmSWtgASSSN5qIcS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766429827, "uuid": "220ea4c4-0fd7-4ec4-af64-05cc3ba01a5f", "value": 104832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766429827, "uuid": "f22ad696-ba9f-4b9a-b97f-1cfb856407a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429827, "uuid": "25451709-04cd-43b5-99c3-9da8ae4ccd3e", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ad26e9-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446293, "uuid": "c3c2aada-c3f7-4eb9-8c00-292abe1b0019", "comment": "Malware payload (Mirai)", "value": "93c5fb8505e15d87843a2627de284ef9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446293, "uuid": "f6c9a036-f982-487d-835a-e8bcabd985a0", "comment": "Malware payload (Mirai)", "value": "2ec99d3399f924c86801ad843e42bb973509f255e1a4e526152c04c7a0fb8fb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446293, "uuid": "2774a9aa-15bd-43e0-9008-b0d03126d3df", "comment": "Malware payload (Mirai)", "value": "d47c867a546b65c1b285f5b43740bbd77ae4983c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446293, "uuid": "46a255b9-5768-49db-81c1-e94717584213", "comment": "Malware payload (Mirai)", "value": "c8435f27ab0f5d4fa629bb53f0c15c7ea073215ef711f8474ef1aae3bd702d8d8ac7346739cf1408476771c6968ea341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446293, "uuid": "f89b4746-0a26-40cd-a2bf-8572658d3a20", "value": "T184A3D61A6E259F7DF76CC23587B78E20A75833D63AF0C645D26CE9005E6034D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446293, "uuid": "eddfc7a3-dab7-4b45-b2ae-49d559599fb2", "value": "1536:FLr6iG+P4kSkbGiK96r5FHnfcMlmn6763iK8yKm0yKKyytkskjslNmUEhu6lbT2C:F6z+PhK9O7nfcMlmn676LiAKzxlbT2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446293, "uuid": "aee27128-4bd3-4612-a712-a362f3df31c5", "value": 105500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446293, "uuid": "b9565cf7-6e13-4483-a190-fe49f20cbd32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446293, "uuid": "e0d26cd5-2bc2-4438-8825-98e3d005b1dc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9424fe59-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388838, "uuid": "53ebbf7c-61f4-483c-be54-4ab389e75f09", "comment": "Malware payload (Mirai)", "value": "d8181deaaa9a094781fc387f62e4f833", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388838, "uuid": "656e61a0-34c8-4030-9bb6-6cb79e1efdbb", "comment": "Malware payload (Mirai)", "value": "2f2edbe1d707e66e6c64063bda5b4a931a5f77fbede12f5f4f4af6774aec6a3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388838, "uuid": "8d693b54-6076-4498-851c-0d40c22b85d2", "comment": "Malware payload (Mirai)", "value": "34a48b5225d12af01165ae4b5a827f030f5b3e2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388838, "uuid": "026a6bef-e51a-41df-ba0c-02acf81e9cb0", "comment": "Malware payload (Mirai)", "value": "ecf2bf2fca0c87a2df1108285cb3fb4e051066928f0e2bd440d9605bb395ada49b79724978d7b92b6c995660f0e3518b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388838, "uuid": "4f76af74-f76b-4af5-a450-fb23e179ebc6", "value": "T123C2D0E07726FA31C4206C3DE52B4D8A7A51067C91FE353764258C398FC165A67F84FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388838, "uuid": "62ead353-250f-4a05-a1b8-6fbe12f7a262", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwr09q3UELuG:OKy4qfqoeJdXWgdLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388838, "uuid": "8e022bbd-f53c-46d2-8ea1-7bb219ae1378", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388838, "uuid": "a222364a-f676-470b-bf8d-a7a8da85ca24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388838, "uuid": "958e850e-30af-4c0d-9b37-8b6faacac99a", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b70339c-ded1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766365013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365013, "uuid": "a13e9e2a-b380-4cdd-a62b-2175cba38379", "comment": "Malware payload (Mirai)", "value": "fe665b1e981020bbb9b479d18b150d04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365013, "uuid": "f3cbe855-17c5-4f36-b22c-be125600a2e5", "comment": "Malware payload (Mirai)", "value": "2fe9924cd0b8bbbf4c3cca78584fe6fd909efe77897e9ea1b80087028de978d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365013, "uuid": "7d645820-8a26-4ac8-9b10-641f1c06094a", "comment": "Malware payload (Mirai)", "value": "295b12c522145a937acdad900d2956db3dcd1a95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365013, "uuid": "24562a3c-30d9-40e7-83d3-9a7dd4241448", "comment": "Malware payload (Mirai)", "value": "86df49cba8d01b3ff56727ba93c8f676b32c15326dcd43655b487d54f9714e507e5e1c257991714c2bb4f3b3c4f62ec9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365013, "uuid": "19d9700b-f9cd-4754-bab6-36e9122f0edb", "value": "T1AE734B21BA752D2BC8C8787E11F30635F1F62B5A25ACC61A7DB20E9DBF105103507AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365013, "uuid": "0c5f8365-3768-4a91-8721-b4cb62829193", "value": "1536:1FdSUkN84xw8rDNffplVWCImHScjcIcK4lMBVAGg55ATMzA7uhK:3M7Zy8LzSl04C7rnTMzAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766365013, "uuid": "a3ffa71c-d2df-4daa-9f4f-78865413d2a1", "value": 79516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766365013, "uuid": "e06dd8aa-359a-47ff-b31d-693cb952524e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365013, "uuid": "9c83be99-fd33-4ae7-9085-b7a185c5e0e4", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb27dc1e-dece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766364100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364100, "uuid": "f80c4df1-c2b5-4966-bba8-2b014f144d63", "comment": "Malware payload (Mirai)", "value": "e7cbaa4a516bd8d13ee28f74cd8698f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364100, "uuid": "819f3b00-bd23-4a20-804d-039a8cfc641e", "comment": "Malware payload (Mirai)", "value": "2ff7bc011a4608692fa1dab1d1a8ebe678d07d1fa9343ceeaf58dced0ac99d05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364100, "uuid": "515e24e5-d55b-42f5-9965-00b41e136b93", "comment": "Malware payload (Mirai)", "value": "14b83852787be782b32c1deec8db0265cd71472e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364100, "uuid": "18f879e1-9da8-444f-b640-1d621f7fcd1b", "comment": "Malware payload (Mirai)", "value": "e9ab4a624194099afdee47470d745047d4c25012ae5f06f950e52a65e68d6a880709d591f9ae90c21e138a49ae4f27a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364100, "uuid": "9757622a-237d-48b1-b69c-5d15b285e22a", "value": "T17063E896F991DB21C6C5A2BAFE0E51CD33130778E2EE73139E146B24678B46B0E7E405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364100, "uuid": "dca89d3d-cb84-4d49-a2ac-e61537e61aac", "value": "1536:7hnR59qbUW/SaF+o7Zd0UTx7D19a5S3qMoi4Zecuz0wm7fxYZT2bVR:b5sAzaF+2Zd0elD+Zecuz0wmrxST2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766364100, "uuid": "1038e89b-5819-45a7-83b1-94fe61de47c2", "value": 70824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766364100, "uuid": "e49836f6-5199-47ee-9868-5188566aea85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364100, "uuid": "ab902590-9b0b-4dc2-a6fd-3be3be77d496", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2933ad-def7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766381523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381523, "uuid": "783bbd26-05ec-4731-bd7a-d553c3859b51", "comment": "Malware payload (Mirai)", "value": "4e3d2c5b1eb0b279221093bf9ab76d46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381523, "uuid": "b056af0f-e02c-4ae5-ae39-12cba38c7802", "comment": "Malware payload (Mirai)", "value": "30d1e33d231e28919cf36bf997a44965ad39c7f8dad59484906fd1e8e2826ed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381523, "uuid": "9e7ce6b5-bb85-4c2f-9656-de0ef8d3b831", "comment": "Malware payload (Mirai)", "value": "eafee1f7e826d89cd141dc288a61010038e0bb3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381523, "uuid": "0a329f9a-c698-488d-a95c-415441630c2e", "comment": "Malware payload (Mirai)", "value": "51d5ee8896fe1a1307ba67ade08f80dbcf17c73fe8c722d0e48da83571f5d6e421e12742bd2fe9f8e0802a2206e5858b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381523, "uuid": "b918cdf9-178a-47ce-8b00-9e95e0de9ed2", "value": "T155E2D05280017DB0C5622D37EF774E4E3756ABFC85BB74122F5822A0A592DE0C16EE9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381523, "uuid": "e8124cd4-6f66-4c74-80f1-c8f01eb6403f", "value": "768:oae9ypVXolcw9CvH2lLknJMQlpCKSiU1qtdMlxRMGK88H9q3UELj2:cADoiw9MILkJMjId0xRHK88WLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766381523, "uuid": "ba433f17-cbc4-4518-9e9f-098e4524c2d0", "value": 32228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766381523, "uuid": "74fe18ea-1611-479c-b7e2-217df0e201ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381523, "uuid": "b6ab3f13-4980-46a6-9fe5-7e6b7e080449", "value": "frost.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db9ba38-df74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766435052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435052, "uuid": "97fda1da-9636-4945-a1fb-54974b465a62", "comment": "Malware payload (Mirai)", "value": "02f848595c12be7c1a6f0e0a6949c0a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435052, "uuid": "360b1e10-8f08-474d-b2bd-8909354c7a4f", "comment": "Malware payload (Mirai)", "value": "3149ad5c4920f2578c75bc4c67f164024454c8ebde56882c74f604acefca352d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435052, "uuid": "452a69af-227d-4342-b04e-200dada303fe", "comment": "Malware payload (Mirai)", "value": "2f353d40f82b26ab73feade6550c8f4819b2ae31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435052, "uuid": "e3da5d2e-587d-4256-a87d-0d2eb6ce78ec", "comment": "Malware payload (Mirai)", "value": "f2d736e15c3c74265ef860f3b8a890d18b56b279a9b1922d69e8b7bcb010d73ba9f154d5a3e10526fc54ae22c4df96c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435052, "uuid": "a5c73c53-0985-4a87-b682-4cda43e58f63", "value": "T16BB33A52F404DE7FFC4AD7724683CB35B63177A18BB306627652A53B792D3A00C26E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435052, "uuid": "075004c9-3dc3-4378-9281-ca738b116d8c", "value": "3072:A4o/cLYBxivbgkghU+vpnYs99kjIbeP3nbOvDMjq:A4o/t6X29mIgCvMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435052, "uuid": "598df66f-5519-42e6-ac08-8877f1c299a3", "value": 111916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435052, "uuid": "0b101c8c-413f-4016-8720-dcbdf857a821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435052, "uuid": "756fdacc-e701-4728-bb83-10f3577853bf", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be12470-df4d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766418460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766418460, "uuid": "b7871e87-34f7-4a9c-b49a-35e42e76682d", "comment": "Malware payload (Mirai)", "value": "66dc9969ce97c9dd18d334411620efec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766418460, "uuid": "8a3cdf10-7678-49ea-8fc9-a3c12eba6cd1", "comment": "Malware payload (Mirai)", "value": "32243b67c0497c60f7cf939615958a00204bde921a2c856e9a7afb8ba930f807", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766418460, "uuid": "efffc92e-4a5c-4a4a-936c-abca77c1c076", "comment": "Malware payload (Mirai)", "value": "16dc69f2084d80bc17f04b4591fefe0517cf3390", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766418460, "uuid": "3627e2a4-4351-46a1-855b-af0c3cc24559", "comment": "Malware payload (Mirai)", "value": "6a6fcdd1f596e03826b30b4e45fa67b4e8706fd3a18d83cf6478d451db2a6103b2fdabccdf01d192cc3b492da02fc673", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766418460, "uuid": "b575e578-7ee1-4cdb-a41b-4fe2c4643bea", "value": "T1135110ED03801B3A391A4A2493E359AC89458FC4B25A576DD4C93C279C0F65CBBF9DD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766418460, "uuid": "565e744d-2be3-447d-a57b-1722c5df0d3b", "value": "48:YXiqQ30IadUsUaunh6apwMZBnZ+VkRS7AF3OHHZNc4:YFfhKT/4aGuBZ+KEzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766418460, "uuid": "7721ac51-90ae-4067-b3a2-d0787e4a6002", "value": 2494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766418460, "uuid": "91695fa8-cb56-4992-b0e0-75936fe48132", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766418460, "uuid": "b02d057e-73be-4cee-9619-90cd59445d88", "value": "weball.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f867452-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387488, "uuid": "b45cdc01-157f-4272-843e-919d82862516", "comment": "Malware payload (Mirai)", "value": "46dc2d6fe51d486337ff2016b5f594af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387488, "uuid": "6683db90-b397-4bcb-94eb-109ed3e950bb", "comment": "Malware payload (Mirai)", "value": "323a26420857b68fb98bda0c5979e3bd2ccd6924ea844be0c28a8af2df6cb6b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387488, "uuid": "33e2e224-ea11-4654-90f8-3259bc7c58b7", "comment": "Malware payload (Mirai)", "value": "c6d2f7c7d961d388580c4ceea71a0a8e44c6ff36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387488, "uuid": "55c833f2-8d89-401a-ad1d-d494b7785a45", "comment": "Malware payload (Mirai)", "value": "563cda89878a51e74e65b563de6813b4cfacecbb67cc747b0f4661d52a34f1458a7e60666637a0e7e672ee66971b9b54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387488, "uuid": "37b54799-85e1-4df4-978e-b113670794cf", "value": "T198146B16FB0C0463CA931CF04E3F4BF9A3621A9104F99101250D7F5A6A76D77A68BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387488, "uuid": "92d9cca1-bd62-498e-bca7-1c7532ac543a", "value": "3072:WeE5IK91Cna95Vp0f3aFlWsirThY3q+Q5Ykb9M4VkwQZWgUaD:WZmKGnraFgX/+3q+aJCwKoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387488, "uuid": "f14e270b-852f-4122-b966-30f0b86408aa", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387488, "uuid": "002cbf06-22a4-4443-a0bd-ad98c3c670f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387488, "uuid": "3d60eb55-9658-444d-b1d6-2c123f214f29", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd94424-df74-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766435324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435324, "uuid": "b3d31aff-ef2b-4a1f-a176-33b035286116", "comment": "Malware payload", "value": "d7c6ce9b5239abdecf5261c2b459d837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435324, "uuid": "659a3ccd-e805-4596-bf7c-612cff72a018", "comment": "Malware payload", "value": "32d8d74892b98a5da32262fc7cb6305dfe33ca1ec9f6003a83e1a81b7630da84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435324, "uuid": "985988b7-a473-4b74-94ee-991824238909", "comment": "Malware payload", "value": "193bc9fb4c6b65c602952bd22152f6d15219d8b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435324, "uuid": "963a786d-b71c-4b86-9f7a-7190fea0657d", "comment": "Malware payload", "value": "7bad9f3146bb43016522cac7202939a21587b915701d3e7773d44a02d4dc857804e9ac7ba8e227003768ec21cfc8e173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435324, "uuid": "4ec32032-abf2-4eb2-8dd4-14a26a59abbf", "value": "T1C8F6338C1125ADE9C24052B036A7A31A7E67E3972DAA9E7133C17EC75F2F3371943918", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435324, "uuid": "b01a1179-0466-4485-9ad2-460ed49f46ed", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435324, "uuid": "ab12b379-cc67-4b3f-96d6-ff2c834cdf81", "value": "196608:nq+l2aR/k+BUZ5fSPp0fJSBTgX53wRgtPkRwebxr2gwVbcgEmSzKtlo/zrPGJ1gt:n7u/YPuJBWRgt8DgDk/c2kv9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435324, "uuid": "350fd9e9-d27a-45d1-a83b-6ec8453c6fdd", "value": 15465472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435324, "uuid": "496c673c-c4f2-44c0-937d-b0b5630176eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435324, "uuid": "c31f7195-da3d-42d3-a72d-ec1a246a587d", "value": "Installer_v3087_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1297e0-deda-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766369231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369231, "uuid": "6b561d10-fa2e-4390-88f2-0673a383bb3f", "comment": "Malware payload (Mirai)", "value": "9936c9a0c3bbdf002733e74b40bf33f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369231, "uuid": "39be3204-3917-498c-9cbf-0c6f012a07f1", "comment": "Malware payload (Mirai)", "value": "3351d6b8aae469ac5683b4f6c66b64465b9be0daac8405ed34227a2fd616b9f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369231, "uuid": "aa2004e8-287e-46e2-9125-8f8ca13eedc7", "comment": "Malware payload (Mirai)", "value": "b33b661ef60d08f41810b3bf3fb30f578777240c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369231, "uuid": "455dcbdc-9f55-4aae-bbbd-32e0c10d091b", "comment": "Malware payload (Mirai)", "value": "ce8ccd4a5f3f1b666a5c9dbe49b2b209efcaf40bfb131afde4d53bb478758e58cbc3c5b6743ba5074d5c5eb74860c324", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766369231, "uuid": "08f410e2-dd74-42ff-9c60-bcc8f762f648", "value": "T15D635B21BEB62C2BC2C4653B50E34635F6B7574A217CCA2B7D721E9CBF149503207AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766369231, "uuid": "bbffd341-f8e2-4439-b1d2-a16a1d53ac7e", "value": "1536:xvaZeN8XVW/hHp+YVhJDym70N/o9VQz8zm7uhUw:9ao0CVhJD9Q9z8zmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766369231, "uuid": "b9f88a25-2cfb-4da7-a9bb-108886f571f4", "value": 67236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766369231, "uuid": "ebfa9829-c2ec-4c30-9856-9ae8430a688e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766369231, "uuid": "a4c06e71-cda6-42d6-8c2f-be5f46168115", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e31e1c6-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424852, "uuid": "6d6af034-5a48-4ade-848d-3d4ed58cc860", "comment": "Malware payload (Mirai)", "value": "c731ead5126c0eb4da368a3834bcb791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424852, "uuid": "c45b17b5-99c7-4170-b0de-356d317df5b1", "comment": "Malware payload (Mirai)", "value": "35f843265b590d16716b28d7f5f6b5029ad2ed3a589220fd62d520aa38734279", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424852, "uuid": "c99b0eee-5f82-46d5-ad12-6c60f30f4f88", "comment": "Malware payload (Mirai)", "value": "fb01c5564344d702019b118e71b77b30c45b9b95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424852, "uuid": "371f03a2-3a26-4cca-aee3-a23259f62b61", "comment": "Malware payload (Mirai)", "value": "ea3c1ec56779f6b26c8e75c612e3ddc717c854ad3ba3027b7a9334e4f4d1efc052cb80bb92b87d2aeecc32f07084e206", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424852, "uuid": "92fd1eaf-7cac-422e-8528-449d3b953078", "value": "T1E0042A46EA404B13C09627BAFA9F424533239B54D7EB73069528AFB43F8779E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424852, "uuid": "74a26984-db64-4c06-aba0-bfa9b3fd15c8", "value": "3072:tfy1kBnMyiKjWLahAQimtiBDvWANguiJ+XPSorM/Rj/npJg:tf9nMB2wahAQimtkaASuiJ+fTrM/R9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424852, "uuid": "fc17211a-fcce-498a-be99-2166796fe3e1", "value": 180479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424852, "uuid": "0e5386f8-1ced-40a1-a76a-cb9541d13772", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424852, "uuid": "95a5e1f3-91f3-4811-adef-67ecb3eb6e00", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedbfe79-deff-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766385098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766385098, "uuid": "5e1ac7c5-8b46-4bf8-8fc7-160fa4cee3a4", "comment": "Malware payload (AsyncRAT)", "value": "5232709dcc00674eca240d577540d13f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766385098, "uuid": "6b7ea13d-be04-4894-bede-4c85b1ce3a9b", "comment": "Malware payload (AsyncRAT)", "value": "371587f150a72a0651ae879635b9980e5330b2589da7b50a7c1ebd20894ef65b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766385098, "uuid": "69e2c4fa-ec25-4af7-8cd0-c8283774984c", "comment": "Malware payload (AsyncRAT)", "value": "c897b59bf7e46675dab712c0c683e464bb298390", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766385098, "uuid": "ac62f409-c40b-49ed-9804-6b98c763222c", "comment": "Malware payload (AsyncRAT)", "value": "812ca0a166d90e2b7c23295bf629fc4084d684f7dffc897eb64df439d60deb2e12b3d5ead382e6370e4fdf8f34e08992", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766385098, "uuid": "47f1da83-8c1d-46e5-b68a-31dec2f783b5", "value": "T122C21B0473E48261D1EC4BBE48329600D375E68B5D53DB9F6EC499AD2A337CD8624BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766385098, "uuid": "a86511fb-ad9f-4d09-ad9e-437757f303d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766385098, "uuid": "216974f0-18c5-422e-80e3-adb34aecb28d", "value": "384:KQ4K4Rt1zgeLsQk5MMymrJhxUHqqbuUsJQxnCJf+BWfXWk/hDu+:KQlst1ERQk+MyCJhxaFbHBFB+u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766385098, "uuid": "f3cc5437-7fca-4086-9495-0899f1acb7fe", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766385098, "uuid": "787510bd-f422-448f-8fb9-e117e4a62189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766385098, "uuid": "c932c6b7-43e3-4105-bf67-fe9c97f30990", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb300fb0-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Moobot)", "timestamp": 1766370516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370516, "uuid": "380a5a81-5ba7-4a42-b8cb-d2c4a8ee4623", "comment": "Malware payload (Moobot)", "value": "eb2ab9e103ad2bfc48d8a1b54beac5fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370516, "uuid": "9b376ff2-2e5b-4bf9-95a4-21d17b52aa56", "comment": "Malware payload (Moobot)", "value": "376db8d566819607da7923ed717d0482cd68ae2d74f68e102d02ffd027dab527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370516, "uuid": "4d43baf8-2efd-4c26-841d-d599a950fa6b", "comment": "Malware payload (Moobot)", "value": "c1847507734907d206dbd2a0f8c5177f28acaaaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370516, "uuid": "004024e8-4258-4e4d-9f63-b33626ef1e71", "comment": "Malware payload (Moobot)", "value": "adfbea15ae5cb24086ed70269717b60808455c65f0544fed0d6e83a5ce1a1aeafe1ed8a364cce6e3cec769d48dacbf72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370516, "uuid": "9c625555-0b12-4933-9e09-ee5509843f0d", "value": "T12C434A02B31C0E47C0A31A70263F5BD097BEE9D022E4F689352E979A9671E375586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370516, "uuid": "d3ed8125-4856-4819-8e05-64bd22b88ea6", "value": "768:EbpJYxjEJf68CRZGRloQUEqdeKPOkdUPV96mCq2Rj5GMIgglGcFRxtafS+wnhIa:q/mqzq3PJ2D6+2qMIgg4AxgfGnh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370516, "uuid": "b9d49440-a593-4fe9-bdc3-383d282d96af", "value": 55160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370516, "uuid": "00f2948c-608d-4091-a166-becf9d13ed05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370516, "uuid": "f39cf5d2-e745-4fda-a5a2-e327ef2b00b9", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ab5480-df0f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766391607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391607, "uuid": "77845d76-99e8-4239-b941-fa0a2fe7d356", "comment": "Malware payload", "value": "b3632c7f1573445353c703de94a38a13", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391607, "uuid": "c4c25bf1-27dc-4b4f-bebd-8ed46b3130b0", "comment": "Malware payload", "value": "378e1fd51e48e626d199334848be1d86e05cde4e099baf4ad0719e96d2a6b6f8", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391607, "uuid": "643e1a79-73c7-40f0-8359-7a97bbad632a", "comment": "Malware payload", "value": "75b88b9657d715b28df0ec04b6d627e80434bcfb", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391607, "uuid": "f0ac7da1-7adf-4e10-a667-6a41ae4272e3", "comment": "Malware payload", "value": "f7e9d7f755c99a557d6ee650e6181a7488a50ccdd6b8c37e34e3d6da7166fb98e9b785f4be84edb5cfb823ab997495ba", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391607, "uuid": "a7ec6fdb-4221-4f57-afb5-dacd9d544f6e", "value": "T184F4AE3BAE695D84EF950FFF8222D5A18DC8E9C79165C4E4BC400901BEE8BD4F858763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391607, "uuid": "1b84861b-9b77-4647-8936-a40855102879", "value": "12288:j/hVCFuQk9GA3pNOkeUtm6A36LnJZ7scSS:rhVCqGA3Hi6pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766391607, "uuid": "7c9f7fcf-2e04-43c1-ba9e-32d91cca0a84", "value": 739610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766391607, "uuid": "c7a3c86d-cf52-440f-8e3b-af1345769f54", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391607, "uuid": "764a0c59-24fe-4be2-9260-0c44f3970c26", "value": "Voicemod_MacOS.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8225ed5-defa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766382966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382966, "uuid": "da7c2b78-f991-4054-a660-0f89d842e96f", "comment": "Malware payload", "value": "a3c11ef580b554b35231843b2124fd29", "object_relation": "md5", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382966, "uuid": "708343ee-1ed4-4d45-b744-8697ea72ca4b", "comment": "Malware payload", "value": "379b41e3fd94f48d3f1756202fc4e702a98af4f01ca59b1be30cb3e31bc4b3ce", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382966, "uuid": "7ef28126-a81c-46ea-ad23-966a297c4ce6", "comment": "Malware payload", "value": "df68fc6ff06d12c8e2ff06e0ea737c7ad3e5289e", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382966, "uuid": "24377157-e3e1-4e58-ab9b-33f509fccf15", "comment": "Malware payload", "value": "2b34758c1aa5fe416499ad184206e865e815f9a4fa8407952114dd838db764406ae488e2105b1de43a74d13085869951", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382966, "uuid": "28e75527-da0c-47d7-b386-1c401d9d9ca4", "value": "T11C034D5388884E47E878C7AABF031F6C2F497E4EA5C676FF10264E837B316605C0E169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382966, "uuid": "408fda57-d822-4961-915a-1864e05acc3a", "value": "384:b0sVJqEZkK1osPjFLjhdlCxJPxncS45sJflFbfhfhfhfhfTZZZZZZZZzJlb93fnL:5lpdCxJZnjWsh3bfhfhfhfhf5lJth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382966, "uuid": "2904253e-d4ad-4e89-9bcd-dc94a6dd3315", "value": 38587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382966, "uuid": "e1ce2ce3-c9b6-4deb-8602-eac9be63e01b", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382966, "uuid": "94556b4d-2392-44e6-a372-589b8983f01b", "value": "invoice-1645080830.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bbcd00-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388834, "uuid": "830a80a5-aa63-4574-9202-78a0ca6fd735", "comment": "Malware payload (Mirai)", "value": "0e0ef5e2758cbb67cea033c47db6c621", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388834, "uuid": "d7b1c668-472a-4954-9e79-05a60c75a167", "comment": "Malware payload (Mirai)", "value": "37acbff451478670e9d8f2e97eca14a92f0c6a5b896117451fdfea5d7c85804a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388834, "uuid": "b32b8e27-e7ad-4a7a-86e1-a263cbed507d", "comment": "Malware payload (Mirai)", "value": "ce6530c178b1a12318c01526c9081cbffcc4f45b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388834, "uuid": "f5c18e1b-2f1b-46e4-9cc2-7818ad1ac29b", "comment": "Malware payload (Mirai)", "value": "d99b84bad95a44a94981ca86a2aa850cb5ce997d2fd679dd16a68f9c076347e23ae37b42f6c3b7ffa40896991486824a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388834, "uuid": "3d40b765-b160-43c6-8b4c-b7b37885de21", "value": "T14A82CF3061AB74E4CBE10430FAAECEC6A71A0BB9D1FC369216596B78CA4110651F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388834, "uuid": "8e66b9d2-b3bc-451a-94ed-df01297c8df7", "value": "384:MnozRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaJvUhymdGUop5h5l1:2sV0P6+kom0tVAoNvm+to1JvUs3UoznT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388834, "uuid": "709850a1-2e6e-481a-a7b6-8c8e5c928d85", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388834, "uuid": "4f4dde05-aa9e-4231-a0da-d27970f9841b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388834, "uuid": "06ca4d16-41d5-41cc-96c5-47e906ef4b26", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca60de0-df37-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766409092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409092, "uuid": "d2c1222c-37be-4d40-9a18-37fd04fc2039", "comment": "Malware payload (Mirai)", "value": "39108120e65e9826c79ca99378ebc7b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409092, "uuid": "47b40543-b897-4fb0-b13a-ce8535eba9e3", "comment": "Malware payload (Mirai)", "value": "37c634fbfbfce823c3e25f381578336d285b49208ad9bb155493ab2b3923d23a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409092, "uuid": "b9f9d2ca-8084-4189-bb1b-bdb203ba4cb5", "comment": "Malware payload (Mirai)", "value": "37b07fdaaa8d9e1f9c3a8c19477c027e0cd9231d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409092, "uuid": "0b381a01-04f5-411f-93f3-f525b91eae4c", "comment": "Malware payload (Mirai)", "value": "33938634c4f5dc8675de6157c4a7e1cae3d52dfce3e4763f77c0f05989d9e8267550da9eea5a7cce23b3f3a24fa0ab1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766409092, "uuid": "c0d2db79-71e3-4cdc-8acc-79e6b42cd6d7", "value": "T1DAD2D16C5E9804ADE13180B515768BB1EE392FA2E5D34413EB86F782CCD90352DE7ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766409092, "uuid": "a0c8ded5-8ad5-451c-90d8-07521e36cd49", "value": "768:qKvNh1j2qV/6/sUwdjNdyltgHexBdXJgGlzDpbuR1J6e:qOrRCsUaHeLdVVJu4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766409092, "uuid": "cc22ac04-8191-445d-8d3e-7e2b80f44a8a", "value": 29516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766409092, "uuid": "54a437e7-c9de-41be-ab8f-9d943cf18931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766409092, "uuid": "213acf8f-8703-4f12-bfe9-8c270ac45296", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1effaaa5-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370173, "uuid": "fa4ad8c7-da24-4f4f-9044-7fddf44c2795", "comment": "Malware payload (Mirai)", "value": "f1bae047b288b4b5a92139595d05d5c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370173, "uuid": "77c24b32-0f96-4b2e-a873-049fb474742b", "comment": "Malware payload (Mirai)", "value": "3813abd73cc5ea9f40bece1c0c07025c384f6f39b52bb42481e1d9b84c526eac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370173, "uuid": "c98a44ed-e9a9-4806-b0c2-f6d2931d2645", "comment": "Malware payload (Mirai)", "value": "c9b11c1c91e596f589a99b4fa566a94f75635949", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370173, "uuid": "6cd73396-9d7c-4321-8bc4-a1b8ef010a7e", "comment": "Malware payload (Mirai)", "value": "f93dee8c707f95c517d66f47320fda9ee780afb66372bdc7a090620ef37d089aced317123fcbf469432e233f27b102af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370173, "uuid": "ef0b74b6-2893-43cc-a3fe-345428ea5d2b", "value": "T1B3F2D791F8854727C1E41379B6AE5A8E377073EC82CBB62BD8224B207AC591F1D63F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370173, "uuid": "30956f2f-cb92-4446-83e4-eaf13a627f8f", "value": "768:TjbUR4xPEXqqoG5M1ICBHGadwq3iFtKV5/a9tuF7d3RyT3pocAtBYwn:TjbUmQqRG5MNxGaqRie8ZBu3W5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370173, "uuid": "22ebb536-d119-4ac0-b5ce-b0111cca294a", "value": 34868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370173, "uuid": "e4c3cdf6-a2e9-4ca0-8c53-9ccebd4933eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370173, "uuid": "f4063ba3-760d-42cc-988a-8baf7fadaac0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71b137c-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446557, "uuid": "1f0d1ea4-3162-4641-83e8-edb455d0b8b7", "comment": "Malware payload (Mirai)", "value": "17027b653375001637ba97183847481a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446557, "uuid": "6f040fae-6bb9-45fa-b929-a1954859ce1e", "comment": "Malware payload (Mirai)", "value": "399666976e234ee93fb78a0467b44478082c01dd1b4fca25371944de2e376355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446557, "uuid": "2f460bce-f260-4c90-b439-ac5206fc40fa", "comment": "Malware payload (Mirai)", "value": "471269b6da13fc99a3666455b810ef3a95738123", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446557, "uuid": "539f2060-be40-4513-91f1-8482acbd49c0", "comment": "Malware payload (Mirai)", "value": "7ed5a7b763d8f1166e4a90bf83acdc159a94fbe4d07a391debba1e533a3c6dc9ef6a3836632407cfe56bdd98420cc506", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446557, "uuid": "e2f7e002-f238-4cab-8ecf-00fea90a8ea4", "value": "T19F835B42B2184E43E9A31DB02D3F27E183EE99A021F4B786655FAF4A4675E331446FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446557, "uuid": "c1c7cabb-0937-43e9-a68d-f6e0be344185", "value": "1536:h9rhNJdMkG/S3Qco5NXSlnVU9xuXDtqqmg8T2bVR84S:ZISAjXSM9cXwnT2E4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446557, "uuid": "03d0ac40-ebfd-4666-950c-3e8c9edc6d9a", "value": 81284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446557, "uuid": "949b4fd0-4be7-47d2-9a9b-ae16001f2521", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446557, "uuid": "8b127568-8ab8-4a9c-b6cb-2e41f8bc8048", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6337701d-ded7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766367711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766367711, "uuid": "044e80e6-8ef2-4efb-b490-8d63b74c1d31", "comment": "Malware payload", "value": "39f03e327a38ca498ac1f7cb0ea07008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766367711, "uuid": "7757bf18-f83e-4282-95f3-a3afc4c334f9", "comment": "Malware payload", "value": "3a2adf0e265c9136da016fcfd2cb72f2ab5aa22be4a26b6f8a789b0680f22a93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766367711, "uuid": "a6f1bda0-1637-44f5-ad91-f5e123e5a7fe", "comment": "Malware payload", "value": "8a31670ef636c9322036df0c925a8105a6427538", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766367711, "uuid": "f6e66268-5be4-4476-b51c-7e3707ed967a", "comment": "Malware payload", "value": "517a8c292b98772cab36d678b700db9b91da8cfb401a973d66137b66632e711a53012e10ad974cdbe8d2c47af6b1554d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766367711, "uuid": "2f662c84-c2d0-47da-851b-31039538dd37", "value": "T1F594DF52F3103AA7E11E9135588143406784AE7673E2D302FBD3B6BD642B5B5CF287AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766367711, "uuid": "6b7843f2-2e03-4ca8-bfdb-568dd77d122f", "value": "12288:GhB6ywFveW/rcHYym+U1niNx/Yj99KIEOSyQbkazkW:h8W/oHe+U1rSbrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766367711, "uuid": "7a5dfc15-5683-49d0-bae1-7b573ebb1d05", "value": 432336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766367711, "uuid": "c097bca5-96a5-4140-8d7b-d5f685406927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766367711, "uuid": "b04ffeaa-a1f2-4664-a922-19e8da9d3918", "value": "rondo.armeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e351a568-dedf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766371362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371362, "uuid": "50a5809f-e5fc-4779-9610-43ab5f8bb197", "comment": "Malware payload (AsyncRAT)", "value": "63021f612c5aa372eff0f36d080efd84", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371362, "uuid": "546170b9-a130-4869-9e9d-480b1f06d5d0", "comment": "Malware payload (AsyncRAT)", "value": "3aac8ca2a6d0da00fa05d5fe10c7c6cad91e9b81ffb92cd35c6e7acdbc9fed64", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371362, "uuid": "eb247fff-3eff-4800-a106-fae575b336a3", "comment": "Malware payload (AsyncRAT)", "value": "b343462e0e871fb569f59a35b40458604070f476", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371362, "uuid": "2eceda5d-1133-4999-a625-013fc91986f7", "comment": "Malware payload (AsyncRAT)", "value": "90417a13a542405aee6e0c00d79afd0e610675cfd5141bd20516763fe4abe753c4318d222e691d6906e08f6043b42b53", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371362, "uuid": "ccf90bdb-c123-421b-91f5-33f51be77a6a", "value": "T1EA232B143BE9521AE2FE9F7D99F11545C6BAF6132602E34E1CC002DE4A23BC6DA527F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371362, "uuid": "8319a388-b412-41a1-9b0d-7937e2df02cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371362, "uuid": "848f6c5a-5d89-4a00-ba50-457676c47728", "value": "768:/seYPfoFMcveOB42fbvz6A5RyIvrRYAeb1ngUptWxrAK8Rcc4rWBNUR:vMcG2f7zNRbFYxbuU3CrvYcP2UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766371362, "uuid": "9bc1a687-a697-4137-929d-a9d4cbdf3f47", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766371362, "uuid": "0d1a4255-0583-45ee-9ff7-5ac2ab40aa7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371362, "uuid": "34906fc3-c6df-45f2-87af-4888f6a93fe7", "value": "gClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e729a2ff-df62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766427632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427632, "uuid": "5fba9e2d-cc8c-4493-b3c2-45815a2db542", "comment": "Malware payload (Mirai)", "value": "52792c6c415803f35742a055e16ea883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427632, "uuid": "afbde2f6-83e9-4fa6-951b-82ab36def8d6", "comment": "Malware payload (Mirai)", "value": "3ac5641459916faceb9422dc228a7b2e40ba03efe47d452ad9742f417271a8c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427632, "uuid": "ab51abff-0cb1-429c-abb9-1d992b08a9da", "comment": "Malware payload (Mirai)", "value": "b20f7960397681b6aee4e58af59f57dddd198313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427632, "uuid": "256438ff-0830-4246-a15e-0ddb60c9db52", "comment": "Malware payload (Mirai)", "value": "8970c50ee7221db9b45d49ff4bd29c9cd46c80518f9ce6d6222eb0848bff612e26e0b45408e014ea0d84e9dd6d063076", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427632, "uuid": "37d6ae94-b469-4ef5-8670-3b886ce8b909", "value": "T153C30796B8829B20C6C2567BFE4F118A331367ACE3DE7313DD185F24278B55B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427632, "uuid": "16aa0f07-8264-44a9-8c3a-a5485856b308", "value": "3072:vn3RO8tdf549mvKaxuZhsNrVJYrlTxI527MqaNknQ1dTLHpnz2:vnBFtdf549mvbxuZSNPYrl652AqaNkQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766427632, "uuid": "52af3197-96fa-42dc-b936-ecd2e7bf2778", "value": 119932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766427632, "uuid": "3e613cc1-588b-47aa-9cd0-c1f4cd21a8b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427632, "uuid": "f18a071a-37f1-4b53-8c22-0bcd6460cf63", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0052a829-df55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421661, "uuid": "3dd17d2f-23a2-4c5c-bda9-f0c1d232e6ae", "comment": "Malware payload", "value": "f457b4665b737926fd18ed4d12a2da2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421661, "uuid": "d287e508-a0f6-4ac3-bd4f-bbe027cf65b9", "comment": "Malware payload", "value": "3b6fb86356d15f3b52f09bdcb433ce34f643e6f4f6d492711f4c8dcac8ac7aec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421661, "uuid": "5a313e7a-8d72-45b9-a68c-5d96eeee9618", "comment": "Malware payload", "value": "e13476e371f745fc454d91a093acebce65dc252f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421661, "uuid": "1218e526-03a3-4c97-8c34-5db6190f22e8", "comment": "Malware payload", "value": "c4ca25ebdb9023a497adbfefcb2a9075643c7fe06470ce7ff17224cc59d0aa6b84b7aa785e6eb9a2b0bb8b753d272c89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421661, "uuid": "763973ba-8f72-404a-8cdb-8e226d1e27e8", "value": "T181B0926A07033D03807DDC3A32B10FCC74257B4D144B3B883CC3406FD0845C42268914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421661, "uuid": "94a0fbca-8458-423b-9e08-85432c74f491", "value": "3:haX+v1FjX+v73VZv+vaGN3zSTASUKoS0/eXIFIXWX+v1Fg:WGrk3mSaqA54X4IXQGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421661, "uuid": "b9a79f23-d092-439d-a697-6b05d2428290", "value": 128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421661, "uuid": "fd5cf925-1ef4-48d8-bf80-d6b1fb05f064", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421661, "uuid": "f68264c8-bdd5-4346-8822-4850a905c251", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5613eda-df91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766447842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447842, "uuid": "e2122c99-d918-4792-8946-8c248d350708", "comment": "Malware payload", "value": "8d6fcdfda9440b68b902f90f6c2b7953", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447842, "uuid": "ebe6c1a7-6ec3-4ce2-8cc0-c4b8af643572", "comment": "Malware payload", "value": "3b8174b5d5021841f4dc04492d7b29ec1d0f4eb14d861b624aebb79c408a6697", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447842, "uuid": "4edd1a7b-2c1b-434a-88b9-fc2fc898655d", "comment": "Malware payload", "value": "dd9a96a50f79285a42b2440cd420f0c47e02602f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447842, "uuid": "35e6d36b-3439-4232-8470-1b40477e6057", "comment": "Malware payload", "value": "5d7f6d09d276786621707a2c8f1c0c194ceda04f945d1cc3d2ceccd222571ec8ca833af51e44588ea8ddc03adc0d659f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447842, "uuid": "39bbdf36-2385-42ac-aa51-7c54cc2c7e60", "value": "T1C9C30786B8829B20C6C2567BFE4F528A331357ACE3DE73139D181F64278B55B0E3E516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447842, "uuid": "86d6fd06-1b2b-4197-b406-966f4eee094f", "value": "3072:osBZz8tYHviACaOt/7hRFrV0D9E3Txal8YKfHUKKBROTaNfYnz1:osUtYHviACjt/7/F+D9E31acfHER04M1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447842, "uuid": "c794cf0e-996f-451e-b988-5d35afea7e42", "value": 119936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447842, "uuid": "fcb9ac67-3d6b-42fb-9f3c-df4f39d1116f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447842, "uuid": "3d0522f5-559c-41e9-9df1-3d9c7b6794da", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0969c5e-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766397905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397905, "uuid": "2f530102-5577-4512-b763-86b701db3b51", "comment": "Malware payload", "value": "9e9f397caa4688565594c11c28965822", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397905, "uuid": "768665fc-2148-48ab-8564-3c1ce2980c73", "comment": "Malware payload", "value": "3b849ea2f040aea2de58ec4623434766b21ff5cc2cfc9159638ef543f14b5c77", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397905, "uuid": "cb68f135-38ef-48f3-b20a-e5925b97cf61", "comment": "Malware payload", "value": "866b0a1473ab4f52b66e853188513164fc0a3f6f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397905, "uuid": "0008a75b-8e1e-4eac-8455-7324e2ac6e83", "comment": "Malware payload", "value": "cdd396e80c3264721b8c40f193d94b701d5d31321e9dfb092744a5c63c0ed0f0867fc22d1ce222da33e769347f451fc0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397905, "uuid": "53ae634f-65a3-40d8-aa8e-835113d561a2", "value": "T1C6747C1677E525F8E177C639C8624A02EB727C225760DBAF0760458A5F237D0EE3DB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397905, "uuid": "921872ce-3bbb-48a7-8fcc-c29f00cdf87a", "value": "0da62d5f519ce5d13fc7eaa002978cb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397905, "uuid": "833498f8-70d4-4862-b3e1-b2abcc258a47", "value": "6144:VJRj793i4Jm2LfxmqtFseUvzYb/MC3agajVoLhDibK:Bpu2LsqEr8jMCQoLyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397905, "uuid": "5bd944c9-e651-40c7-88e6-9e8eb9357f64", "value": 354928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397905, "uuid": "8019d873-d7fe-4b52-a4b6-2a354c5e20ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397905, "uuid": "f612039f-129f-42eb-b7e1-21e08dd8fd30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7068f6-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388850, "uuid": "21493b5f-3333-4d4b-a29c-5953919a25e6", "comment": "Malware payload (Mirai)", "value": "19e56c2a52227d23812d29d55567ea91", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388850, "uuid": "5fe06e1b-c5ac-4ccb-b564-12376aac8504", "comment": "Malware payload (Mirai)", "value": "3b9a50826c83693a023ef643778c4fb4b50d6226b69f2d996ccc365ddcf499bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388850, "uuid": "3923589a-1fb3-4a71-bc98-9e7af9b05ee6", "comment": "Malware payload (Mirai)", "value": "dae7f04e9eda1c2c3895f5b40c07f0a2928c82bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388850, "uuid": "d50c179c-c83d-47b7-9a0c-8aa570c03413", "comment": "Malware payload (Mirai)", "value": "1e3455eb60aca240acd041de967f99f4713eac29eddf244820763f484859c3e2af475d4a293521204709760ee924ca99", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388850, "uuid": "2484a049-a5a8-4ed4-9d59-5d1211729fb6", "value": "T1D601FACD26515345440CCE48766E0A18965ABBC0B4B4CF29ACD4187F9C997087068F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388850, "uuid": "e22a6334-420d-48c1-bca4-16a10a5a392e", "value": "12:aYj+VWq+VyNNIl5zA+V70LKj+VZgOs+VneC+V9ON/+VRSE+VktaKA+Vej+VSiA+Y:jVYNI7KK3Fm6LtBCxxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388850, "uuid": "a3b5c952-dfc6-4579-90e6-252fa2c234e4", "value": 814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388850, "uuid": "b5a9648b-2547-4a65-a7ce-b859ab1bd8c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388850, "uuid": "e9e4ee88-d20a-48d2-ae8b-e5f352347e4f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992f3b16-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388847, "uuid": "95bf7cf6-19cb-49ef-aa44-71e3c352e424", "comment": "Malware payload (Mirai)", "value": "bdc0d00fde4863aceec2cb686bad1cd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388847, "uuid": "cc6a2647-49fa-4c97-802d-ef90ae33ed5b", "comment": "Malware payload (Mirai)", "value": "3bb78c48c3a21328f84db4e86c36ed4916340003af2d1c99e2fbf48adbacb15b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388847, "uuid": "7b6cce0d-c7f5-4b74-b0b3-5e2e02bbdbbe", "comment": "Malware payload (Mirai)", "value": "aea57b6d284e4c905976f9befbad251eeb97bb5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388847, "uuid": "fbddd2cd-34d3-4890-8041-1e7ac11f67ef", "comment": "Malware payload (Mirai)", "value": "2ad48518ecec62cf997f97a51bfc785c8b9e4667fbbc95d13d5165d2c7cf4c8fbc749fb07c6e61f5a0f200519df18fd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388847, "uuid": "55965ec2-15af-4b62-b130-f81a3c19be90", "value": "T146A2E115BF2886CBC832693855E9E5D21363FC72F2DDDC096940C16BB4A33A96874F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388847, "uuid": "dfba9953-62b7-4128-8ec3-04b358e3b1df", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKE:798o08kxofBE+ZkXaqGbp2F2TWul0c55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388847, "uuid": "19b7dbc7-a2f1-4c7b-92cd-ec9e2cb8b091", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388847, "uuid": "b53dbe3b-e90f-4f6e-b408-066c8431a761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388847, "uuid": "43f89ecf-0942-4518-a82c-ac2c837b7e6d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97204b8-df3a-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766410376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410376, "uuid": "11bc76ba-44bb-40e3-bec5-2225bfdd4d45", "comment": "Malware payload (AsyncRAT)", "value": "d2f7e0866ce006ca813191bcad98feb0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410376, "uuid": "5a9f7110-201d-4d92-9748-0fe7a4acf87b", "comment": "Malware payload (AsyncRAT)", "value": "3ca59a6705ad21459d8fe33ac65f434b440a741bdb32e07c0c5b620c96a8004c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410376, "uuid": "91e45090-77e7-4271-9bfe-414d2efbe2a9", "comment": "Malware payload (AsyncRAT)", "value": "03c16170cf2301a4ec8e2af44c5d53672b267af3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410376, "uuid": "7f6b1cd4-ffbf-4690-9ca4-7b5c2a858ca6", "comment": "Malware payload (AsyncRAT)", "value": "e3158d61d125a1e427e28dcf56feed0b9af0093691b0586ce42795109141a33ce1aeae189425c9accc139248f3baec4f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410376, "uuid": "6e616d71-be13-4b5a-9661-4c176ca7c751", "value": "T14B233B043BE9521BE2FE8F7959F1154586BAF6532602D64F1CC002DA4A23BC6EA427F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410376, "uuid": "0ac4f76f-2162-4871-aea5-9989d2b6fdf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410376, "uuid": "5b6e5717-c2ab-4a91-9e59-f1e2f2c75bf3", "value": "768:useYGfSVqcvehZn2fSUjzuGnuvTYzqHH9eb1+gUptwlrAK8RccTrWBNTJM:XqcIn2f1jzNnbzqHHUbvU3QrvYcY2TJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410376, "uuid": "922794c8-6016-4a43-97ea-4fc7605dc822", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410376, "uuid": "f95d589b-d257-4cc8-8563-671205a0b5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410376, "uuid": "121f6c0d-e4e5-4a99-80f1-473129874840", "value": "gStub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a392700-df45-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766415048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415048, "uuid": "9fc32bc3-376b-4b80-8f86-789edbe7e3a3", "comment": "Malware payload", "value": "481b178f0983079dc94b570c5a9517b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415048, "uuid": "342c7652-2227-4c91-b0d7-bcf1495d28e4", "comment": "Malware payload", "value": "3cc7a939e45c51944778533f121228676120c09ab0c7b2c999f539c1aa9af22b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415048, "uuid": "86dfd2ae-270d-44c3-99cf-7db1df52cc04", "comment": "Malware payload", "value": "e910eb38b12323e8d19ff558c5cddf147cc8bc99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415048, "uuid": "3ef2e244-c496-46a4-96ee-dc57e00489fd", "comment": "Malware payload", "value": "9df2b3b3f90de9e71e513eac02cbb9417189248a07a5527db1b8b6985321f0b96aea61001348c319b13986a858dcaf23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415048, "uuid": "03984498-41cf-4e3c-be3c-f3a3ff063ad6", "value": "T179B37C43F683C073D1AA96F261769B3B5631E4B350448D42DBF9FD31AC65942EB0AB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415048, "uuid": "6d85d5a5-3546-46db-87e7-4aa792953fa9", "value": "1536:UT6xuAs2sMUe4Z1ZW7KeAmbT1ITQyAgru3ZV+o5r78iVy/hI+05kgqQIgtoyQ/37:C2Vp4gbhIQVgCJV+g7a58kXyI4UQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766415048, "uuid": "51ba41be-a87b-48c9-aa95-ed1781b9ee71", "value": 112876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766415048, "uuid": "f641cf5e-4251-4779-8426-770999d3e0fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415048, "uuid": "19cc1233-c782-4b34-b009-de70c4e963a5", "value": "rondo.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf34017-df74-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766435051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435051, "uuid": "367a2e80-2e8c-4891-9755-bcba93bb69a9", "comment": "Malware payload", "value": "00006d19062c9e6468c209ab715d1a9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435051, "uuid": "b1b31f93-1168-43da-b7e1-99b63c0d0377", "comment": "Malware payload", "value": "3ccaefb4a9cb7a8785f85b20c02627adff44be58567f9dca1a0e4073d45f23dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435051, "uuid": "637c8b8b-b8eb-4776-a311-ab54b1bb4e0b", "comment": "Malware payload", "value": "974275f0ea99c574ab9b0e3df9827f34909d9b75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435051, "uuid": "b00e7d51-2730-48de-944d-5e6b531af63d", "comment": "Malware payload", "value": "b40f04d5f97457dde52b27b5fda2eca8d74ebff67f674eb8abfb7875ff1acbe7d83f9eaf938afdd59c6475820c41bad0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435051, "uuid": "ea669234-8206-4458-8728-cb6609c81a7a", "value": "T17AC305327A61191BC8CC533A51F78321FA72772AA1A8C71A7F931E996F3C39471177A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435051, "uuid": "b08c8a8d-315c-4843-b7c4-154137133d5d", "value": "1536:OlqXGRP0FGpopg/o1KHl8FviMrAji0HvPmTU5MvTEQwpXKMuNLO:zLjF/ke0HmgVQMuJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435051, "uuid": "8aa1a780-7a92-472b-928d-ff29af16e48c", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435051, "uuid": "542519d3-8394-4631-a125-47f84e12b14f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435051, "uuid": "391f36fb-a634-461b-b836-07b388cd639a", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a151a7e8-df02-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766386283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386283, "uuid": "8780934a-f662-4ac7-91ae-efa44b87fd46", "comment": "Malware payload (RemcosRAT)", "value": "a260bda41ada4ffe3d2a3f298ffd0a22", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386283, "uuid": "88622c32-720e-48fa-a14f-999cb7284cd6", "comment": "Malware payload (RemcosRAT)", "value": "3d2b5353b7f6331c10280799e82e05dd53c8969cdf424a4f8dad23a7af5e488c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386283, "uuid": "aa3d08fd-68dc-49c6-9912-175cf79ba6f4", "comment": "Malware payload (RemcosRAT)", "value": "ec4dc399295742d428ff1a5c6c3bb52ed5107aa8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386283, "uuid": "cd1b2ef2-302d-4534-83f1-618c9808fafa", "comment": "Malware payload (RemcosRAT)", "value": "a45f40e0ef364bfe315189835677a1567ff2cdcfbea217a87ae44dbbaff1f34a8b0a49317ff761daeb7747a0c0a0bb8a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386283, "uuid": "6a4a178b-8e15-4037-9b52-8c9f11dd7265", "value": "T1B2B35A10DD380A6A0E671BDDFD954762CAFD860E4225A4B1F6DF430E21025ACE3FE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386283, "uuid": "64aaef33-b0f0-4508-aec8-9ef94575f545", "value": "1536:RzM6uGYiD+JiiLRHHmw52a5bCxsmTE+5Kl+4P8HwnmOIMa:RoyR+lRVw2o5Kl0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766386283, "uuid": "2650648d-e9cf-4535-999c-b9fdd713f98a", "value": 112805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766386283, "uuid": "4c0762ec-7ddf-4e23-a9c3-21865e7ee7b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386283, "uuid": "656731d7-db8e-4bbb-a88d-89ef9c7af2a6", "value": "PO-08626-SUPPLY-40ft-CIF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159b8dcf-df90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766447037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447037, "uuid": "b5fc245d-9bf5-4df5-81b0-847d73a42608", "comment": "Malware payload", "value": "090e890613238b96fec918b7ab1d6aa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447037, "uuid": "95010d8e-e02c-4d72-8330-177dd9db9105", "comment": "Malware payload", "value": "3df40d1898ba2fa6ca824422111ad77d09d7684b93daf3ed61972f45181dc14b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447037, "uuid": "86a95a04-d2c0-4f60-a4e1-f1cd03323ea8", "comment": "Malware payload", "value": "010290fd428ec81aae26dee7bf1f333c0644f390", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447037, "uuid": "43818d2b-96e7-4d6b-a61c-20151ab84955", "comment": "Malware payload", "value": "40b416d6dcf9b5f56299de9c577320199dc3c8b0f7195c77d6e196edeb26ee436c2d5b15148a12c86c65eb90eb254b4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447037, "uuid": "5ed93d6f-63f5-4e93-9b19-9322fdd02c75", "value": "T121B35C02B31C880BD6F71FF027BB53E1A36BA69156B1E286360953455136F729E06FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447037, "uuid": "6343c3ae-f531-4150-868b-3a91c81f5096", "value": "1536:XsBFkYb6nfi5k0qmqe2X5W+tzwv5zhw6wTmDFEVp2nZMwy:cBFqK5M7Azhw6w7SZMwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447037, "uuid": "0e190651-4c26-4411-a76b-3f800fda619b", "value": 108040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447037, "uuid": "bdb8068e-dca5-48da-938c-01c949bf6a9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447037, "uuid": "36c1bef9-ca10-4c58-9cb6-9bc9b165e089", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6d94ac-def8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766381874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381874, "uuid": "c619ecb9-6715-4f6f-a20d-25a38bf83046", "comment": "Malware payload (Mirai)", "value": "bc8de4085beb82ca68b454968c995249", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381874, "uuid": "a41cfe6a-a3cf-4307-9810-42611f73c77d", "comment": "Malware payload (Mirai)", "value": "3f369751f1b58e23d838e25846c03bd66f8e84dc08c878ab2d58073e37b59389", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381874, "uuid": "f04cdce6-9cee-47f1-a474-706c5a396234", "comment": "Malware payload (Mirai)", "value": "79d658c1d7668e1f5348e11eef0ceceebe6b77ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381874, "uuid": "4deb5348-6ce0-41f3-8762-a49d6aabc15d", "comment": "Malware payload (Mirai)", "value": "2f55810dd90e3599044bc0d445b6715850a65c2b7160b4ecb4e94cc61b66c970860046fa190267e5381abcb4905176f0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381874, "uuid": "e59ce1c6-afbd-4f72-a76f-0273c0fd53f4", "value": "T13F51819F11089F31A74E858EB7F031B4A54AA5D35BEB8A14EF90085E2EC5E4C37C9E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381874, "uuid": "99c3cbde-c1a4-43bc-b215-c6767285c36b", "value": "24:6909n9iO9i2JMY97C97biBc9HL9HuZU9OEd9OEnE2EhEv9O9xt9aL9abwP9F9H9g:ot2JMM+biB8puZHHcvyAAbwlohM3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766381874, "uuid": "b0194386-6391-482a-b551-cfc06e53a8f7", "value": 2881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766381874, "uuid": "5aeaa419-52f7-488a-8366-8ad0f3e7838e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381874, "uuid": "650f214c-f1ba-4627-bc79-606c803286d4", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9db7ffe-defa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766382969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382969, "uuid": "e9069b60-7e53-4a78-b70c-f3cdcf2de422", "comment": "Malware payload", "value": "0c202e4810b42a441374fecb7eaefc7d", "object_relation": "md5", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382969, "uuid": "ceef95ed-427a-4a97-8b2a-89021e79a6c3", "comment": "Malware payload", "value": "409676db97ad7c6e48fe62a71f53cde1c62f5ac2849d32d58bcb659255801578", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382969, "uuid": "3282591f-fc68-4b72-879d-38080a049fdc", "comment": "Malware payload", "value": "4559ac367378ccdd07f01794b564c733278394aa", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382969, "uuid": "b3504246-abd4-4d69-811b-bcf9053df847", "comment": "Malware payload", "value": "7021a38cc3496ef19d45cee43ae63ae0a373293b4b10ba2ff214d1ea6b763c835abe6a98454f3cad65da9c8837ceb16a", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382969, "uuid": "45a0b20b-27b4-4c76-b71c-d6c15b85d6be", "value": "T13D7319DED983E3AD46BAC4F3A6FF7108514C9012532BD9A54659F33832EAB26D83D41C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382969, "uuid": "51d43a69-cad3-4b3d-b701-d54f171c3047", "value": "768:I8w/h62/jWs6oS+xISN0vwEMFzw8oUoDRxyiHrF3NEoQHQq1fTf+OC/DMaV4Hpc1:I9l/AoSSM6RBusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382969, "uuid": "f90dc424-1921-4060-a60b-9ce6763c47c1", "value": 74365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382969, "uuid": "289684c4-2abd-4b3d-ac07-2fbe1ecfc94a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382969, "uuid": "894a4b01-700c-4486-9c04-c90a7121ea0f", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7e73e1-df90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447047, "uuid": "4cb62d45-16a0-4340-98a4-18d154ee499b", "comment": "Malware payload (Mirai)", "value": "f61ecf4a3a92b1d3c80045c00c4cbfcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447047, "uuid": "32813388-a4e2-4985-ad3f-39a42f8c87c6", "comment": "Malware payload (Mirai)", "value": "40e673fd874001082e92777e53df71e948f3f1f890ce96c751ff9e9df6462aae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447047, "uuid": "0e0c5f1c-4df8-408a-a3f5-f592fcc461d1", "comment": "Malware payload (Mirai)", "value": "e77cc0ca0cb0ad11fea7ea71f9800bb8ddefcd5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447047, "uuid": "1468e36d-17b6-4f88-9aa6-f7028d6f3e8b", "comment": "Malware payload (Mirai)", "value": "cfe927fee8e87fe3eeb2c038054cebbcf98351880011703e7a09b514089cd9ead528a1c661c91181ea32e68c3cbf6630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447047, "uuid": "d9208f5c-f2e0-4621-ae55-8f45314352f3", "value": "T199734B21BA752D2BC8C8787E11F30675F1F62B5A25ACC61A7DB20E9DBF105103507AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447047, "uuid": "49a34bcc-bc50-43f3-b9ab-d5fb97a1d125", "value": "1536:1FdSUkN84xw8rDNffplVWCImHUcjcIcK4lMBVAGg55ATMzA7uhK:3M7Zy8LzSn04C7rnTMzAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447047, "uuid": "ed3a9b64-539a-4674-b42b-816e19ba9d87", "value": 79516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447047, "uuid": "c11675bf-fd91-4e23-9038-a3a6cc779b55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447047, "uuid": "7cc97435-78dd-40f2-80f8-12107d8e6e26", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f266bdf-df59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766423619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423619, "uuid": "6fe01682-054b-4550-8d06-06fc931eddb5", "comment": "Malware payload", "value": "09b81afdde2f9090fb6c50baa75821e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423619, "uuid": "2eece96a-bca2-401b-8a51-b5d95040aed5", "comment": "Malware payload", "value": "4108c6b88bbe87ee6c1cf24f618b36c018c39d4b1129ebff71a7b4b7e9f1b7bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423619, "uuid": "6e1badce-4773-4766-93f3-c0251968acd7", "comment": "Malware payload", "value": "bb376b6f7c6292bc973734b43399fc28850b3054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423619, "uuid": "89985fca-f87b-4fd7-b1bf-6e1d6c72c178", "comment": "Malware payload", "value": "fb0d66542dac33b63fd957618e16e44511f12043333db1654a7d30c6d41d45b802d39a8a4918ca665528fac842b90d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423619, "uuid": "23651eb0-d285-4d82-b5a5-637bb847c2ef", "value": "T16A081221399DC43BD56A02709E299B67A67D7CB50F6144DBB3CCBD1E2A710C20636FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423619, "uuid": "9fed52d9-2231-4af4-8691-11c0512ab54b", "value": "b5c4af63fce9c0e356ea53b41bbf3d02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423619, "uuid": "3780f8cc-088b-42c3-92ff-1ed35af51d8d", "value": "1572864:X857g3Sn+mqFyH6bP857g3Sn+mqFyH6Y9OvAsLNNCawx9hLrtic7er7t+pkEpx5u:Fa9AAsvqL1tiVrApv6I61U6beA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423619, "uuid": "3b1abf1f-6b91-40d2-9a36-de93282e8c23", "value": 84764152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423619, "uuid": "16eae5de-208c-42f5-9330-c94ac2c316ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423619, "uuid": "1cfae3be-6e0f-4419-8a65-3bcfba25a20c", "value": "010_Invite94IY-PDF39539DFGHYTFTF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a063fea-df20-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766399129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399129, "uuid": "7abfe007-05ac-4bcb-a567-95bbf326aa7c", "comment": "Malware payload", "value": "23cf083aaf8d4f4e8ea54451c8198f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399129, "uuid": "15165c4a-66ee-4aeb-a19a-73537d020742", "comment": "Malware payload", "value": "4183ce92541a0f8408573a2eaba2beec8decf624b30d101d5e551372b3cba425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399129, "uuid": "bfe560a5-08a9-4742-80c5-331a4b303991", "comment": "Malware payload", "value": "ee437a7589dfba9531a57016dba2d803d745bc32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399129, "uuid": "2ea0b4c4-1d34-4d96-a569-48e9e5f08692", "comment": "Malware payload", "value": "98b8863cb83313681d6ba51c8ad49e8fbaf175f40d33300c783c56941b1c139ecca1ae4cf78c6670162e5a93a2291d8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399129, "uuid": "0a8be1e6-c553-4ed7-8e2c-1e6736b7d325", "value": "T163458D02B36AC604D62AD9BDD9D1D6F012127C05EA61B11B36D53FEFB8BB25C0DC6683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399129, "uuid": "4465a919-6e28-4537-9e1d-ba9a9409094e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399129, "uuid": "5489d3df-2bac-4867-9c69-66975fd46960", "value": "12288:6oW4lDhyiTnq9BpxPZW3nQzSPrEhgBLj8B3mLoU6/5rTxYvveS9xJ/VB:6oPnKxRWxPr0YoBWLoU6/pxc9xJ/VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766399129, "uuid": "632fc978-15b7-4203-b333-e80387da91b0", "value": 1215968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766399129, "uuid": "47c00392-a508-4876-b94f-60de2abb8eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399129, "uuid": "14a23915-3358-41d0-8247-9567e1eb6467", "value": "NutWall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65ed030-ded8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766368307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368307, "uuid": "c998bea1-a9f4-49f4-bedb-a0b5810a7ad6", "comment": "Malware payload (Mirai)", "value": "15d64341fc1a952cc14bf935c4607eb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368307, "uuid": "ff432001-6e62-44c2-84e6-9b8e14bfb2d0", "comment": "Malware payload (Mirai)", "value": "424d64050d4ce6fa8ed6a07155dd35725d0519f7bd708f6729cac3d485f6149d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368307, "uuid": "cb1aab2e-a370-4022-ae2a-df767135b832", "comment": "Malware payload (Mirai)", "value": "3fb83fbc19e50ecc7699a679f3b0198117e38f90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368307, "uuid": "d6a2d463-ef9d-43d5-aad3-61fb365b8dae", "comment": "Malware payload (Mirai)", "value": "8c475102ea0d291489e30b3b28c43d49aec3bb2d8453218674a377a96da142d81a375005fa5879348157514a09335e2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368307, "uuid": "41246fa9-885e-4a23-9e13-4201479a898f", "value": "T15F732A86B8819626CAD5627BFA2F42DC332613A8D2EF7207DD156F107B8682F0D3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368307, "uuid": "226f0f2a-033f-4f4c-b273-d0457455c086", "value": "1536:Ly46Je7nkiM46TreNqGE3XsSGAV4JOD/KCJPiTAbVR:Ly3YLy3XsbAVVD/KCFiTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766368307, "uuid": "97f6ea7a-40d7-446d-b335-cb7acf50c9f0", "value": 75028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766368307, "uuid": "7902e21d-25ff-4ccc-a1b7-989c58a32c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368307, "uuid": "e639887c-7e72-4b1c-9267-c92bf0882d87", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b9a585-df7a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766437837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437837, "uuid": "4e31d96f-cb71-438b-992f-d2faf0a3eed1", "comment": "Malware payload", "value": "66741f116149fd23b9948a7ba7007745", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437837, "uuid": "37a5f919-7b22-46bf-a90c-8410db5700c2", "comment": "Malware payload", "value": "436096ead19b13d54198f81f09bee47c48b63048ac83f0c4c6fb96ae01e1bf8c", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437837, "uuid": "cf41abdf-69de-45a2-937e-53c688345a81", "comment": "Malware payload", "value": "deed4544a6d8e6fafedbaa67894a410afd4b6ebd", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437837, "uuid": "087c0348-8238-4cda-b71b-0d51ecc9acd1", "comment": "Malware payload", "value": "7f10be0119ef0f701679f825f9b46d2d118e11a3dd617d83d9b12efd3c3ac3e909e2fc3df8db14c0d39cc7861a0a2160", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437837, "uuid": "5824c031-905a-4b29-a723-fcc10251b50e", "value": "T11E77237A965C26C0FF8B81B5DA79860D40D23A513497A9E53B2475108F9FBC0DB32B8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437837, "uuid": "db6fea7a-c728-4dc7-87fe-df838caa4d35", "value": "786432:6nSKfnRNXd1wy/6YCVGXPnHXhQOsYseq78og2DCalf1mbW:abd1RjYYQ7Y6RMal8bW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766437837, "uuid": "017f271e-3fb1-4ad9-af6e-e5d7154afe12", "value": 34261595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766437837, "uuid": "d03c0cb4-fdd6-4e60-9f20-8c7a321dd274", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437837, "uuid": "5c9ad270-5a7a-4e14-96a8-ca88602a2afe", "value": "(3) Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c35d80-df91-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447846, "uuid": "fbf49d22-97b0-4d1b-a21b-ace12e681e2e", "comment": "Malware payload (Mirai)", "value": "e555fd8440829820f7649365b63c38ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447846, "uuid": "815378d4-a41d-4508-8c96-dbf576c577c4", "comment": "Malware payload (Mirai)", "value": "43ccfb3e37398b77240ba1d5d29068137d1193302757182e1e7426ee212afdf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447846, "uuid": "1493db18-f33e-471c-9b94-fd5dd8f44a01", "comment": "Malware payload (Mirai)", "value": "24f358236e23b61b614c7d8c1c44c77e412fd88f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447846, "uuid": "143a9fe9-9f11-4c10-be0e-ece0e4ba3712", "comment": "Malware payload (Mirai)", "value": "2bddb9a61b8e5ba4fe9d8120e32850a2c8d5fbaea9e651781c9621bf359feaa260b126d0c0600339f52d3f680fb03a24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447846, "uuid": "6eeb1c29-5212-4bdd-b3ed-5006b172f8c8", "value": "T1A104392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447846, "uuid": "048a1861-05e4-4025-b66f-7c4acecdd410", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wmUXS:7eJpJUVD1A8n0YNgEJi5azi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447846, "uuid": "707e1c45-c272-40f9-82a0-404bed06a549", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447846, "uuid": "78089861-10f2-433f-bda2-a93e18eb4d72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447846, "uuid": "3f0a6259-35b0-4629-9a1a-f539cbaffe07", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901f6cde-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397851, "uuid": "a2f7dc95-ceda-4e5c-9470-aef2bb6883bf", "comment": "Malware payload (Mirai)", "value": "f834637a075dbd3103e787b0eaaf7b7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397851, "uuid": "17193a42-0d61-4690-a9b7-be169268adb2", "comment": "Malware payload (Mirai)", "value": "43f4933990a71e1836a520a101d3e67ff251dbb8703a4b5a2a0b40ee7a3ce3ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397851, "uuid": "2bbbb06b-3b83-40a2-8c06-c8b1cb4c5805", "comment": "Malware payload (Mirai)", "value": "79d59519691c623d09b891f92d546eaf9b7d89c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397851, "uuid": "1b26f5ae-1e50-468a-b04f-5d49f1594d53", "comment": "Malware payload (Mirai)", "value": "44b5943602a4f92e56e8edcdb758256bcdeb2ad55a7158ca664c7bcb1e7ae9f049c2ad4deb4fa5bc20fae0d86b1799c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397851, "uuid": "a4f89668-dfd0-4d25-a42b-966db0e02e70", "value": "T11A937C72CC393E28C19999B5F0B0DB79EB13E95180871F9AD166C37A9047D8DF8493B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397851, "uuid": "b0e3b5e3-767f-49e7-8249-831b3bdd8f49", "value": "1536:dB786vH13q707ubDtRy+PCvqJnnU/KjCKMKdtqW31+L6QGXnzFe:v7Bvg7g0xRX+qhnU/KjbdD3wYXnzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397851, "uuid": "3745bf37-714a-4a5d-b421-d736f0b96444", "value": 91556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397851, "uuid": "2b4a4041-4e7d-4793-acb8-000457cd3513", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397851, "uuid": "268186ae-9368-4f6d-8c27-f790c51ccfc3", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c37db4a-df01-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766385738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766385738, "uuid": "e582d56e-3347-47ca-a3d1-24ef2a27b3c6", "comment": "Malware payload (Mirai)", "value": "b64aaf18ed13b7bd030c1d0f46ac79b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766385738, "uuid": "83a2d6fc-92ff-4f1c-a362-129ff4e62ff3", "comment": "Malware payload (Mirai)", "value": "44fb5cec7763ef8e3dfc5b574cd8118e4ba2ed38a4eaf72d4ce0ba6d13d99c73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766385738, "uuid": "f5b100cb-aca2-4351-8040-cb264bdb997f", "comment": "Malware payload (Mirai)", "value": "9be2c72745c3e57625b20fa688d7103ba66d300d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766385738, "uuid": "92cf22e4-17e2-4224-94de-73c178b709db", "comment": "Malware payload (Mirai)", "value": "e91d6639a18e42d9134e8e337a63f087eed572afb15970ab31f2d3e5d720c9d1341c09bff13a6e32855dbcf8cc0642bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766385738, "uuid": "2f6b969c-9301-4dae-a2c1-8fc2bb394289", "value": "T118D3D65E7E314F6DF2A8823447B38B35E75923C623E1C681E66CE5142E7438D581FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766385738, "uuid": "02b626bf-1824-4df9-98df-2c2d1d505a28", "value": "3072:2fTZ9WoQyUUmRAAH8W7Xd90LWs8NEBrpPG:CWXH8W7Xd9qgEDPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766385738, "uuid": "80d7bd99-d2ca-4ae8-abe2-0a0c61f29924", "value": 131228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766385738, "uuid": "51917365-ca72-4970-a0e1-be4c69880f8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766385738, "uuid": "53a4f791-4dca-495c-9aa0-264d60eece5e", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4fcbd6-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424873, "uuid": "64e825dd-7776-4c20-adcc-668e53f7aa2c", "comment": "Malware payload (Mirai)", "value": "6decae6b0561929416b670a3007375c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424873, "uuid": "00d36c3b-4f84-498e-a8c1-76882866ac33", "comment": "Malware payload (Mirai)", "value": "450d090d9ad1621ab8400d5f29593a1b38bccf869940f708e981d7ef097e3d6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424873, "uuid": "375456ce-62df-4af5-9f9e-c473f0f6553e", "comment": "Malware payload (Mirai)", "value": "5213ec100275249a40132e0f275b51dcb189e63b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424873, "uuid": "284bcfed-83ce-44dd-9481-6b55c4522615", "comment": "Malware payload (Mirai)", "value": "9383a4542b1ee448e8a9ac073a2ab86c2a61f05c4fd24038a2ad6a497d90053e712b301b2a555869411ae1e64d17b4ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424873, "uuid": "a8c79640-ed8f-4264-9ae0-787971099a20", "value": "T15204981E6E228FADF668873547F74A31A75D23D622E1D684D1ACC1106F2039E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424873, "uuid": "9e21ef78-8e79-4caa-a29c-41b94d9129d7", "value": "3072:vKqYPbL8THS6f+uyeXeLlUfz4Fts2mNPk:vKqYDqy6rf6tsFNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424873, "uuid": "dbb76587-f34e-4ed4-a0a2-70b57770e17f", "value": 173316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424873, "uuid": "ea8a751a-6c29-4271-a564-f9cc8a54c91c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424873, "uuid": "b5fa4da4-6155-4169-8b2a-c0fadf7c44a1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653eaedf-df76-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1766436004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436004, "uuid": "bd196524-170b-4123-8d3a-a98dbae7d6c3", "comment": "Malware payload (GoProxy)", "value": "6639ea5c227711d41d430c763ecd15cf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436004, "uuid": "33ed9eb3-f983-4f65-99cc-cb1b3b0bc11f", "comment": "Malware payload (GoProxy)", "value": "45d11cb872017fa4043db0f868978c693ba331b29fc0096d79fda1a8cf23772e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436004, "uuid": "1e28959c-36b9-4b90-a389-1aeba808be30", "comment": "Malware payload (GoProxy)", "value": "a41fc9d53f2b9761d9f63c1b8b6d8f1bf05d35ff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436004, "uuid": "045d7d65-4d1f-4c51-8be8-85c83df2d7b4", "comment": "Malware payload (GoProxy)", "value": "0cfd5ca0c75c2c3b5c91203f8b9722c9941385969bd045644677c5da48d11199224dce50e5d92f863db3ca7b91d27380", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436004, "uuid": "05d33fff-8242-4ccc-b8e6-f59fcc30e938", "value": "T1B5664A03ECA555E8C0A9E2358A779252BF717C881B3123D32B90F7286F76BD06E75760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436004, "uuid": "05f5548a-6caf-4c48-989f-769ebd91032d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436004, "uuid": "ba366d15-6237-4a45-9115-0cddb4ee43a4", "value": "49152:VZoGJ7VND8VqnsSF3CmBfDr7zh+8NFf6llX0PfBGDm6m5jO0Gl9Q5eHPfKiK9KvX:VC4ckh5bfolXry6ZrGYb7S/E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766436004, "uuid": "5f84b697-c474-4375-87a6-6629b0a732df", "value": 6698744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766436004, "uuid": "4ffc89c5-906f-4c78-ac22-0825d5bb5028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436004, "uuid": "3a90b950-a419-446b-ad71-0158caeb0928", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac2b3dd-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387480, "uuid": "7990c2fa-b76f-4969-aef0-9cd4c84b83cf", "comment": "Malware payload (Mirai)", "value": "6bd67084c0c31f1cf50965e666015cf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387480, "uuid": "c3175f9d-8972-4383-9f26-680741c7c20b", "comment": "Malware payload (Mirai)", "value": "462cc9496008db5d12d32b7a1691abcd769acc5b7c6b8df9ebc59d46553f89e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387480, "uuid": "25bafc0a-97d6-45d5-8634-ef1c8590bc66", "comment": "Malware payload (Mirai)", "value": "2e9a86f2bc02e131fea04f6d8152679a7e2b4227", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387480, "uuid": "27932b07-9311-459b-a4da-9b37a83b1e52", "comment": "Malware payload (Mirai)", "value": "e4da0ba872ae293ffc1e362b971079854fdb4f5760a095e6a4231bec0b3b17f3f903f887d7e9d9d1078e52469df3696f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387480, "uuid": "3087b739-db18-4795-a43f-054fe51bb505", "value": "T164148120FA0663F1CC720A38A7956E5A6E7B04559FEB26312D1F523DDE628509F30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387480, "uuid": "5e9d90d2-05c5-4e95-b63b-a030206eb90b", "value": "3072:QwdCpVwKHP3cbZXb4wnKzoiuZrvfARysVh0TUKI:xopVpPG1b40VQRTugx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387480, "uuid": "d3d78d23-2335-4228-a997-b3df0325e935", "value": 197268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387480, "uuid": "f83e1759-1780-4d2a-8e82-c1f74f719339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387480, "uuid": "8001ee31-abbd-4f57-a338-4861e32f7bd8", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8131753-df40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766412950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412950, "uuid": "cf1b1cac-50e5-4cfd-aea7-c146576720d0", "comment": "Malware payload (Mirai)", "value": "f9297da668f487182ff05746a5eab24e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412950, "uuid": "1f809944-ed29-43ba-90c5-a956d7465c3f", "comment": "Malware payload (Mirai)", "value": "4781af0b6942e45bc58a063a6c8f39282aaae2f44df792a94ab3e14fca0cf35a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412950, "uuid": "52553b49-3c59-44ee-a083-fbe7a977b648", "comment": "Malware payload (Mirai)", "value": "1e62b73f216be322f88bf36482ce1a446ebaffd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412950, "uuid": "96d6b98f-911a-4c84-9ad0-ad33f6cfc1e5", "comment": "Malware payload (Mirai)", "value": "e53b1e4fb5185fea43b044c770818d6719663928f0017694e762800590d0f404fc75b8b15652657b897898f53c717e4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412950, "uuid": "a8855925-30d9-48c5-9792-4c7df5f2c866", "value": "T10F833AD7F400DD7DF80EE7BB44534A06B271B3A117931B3A6397B957AD321A44862EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412950, "uuid": "c256222d-c54a-4400-96dc-b1616cc1ba2d", "value": "1536:dsXjnRknf+xX6aehA+RgFgM8VyJPFOBRcsa/77zI6NzwnW4bLzkXkukV:dsXjR2sK1nRgFgfyJPFgw//zIKELzkUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766412950, "uuid": "4b7d77d8-6867-4369-9762-56429ecc2f2f", "value": 84476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766412950, "uuid": "6b1aba80-8d42-4b0c-a1b1-1ea1db7c14a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412950, "uuid": "19cccaa0-4c1c-41d9-b48d-8ff27f245b47", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec582c41-df6b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766431506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431506, "uuid": "97a6c3be-f771-48a8-8347-c8c5f2357ec2", "comment": "Malware payload (AsyncRAT)", "value": "0930fad6bd9efc8443909578a149fac2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431506, "uuid": "9d0d32ea-e25f-4135-a579-be9b17834d0a", "comment": "Malware payload (AsyncRAT)", "value": "478deaf8d2cec05767fdc2c2025f17cf64e93be5be9ccbb4a9387700158b129d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431506, "uuid": "a37ed634-8f01-4b20-95c4-8b9aa070513b", "comment": "Malware payload (AsyncRAT)", "value": "0a75a78e76451e27e7071cee21528b5439251ffa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431506, "uuid": "af5997ab-807b-4ff3-ac75-3d5700d4cecf", "comment": "Malware payload (AsyncRAT)", "value": "9a242aa1064bf9272a1513e59c07c85d8442f5020af43bb3db006f9c1135e49115f33a613ecfc546adf9b5c643dd1622", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431506, "uuid": "24ab96ac-d020-4151-8261-01c2fe7d2edc", "value": "T145234D003BE9812AF2BE5F7499F37146867AF2673603D54E1CC841975B23FC68A425FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431506, "uuid": "9f620461-179e-4add-916a-355e70a559a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431506, "uuid": "24357a8e-beaf-4cd1-b55f-2595993fb575", "value": "768:4udZNTAoZjRWUJd9bmo2qL86kU9cWPmfs+gfkOc0bqWofp/knFt5AgYDZv+:4udZNTAGL2BUlPmKk4bHuxkFs7dv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766431506, "uuid": "62dcf73b-c08e-4a2a-b83b-f923d8012768", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766431506, "uuid": "62be60f0-ae9d-4f1d-96cf-1c7956cbdbb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431506, "uuid": "533327ff-bd3a-40b2-b93c-359a1c31ae1f", "value": "478deaf8d2cec05767fdc2c2025f17cf64e93be5be9cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2656e77c-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370186, "uuid": "741c41c8-d8eb-472f-bb2a-48f01d195799", "comment": "Malware payload (Mirai)", "value": "794bdfa971b025c4e53e5aa3e5b1491a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370186, "uuid": "0962a307-878e-4f70-9f3a-a19a982de3cf", "comment": "Malware payload (Mirai)", "value": "48bf134ddf8ac82d4f247d983ef6b789d93e3383e43c4d05485e21a8666073a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370186, "uuid": "b9716263-0421-463e-8c51-e9fe96861c82", "comment": "Malware payload (Mirai)", "value": "5c79f01b6873633f6bd585f38ad60a8177bf6273", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370186, "uuid": "ccf33b06-7422-4c1d-80bf-6456f9ec43f8", "comment": "Malware payload (Mirai)", "value": "033e9daad2762f70e231879761259615ad4ed4b7f2f26c369bf3ae6a87fc861a543b127545031671cf4f8fe2e5a32a73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370186, "uuid": "c1b30dfb-3343-4437-a2ce-e9b9dbea9842", "value": "T141436DC6D143D8F6E80B0570602BE72BAE71E8EA2219FF47C768D631FC86641A5179DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370186, "uuid": "7bf8b167-de86-4445-8ec9-1b54eff3321f", "value": "1536:DIqD1xfYqyDgZtmYX38pJcpJoC2TwY5ts0Aj+ISeWYeJu:DIqDXfYqykZ4YX3IJcp+1wytzG+MWYe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370186, "uuid": "57306960-acc0-4c73-8714-bd80a1e1e9ec", "value": 60080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370186, "uuid": "a5d8ad37-dacb-4a05-9bf3-d08deca20fd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370186, "uuid": "de4f334c-76e8-4040-a53c-97537d06043a", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c310d2d-df71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766433761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433761, "uuid": "f6806114-49f7-4ede-aba3-b29298a71f63", "comment": "Malware payload (Mirai)", "value": "6d2fcfcb8f55030178a0e795c2a50ef3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433761, "uuid": "72bf2ba3-0a29-4540-b340-2c86a6cc811f", "comment": "Malware payload (Mirai)", "value": "49629d7af7938cb5739b0b08bc2669555b1cb7d9ae0ca18ab34b550119defb54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433761, "uuid": "3e32bbde-291c-4bcb-849c-ae8ca626d478", "comment": "Malware payload (Mirai)", "value": "abbc2c69df232aea93e85788713f0b76079aaa56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433761, "uuid": "64523f8d-ed42-40f0-9492-17bbf1d934fc", "comment": "Malware payload (Mirai)", "value": "a9561f88c107ee1d79e20fb35789d2bffbc97cde573476b67184848b0ffd4b604c10dcf788c02f1099c4d13e2b315005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433761, "uuid": "abd96506-a705-4b7a-b58c-f226e97c214d", "value": "T190B34992F404DDBFF84AD7764683C735B53173A19B730A62B6526537B83D3A00C2AE89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433761, "uuid": "0877bb83-87de-45d0-998e-ff8ca3fb82cc", "value": "3072:y7IjwtnHwzOea42Ie9EdWqojLKvEJZlWA9LG26Qzgysejl:y7IjwtnHwzOea409w0bZlW2L/oIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766433761, "uuid": "5e7c2265-8f40-47be-8a4b-6a3bad8c0767", "value": 111788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766433761, "uuid": "ffe484bf-6c85-4958-b8c5-01b57900a74e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433761, "uuid": "8b88ec43-b32c-4694-87eb-3a7319d77b0b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb737f2-df65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766428660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428660, "uuid": "000a1985-53da-4129-bc88-f1171562cee9", "comment": "Malware payload", "value": "2dd79780a5b7244756695dc2e99fde5d", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428660, "uuid": "b4675c60-5116-4289-bf1c-1ff42e3d240d", "comment": "Malware payload", "value": "4a314a9d86b2694a480f0ce189a70767e9a9fa52382bd53edf28a44e49db4e75", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428660, "uuid": "e8abe880-abd1-47da-8b0d-4721fe3d7ea5", "comment": "Malware payload", "value": "abc2273788658f3cb4d392cc36465d46442115a0", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428660, "uuid": "2ed7ec2c-94de-4d8f-a1e4-58d5ea9468c1", "comment": "Malware payload", "value": "55f90a8a95697ae6e76852f7fe3da857d6ef64ba9d7b89026d3be78d40532cba5739dbe44096af8ba5c087f9ed45c440", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428660, "uuid": "505af831-b2bc-4f00-b368-1e2bcb722745", "value": "T11E244C4A779450F8E067913DC9668A46F6B27859077097CF136443BE9F33AE09E3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428660, "uuid": "449e0c40-de1d-4e9f-b58d-d37c28037350", "value": "f7c81bac458cddb7982f4c9357773276", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428660, "uuid": "8bab6dbd-037b-4a47-85b3-9ebbaee039a8", "value": "3072:+e5Hv3ui8/5ki+pFTL28o/a41YnFrryz1+l2pd+TNTHi2X9as6:+e5HbWkiWFTTwqnNy1f+TJi2Nas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766428660, "uuid": "9bae150b-0c9d-473c-a83c-c284cc868370", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766428660, "uuid": "e19ea6f5-b70f-4ffc-a4a0-c0c79dd527e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428660, "uuid": "422fedac-3bdd-48d6-9adf-abfb51c87a93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5bf7fc-dedc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766369790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369790, "uuid": "f26b599d-02cc-4fc3-82ba-1326601a9229", "comment": "Malware payload", "value": "c039a1c0f6e337ce0ae13b646e589b38", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369790, "uuid": "ae67cb93-ab79-4629-9628-a5632138a1de", "comment": "Malware payload", "value": "4ac8cc6f74488b3dd50dad7262f8cdad5ce75fdcf25539b073ac97c3d2203290", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369790, "uuid": "2cb4becc-0b59-44a2-864b-e974d5d861b1", "comment": "Malware payload", "value": "d36b20f85be3cab7acd26f6f41b0c27595b47299", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369790, "uuid": "efe8adea-4c81-41bc-b23d-58b3e8b4be38", "comment": "Malware payload", "value": "f9d9dadb668b477c4477d5b72fa6f77f9137c8d1df540e3318ed9a6c9618345c9990663d2e62ec8b21b9330e6fae199a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766369790, "uuid": "8cbcd740-bc3e-45fc-87ca-21c4c422904f", "value": "T1AE660185BB48D92BC477713245BA5321558B4D068E83DB93A9443E0CADBBAC41F8EFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766369790, "uuid": "756bc9b7-205e-4d60-ac75-2ef02bdf260b", "value": "98304:s+j7+7iO8ftRr0ZJZW2Z7U8AvkeXSEEppppT6E3vOaFRvjJCpXujHxtqyOT2U9yI:sLXJZk8As5t6wFvjJCpXmxtqTk72j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766369790, "uuid": "7b2372d8-2974-4ffd-a260-6c634cdabf37", "value": 6712265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766369790, "uuid": "5c014013-7ccd-413e-b8f1-ed2eeefcf8e2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766369790, "uuid": "a4440fe6-b4a2-448e-9a92-bbda68db40f7", "value": "APK manager_1.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ffeeea-ded4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766366514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366514, "uuid": "54e4f0d7-6df7-497a-9f62-435492877caa", "comment": "Malware payload (Mirai)", "value": "e00ae75554cf6ac684b8a06c236cd154", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366514, "uuid": "22ebf6e2-ba1f-4452-94f4-ff941064af2a", "comment": "Malware payload (Mirai)", "value": "4b348bbf173a065647c32ad385d7ce4eddaa95f3e9373b82d8d619c48a0bcc72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366514, "uuid": "5fabb80a-5d99-4d0f-bfff-44d948e717ef", "comment": "Malware payload (Mirai)", "value": "a86b317b89536e15af9026e7bd65e24dbd8539d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366514, "uuid": "90dc4960-338a-4375-bf14-99fad2a8a2ca", "comment": "Malware payload (Mirai)", "value": "405d2e7c89df148f2a4086daaf22b8b529ee2f9cc3962fb7a99017c077502fa48927cab02e989601ab457c1e9b99d913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766366514, "uuid": "90ca29ba-4526-4868-aca1-934b5f4791c5", "value": "T109833B86A400CDBCF84EE67784574F10FA35B7119F520F27A665FDB3A9720988E1ADC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766366514, "uuid": "04c9560f-a34e-45c8-82ec-c44361f77985", "value": "1536:AeFU4rgdrqUOE525hzD4n6TrkaY/8QjOEnBkXc2MqxKR3IginETPN:bFU4UqDEO9bTr+HOvXc9qxKR4VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766366514, "uuid": "4639e21d-e51f-424e-9681-04b4dca856a5", "value": 83760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766366514, "uuid": "32c39141-927a-4ebc-9e2e-1e002b7906f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766366514, "uuid": "ef08e2e6-c979-45c2-a793-f0dba03160fb", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bbcbb8-df77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766436493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436493, "uuid": "5a9d709f-06ad-4d51-99a2-7164873a1987", "comment": "Malware payload (Mirai)", "value": "aedb82fc6ca42bcc249cbd7b83a4532b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436493, "uuid": "c7459c6e-ed9f-4447-b060-af4495dbbd88", "comment": "Malware payload (Mirai)", "value": "4b5f8d3711b636e91ea3fe40abfed7a9723b63e1431707c32b37f553d13135c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436493, "uuid": "e7f1b6e7-5e86-47d2-bf89-116968f28aff", "comment": "Malware payload (Mirai)", "value": "269ad651cbaf27e4d57b791aefaec4a02c266905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436493, "uuid": "a487c2d9-a4e0-4c47-a6fa-174ab403ad86", "comment": "Malware payload (Mirai)", "value": "fa26bacac6b8c0668a7944dd3afe6597ac3872519ed5bf3d1d197987fc65856af867a0abc8bb84b856260427ce1805ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436493, "uuid": "9f8ddf69-171e-424a-8712-f683caec377b", "value": "T191E3630EAD218B3FF22CC33547F7CA64A36532D723E7E64AD25CD5211E6838A581B764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436493, "uuid": "ae0e78aa-53b3-4868-9de8-9991ae237e2b", "value": "3072:/Pcb8idbSgIHGZjDxCGjbcv8sMoPRKlN45YKiVHdBVFyxdf9:HcbzbSpm5FCAbc4lN7lVmxx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766436493, "uuid": "0c32ba50-e562-4a7a-ad12-bb59b95fd93d", "value": 145024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766436493, "uuid": "30d239c7-abc3-4512-a03c-109b3ebbe46e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436493, "uuid": "b8bdddf6-0a70-4fb5-b1d7-edab00935fc8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2509c6d2-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370183, "uuid": "74b8cc32-aa9d-46ea-b953-56f6cdc4fde2", "comment": "Malware payload (Mirai)", "value": "2704829530b47c96ea5dccee15de66ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370183, "uuid": "11d8b390-0416-43d4-860c-9078d76e564d", "comment": "Malware payload (Mirai)", "value": "4ba5f215082bca06a6242c3d6f6fac68b19cb1643d111eac3dcd4709f3120cd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370183, "uuid": "8d71daa3-dd40-4942-bb78-5b25f32ea2f0", "comment": "Malware payload (Mirai)", "value": "bc85fe09ba316e8620870177106c52969c2cc0c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370183, "uuid": "5b8ab6e2-b55c-4452-bffe-40afe2b64f64", "comment": "Malware payload (Mirai)", "value": "0fd7cb8b28ca29542534423d06122ba160b1b7d8cfc88437c43c6be4dd24648d6878f401e91dd3f0e437e8d46483d2bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370183, "uuid": "7cf2f7a7-6dba-4dfa-a921-78d6af3832f2", "value": "T100434A91F8819623C6D1127BF66E428D3B2613E8E2DBB3079D225F2037C686B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370183, "uuid": "1f5b67aa-0c5a-475e-ba0b-a1c7fecbf238", "value": "1536:tj7QgWzvkqAs5a7U+81/v+VzxiCsaXvWn5:tjg0/81vWV9xWn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370183, "uuid": "23085daf-8b58-4fc9-ad96-3fd5ffb3d225", "value": 59644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370183, "uuid": "76d9036e-f52b-4b43-af22-9410c94b3447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370183, "uuid": "f4a1d982-fed6-4609-9c00-b79b8e13cb72", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e485380-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Moobot)", "timestamp": 1766370172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370172, "uuid": "749fca84-2903-4c2f-b72e-6912cacb9996", "comment": "Malware payload (Moobot)", "value": "0f237900f9cf05568cb257e35f787061", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370172, "uuid": "d188446e-c24a-4502-9735-b9e62de1ce8c", "comment": "Malware payload (Moobot)", "value": "4c6ed91fe385a37d90a9c3c387a7fff5c76d0f9b6c14a474c93206387ecaf4c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370172, "uuid": "22d02c2b-211a-45d6-b47f-ea8dadf9d00d", "comment": "Malware payload (Moobot)", "value": "fe731e645e3f240530a2e068c731e470d6ae0061", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370172, "uuid": "5120ef35-832a-40e8-982d-8029a2136538", "comment": "Malware payload (Moobot)", "value": "61f1078a894d8912aeb0dbc7a36122a89d0515ccb34b3779b4bd0a70495724e24c6505ac574d99fc3d32b5bf9cf22ccc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370172, "uuid": "815e4a54-c591-4204-87ec-f43b0d446acb", "value": "T111533C9AF801CE7DF85BD77B4457090AB632B3D102821B3623A7B997BC731A91D23E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370172, "uuid": "9998ffcb-1a8d-440f-a3fc-15a6ed754e18", "value": "1536:Nk04ggXHsK+THgk8L6ny+xG5T7D7XMpUeayX8Yb6:Nk01gclTHgVoxsTfIrX8Yb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370172, "uuid": "3b5c8ea5-84c5-4304-8d3d-640c369ba186", "value": 61704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370172, "uuid": "66251c9c-7343-4f79-b5ff-91ee035e076f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370172, "uuid": "5b825262-c055-4167-ab8e-6738c080fff9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400ffe31-df76-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766435942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435942, "uuid": "8317aa83-47e1-4a26-87fc-c3a688b2f55f", "comment": "Malware payload", "value": "ecfd78b9e7ced8a80e49b2886ef055ad", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435942, "uuid": "e7864791-2bc4-4495-ba2a-da5297f1ae66", "comment": "Malware payload", "value": "4cf5d95b2b4fdd6348684601f9199c60db519f4b860b26855aef8ba5f01cc302", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435942, "uuid": "0e3317b3-0453-48a4-a03c-bb24f6df3d69", "comment": "Malware payload", "value": "f0579a1a414a3e703d160064e7c5cfd4e5ecf919", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435942, "uuid": "f2f01192-6b0b-4071-ad44-538f8feae283", "comment": "Malware payload", "value": "8000a240a03a349d0bcdf87de9f4477dc001bcb95168bd39dabeca3532da9c7ad7f827765c5d752decb8ab7ccd32d2ee", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435942, "uuid": "2d0a4c10-236d-4af9-a79f-6a3bd95a087f", "value": "T12697333BD26C84C0FB5789B1E5A6E70C41D65561219368EBBB3466024D8F1F0EBF3B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435942, "uuid": "d5bff6cc-d573-4ab4-8da1-e8f457bab4a3", "value": "786432:V2fBUNmlByjuQsM+nF2TS1CVGXPkUXhQOsYseq7voTHC104FHhzb:QHlsjP+S4YEQ7Y6kezzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435942, "uuid": "c55023e4-7572-47fc-ab39-a02e60496055", "value": 41323999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435942, "uuid": "f75a6092-6039-4d22-be47-aa1362e2f00b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435942, "uuid": "ffde92e4-8337-4726-af3f-4c76381db8e9", "value": "Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4f1308-df71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766433759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433759, "uuid": "846de680-c2dd-4465-8f08-ae24d225c638", "comment": "Malware payload (Mirai)", "value": "ff4e59e9c5160571b53f400860010f4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433759, "uuid": "6facc0f9-ba65-4d01-a41c-86e0f14991ce", "comment": "Malware payload (Mirai)", "value": "4d5117792fb1f8c372b5ac12ea8c944a97509a61e2c69a9becc7a7c0c2e422c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433759, "uuid": "bd2df4d2-4fb4-4df4-9f27-d415baa788ab", "comment": "Malware payload (Mirai)", "value": "075f7959d00446b30688c55bef9c307f36b59c8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433759, "uuid": "5ab08aae-e1e4-4440-bda5-ab8eef496df8", "comment": "Malware payload (Mirai)", "value": "6e5bf0c323e87e9a7a45cd537c7302edf45f6612c2f787e9f3b49d4e53ffbf57586c26a713765219ab7611ca347c656f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433759, "uuid": "0c813e19-e68b-4a17-84ba-83064170c5cb", "value": "T118936C83A992E4B2F8220036173BD3629B33F1352421DD47E7A92B75ECA5710DF4A79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433759, "uuid": "a1dbfeb8-104a-4306-97a0-d5fe093a6407", "value": "1536:ohgZQIyCy+WKHATH3MBw7H0S6JEkENcOb/9jx+fEYCBj4kJTz6qP5bMxUByzRi4U:nkTXqwgS6ikOc2z+u5zFPZcUvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766433759, "uuid": "81ddc288-e3aa-4a52-9662-76223196dee7", "value": 91376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766433759, "uuid": "8cd47f74-8824-4961-9859-ad4426a05350", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433759, "uuid": "2cce43cd-9fcc-4dec-8ff4-f80144769d86", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27194baa-df59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766423444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423444, "uuid": "c8078cf2-4c17-47d4-a17a-9165ef960d5f", "comment": "Malware payload", "value": "2cbb2ac9ee079000297a9b21035bd092", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423444, "uuid": "e5e90eb3-12f0-4a20-ba3c-d54cda67b2cb", "comment": "Malware payload", "value": "4d589fd6ecc3da49dac318f0900ced5ebee6a3d857d2235d8474634ed5b2abd6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423444, "uuid": "95ca11a2-5bb8-4095-bb53-781a4ed9ecd6", "comment": "Malware payload", "value": "cff7b8991314b136b5f38380660ce4b6c6271371", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423444, "uuid": "c51491a2-fc83-4410-ac6e-341d72d6791c", "comment": "Malware payload", "value": "7405e1e288083816482a04cdd95568a9c2404ab7b9a31d3e9cc0dd70a0e109d34e0ace1748d390177294a87690b3ad15", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423444, "uuid": "ca88568b-37f4-4b1a-9aca-39d5fcb5fe3a", "value": "T17B4176A2103A601104B6D377A64D2389FD5DA5AF8319678B7CACC09E2F370BBC6B34D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423444, "uuid": "1179f413-da0a-4ab4-9741-78f12b9db3fd", "value": "48:+XR3AwzHugSVNRSfDYduEMc/FMSFZcmEtavTZh1gzUWI2UFYWOfSQ:tV0El/FMSFuta7MUdkW7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423444, "uuid": "acd106a2-786c-45fc-a750-1b7ba1438ed5", "value": 1972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423444, "uuid": "4944cd77-4ece-493f-9e66-066df78ec2c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423444, "uuid": "8e6384ec-84d1-49be-be4f-43720fec7592", "value": "UKBB2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422b550f-def9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766382258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382258, "uuid": "e4ba4ffd-76cf-4e56-90b7-f02567b0acae", "comment": "Malware payload (Mirai)", "value": "e1e340730314e87652c5686f510cf6a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382258, "uuid": "af00d9d8-0e4f-42fe-a1e6-86eddb7b2fbb", "comment": "Malware payload (Mirai)", "value": "4e1105abdf7e474cdeb39d9bbeb773468973754b3add93e04409d9d85148adc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382258, "uuid": "725d2198-afaf-4164-b9d6-e0e2f63faa98", "comment": "Malware payload (Mirai)", "value": "3a861ec788f7b2053be53a7f60c43c51ffee4c70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382258, "uuid": "ef8602ae-c730-4edb-80ca-0f4c70dc362e", "comment": "Malware payload (Mirai)", "value": "36d03fcab6a81690c7fd7b1ff20401ca52a7c6efe44d1861bee1815a6a638fa7e6dadf40e6e2f2beff2c463caeeb8542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382258, "uuid": "e5b9a9de-f252-4111-99ba-b49917fc88f5", "value": "T1FD143B0BB7118FA1C368D6700AB3CB6797E6269216E19985E36DDD107B3075C6C3FEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382258, "uuid": "a47cf430-0604-4f27-ad60-df49fdeeae60", "value": "3072:bBmCqq5/vIT+NGsfAlDXsBke3dBxp8IGq4yzxgAfadw:bBmChvIY/fAlDjklp8JSzGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382258, "uuid": "d1ecd83d-0477-4f04-89a3-e13d6ad3ff7e", "value": 198796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382258, "uuid": "c7121a93-d2a7-4985-8a08-e1cde18a40f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382258, "uuid": "efbf17f0-067f-40ae-a2c9-e48e75c72845", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6897e136-df91-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447606, "uuid": "c5c5029b-0a48-4a5e-9fca-43e5c8d10094", "comment": "Malware payload (Mirai)", "value": "d1ef3a8044ee9f2dd1a78934d0af8e14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447606, "uuid": "7da5f9d3-ddf0-492f-9ef6-610e551d024c", "comment": "Malware payload (Mirai)", "value": "4e1f842bc4d46e6a7922724b7ccdde4079cd95be72ad05b55d615ec38c8a883d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447606, "uuid": "2f2882e7-7e05-45dc-83c5-1d4f7a29dbf3", "comment": "Malware payload (Mirai)", "value": "ee7c7a230115cb76b7ee00ea951358945e568f7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447606, "uuid": "c7bd8e34-0a78-4b88-8cc3-8356c3e0f790", "comment": "Malware payload (Mirai)", "value": "900ccb4b340e0442c8c58d1b31cbe53b39335d7a404609ac8c48256b680250a0e8563d9a5ce30413f79995cea10e270a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447606, "uuid": "d8cb97e7-b755-47d2-9aca-d3a3a743d8f5", "value": "T19F145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447606, "uuid": "fbc90e85-05f4-49b3-80fd-e9c7972098f0", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NX9UaN:HZ15BTYCrYq1QDY6+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447606, "uuid": "0b854c3a-cc46-46ed-9be8-9bdff244a50e", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447606, "uuid": "481bef18-e865-42c7-bf94-125a149fb010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447606, "uuid": "41ddabc9-0d70-490a-a3dc-064109b6a56a", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ce5e37-defa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766382796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382796, "uuid": "bd20d711-b3a7-43df-ab3b-4120ab5d9db4", "comment": "Malware payload (Mirai)", "value": "50f256224609bed8683dd201f9a5ddf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382796, "uuid": "09722980-5d72-431f-9d6c-c407d0695d17", "comment": "Malware payload (Mirai)", "value": "4ef3d5c9a61d4c2ba274fc8d340262497e335f79588d3423be457e865ecc6698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382796, "uuid": "52a095c1-e30c-4bf5-9d4c-18ab7356d5e7", "comment": "Malware payload (Mirai)", "value": "06526d15cbad3b0c927ac9479682bce9ab1a60e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382796, "uuid": "d35eced7-6f89-4189-bba1-3495c8e33ac7", "comment": "Malware payload (Mirai)", "value": "88ab8b16f336464e061a2957f2d0bf641168db5f923df5d642f5a4e387409f6af774f661f307225c972861e32e350edf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382796, "uuid": "36ec62b2-9375-4b76-9877-488764c05ca9", "value": "T18D532851B8818A23C6D0237AFA6E45CD372163E8E2DF721B9D215F207BC682F0D67E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382796, "uuid": "405eeaa2-ab46-4b29-b7c4-ff68005ad2ad", "value": "1536:jLabaJKAQlI1W9PvxJC+U3lH/Sscint5sbk5ZKT6:jLajUVfgYbsbeZKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382796, "uuid": "e892004d-ea90-47b1-ac90-62edb13afcac", "value": 66632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382796, "uuid": "7287459e-9f85-4860-bd0a-90222a1c6199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382796, "uuid": "90eed5cc-c159-4364-a7e4-ef9b5c97ce4c", "value": "frost.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6940b9-df3a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766410357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410357, "uuid": "e0b65983-90b7-4bbd-aec8-bd70dd929af5", "comment": "Malware payload", "value": "ea7091ee8e6227138e82fc7a89a3aedd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410357, "uuid": "dc601853-7c5f-4ed8-9144-1efb375e7fc1", "comment": "Malware payload", "value": "4efe3f5e0b570d6a8e11b9518040a04fd19749c9e522b3589e0151596f9287fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410357, "uuid": "9d6ba89a-dbba-479d-8e5c-872da3e43e44", "comment": "Malware payload", "value": "b28701e929ad1caf345df701bf2e2dfd653fdc26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410357, "uuid": "70e8f97a-88a2-44b6-a08c-6ea1cefe2ae3", "comment": "Malware payload", "value": "6a5e6770a62fde06e099908f4fa3dd9210f46b91936035a53e8f6ae5a84aff3aacef3de36feeacc74826d82071aae081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410357, "uuid": "fb6482fe-4fe3-450e-8cfa-5c64daa26054", "value": "T150C5AE42A3F540ECD17BD178C656A21BEB7174190320A7DB23E04E6A2F63BE16F7A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410357, "uuid": "761d2cc6-2bd0-40f1-91bd-e8887a7f61c7", "value": "6da8fa05c062b7725e376ae92a1b43de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410357, "uuid": "538f4e95-2260-44a5-b9e4-e15e5a955de7", "value": "49152:/cNaxzYZHAUbv36p/qzoxnBVIrUUq09XL2hWJtFopEhx0Cc/1XLOkNNtUsQQz:MmUep/lxe9XL2hWJtFopEhPc/RiMf9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410357, "uuid": "182abd29-27cd-468a-a67e-0520f620efc7", "value": 2528768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410357, "uuid": "aea2872f-a211-413c-a7ac-dd75f3c0167d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410357, "uuid": "d358ff23-3f37-4e4e-be8d-60bf9dc62948", "value": "1eu3k3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb93c76-df59-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1766423484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423484, "uuid": "b8d3926d-bbd7-4ed8-8604-b90bbf9a8c3b", "comment": "Malware payload (GoToResolve)", "value": "b540cac407181041bb78028e9523afa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423484, "uuid": "5045aae5-9245-4263-8840-f9ad96054913", "comment": "Malware payload (GoToResolve)", "value": "4f382c047694b9ddc925ccd489a00e723adb7afaef981e7b069990502f285eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423484, "uuid": "2bc5fa5f-8c28-4eff-8418-9badafe8ab32", "comment": "Malware payload (GoToResolve)", "value": "dceefa6406e41b5d0df2095ab8caa2930586d39c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423484, "uuid": "141bad72-e0ff-4b3c-8160-d1d7d86581ae", "comment": "Malware payload (GoToResolve)", "value": "def5681f7186749fc9ba7eb8070a036f2c893864b48f5c50806ab838f0ecaf1b8f1d7acd7d61bc26925767e944f5c4df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423484, "uuid": "310d0cf8-0d38-4aed-9429-433d452f6337", "value": "T17B373321B155C032D85221F2A928BFBBA69D98344B7119D773EC5F299B301C33B36E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423484, "uuid": "40f7ebfd-f622-436a-9761-fb0d303e0d8f", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423484, "uuid": "24b0b25f-cc91-40a9-bcc8-bc0b84cf26dc", "value": "393216:fUCnUEBz6o1cXTQPw1OP15IP8EH5egBMYjZSteu26Gg8Lxiy8zgvXw1TT+WY6:hnUYSsPly887otT2zg1WvXw1TT+W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423484, "uuid": "8ee8086c-cdca-48ce-9f38-ca2bf9e6fa88", "value": 24444392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423484, "uuid": "7455d6ff-e2fc-4c4d-a53a-202b1cad6708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423484, "uuid": "6d873a4a-4da0-4577-b918-0cdbd7560830", "value": "milestoneiv@.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7410a80a-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387496, "uuid": "73a42760-ec60-42d2-a5ea-743c0a0bb403", "comment": "Malware payload (Mirai)", "value": "81c2836d196ddf431d84e19f7bc3051f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387496, "uuid": "c33c5857-5958-4b33-99f8-297e091bba79", "comment": "Malware payload (Mirai)", "value": "50002231c20faeb2280baebcfef468aa199326eea632fe3c1660c3134c33fafb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387496, "uuid": "872c6d96-a4fb-42ab-b9eb-60c647bf4886", "comment": "Malware payload (Mirai)", "value": "3f63d6a0fa8d978f211722fe18faf466b8411962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387496, "uuid": "fa9bd040-d9c4-419e-b829-74a31165d7c3", "comment": "Malware payload (Mirai)", "value": "b10f47d0703c17e39e166c11b7e62104b1e3564bcdc2a1222a91c0cc27ee89a95f9ef3d915635e9f0775bb204d4704bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387496, "uuid": "2c3f7585-1022-43ec-8685-e7a12c63c422", "value": "T11D145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387496, "uuid": "3c67dd29-3eff-4b92-9550-9e0be4476eac", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXJUaN:HZ15BTYCrYq1QDY6a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387496, "uuid": "1462bf4f-4154-49ae-9f92-d0a7690ea3de", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387496, "uuid": "97562c61-09ce-41f9-b9ec-fdf0917f1734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387496, "uuid": "1e50aa05-f1f0-42ff-bed0-d7d634be7772", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c35d94-df66-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766429193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429193, "uuid": "5ad37d18-4c9c-42f1-a341-06c3935b8229", "comment": "Malware payload (Gafgyt)", "value": "21358737d254a07d4e044c68ef394aa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429193, "uuid": "351db21a-86cf-42fb-ae94-1a38ef3410c6", "comment": "Malware payload (Gafgyt)", "value": "502c9270e46218fbd1c5fa3f5c233de695ed113ec06e5a0602db7c4b729f6212", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429193, "uuid": "6be77049-10ed-4f94-b764-bf6afbc660fd", "comment": "Malware payload (Gafgyt)", "value": "056d95f5e8c1443244731f23191e4885e1f85746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429193, "uuid": "6804518e-f135-4a9e-8869-358f3ffade7f", "comment": "Malware payload (Gafgyt)", "value": "64529814f215a60ee8c6e04dfc20f2bf878ea08299b6605fb013c7673849ed48d619d1e71cec68230b9f8c81b1b712bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429193, "uuid": "91442e54-7bb0-458e-a47c-64649a976e19", "value": "T198836D82DE62F8B1D421007A132BE7928A33F63134729D0BF7A52B75ED59740EB5236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429193, "uuid": "d1922783-2c18-4c80-b089-26ee75ee8e53", "value": "1536:zQx9SNiGQF/tMy7t0LUuFI0kDcb7gI+8A2pWyEbcC8ZCwBb7BQv:lN47tShrGcIcWPbcC2Dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766429193, "uuid": "3a27c020-db21-456b-adbb-2a76321cc0c5", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766429193, "uuid": "83614b1c-3fbd-4f44-9872-ca42fd23638b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429193, "uuid": "1443fd3d-16c4-4d4c-9b74-2705dae5bc96", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f1b3fe-df71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766433838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433838, "uuid": "af2b683a-ae05-4589-bec0-07bd843adf7d", "comment": "Malware payload", "value": "12d1b84ed1d5440a3a713482726f32cf", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433838, "uuid": "18092a34-f54d-4963-8b09-6c9b8bd37301", "comment": "Malware payload", "value": "50787812ba32e36b5368b5cf3bc27ede63658132aafdfe2e1f705d0a24e82ef4", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433838, "uuid": "6689b018-414f-41b8-ab73-b8a193fb7f74", "comment": "Malware payload", "value": "b7f4e99a0b9585b53a80e06200850d560d6455a8", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433838, "uuid": "01cd50a3-0faf-4706-9cc5-a6a2a78f0252", "comment": "Malware payload", "value": "e4d90ab053089fdf36c6388181d5f9965cb9c898c4eb0fa10d91bc3c5433b4a091d85e2dbf241fe9302e88adc6e37861", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433838, "uuid": "e6e31574-4164-4908-a156-394b904a1093", "value": "T104F556C78AC11EC7DDC45838AC7B4F705A30C8AEF856CA579B32A6699FC73909C1A44D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433838, "uuid": "c79b5546-e83a-4798-abe2-c45724589485", "value": "98304:KMJA8TJEqFiYRv7GveZ375fyYHdd6f1vCX0CI+rXf3D:KMFTJLFiYRv7GM37NldM16/RrvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766433838, "uuid": "0f8f25df-cbf0-4c33-a583-7ecca8aef240", "value": 3365735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766433838, "uuid": "7a35ce93-166a-4a6c-afee-0ad3608510b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433838, "uuid": "5b29cf1c-b808-4715-852e-806bf955b0ac", "value": "Lawwasoft.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d16a5f-df02-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766386106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386106, "uuid": "bea142b5-d623-423f-889d-56c65ef17239", "comment": "Malware payload", "value": "82b908a46579ad0d263db24ccadd6be1", "object_relation": "md5", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386106, "uuid": "37ba221b-853a-4909-b2e0-614de3d8dcf9", "comment": "Malware payload", "value": "50820c53f29745d4aa6450d81182c500e1faa8c563835b2bad2e789c679214f7", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386106, "uuid": "3fec50a1-b5aa-402e-82e8-057195dad842", "comment": "Malware payload", "value": "4bfec41b11c8fcab14dc85f2302e96f6a89dae02", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386106, "uuid": "fa8cedc9-9c59-4974-9344-329b7dbd678e", "comment": "Malware payload", "value": "7d5f6b32d438e1a73af5fc41955e6716925901f24c7b5f72ad41a9e9ba123a4fd7fa529b5821042091f3d6980d8b6555", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386106, "uuid": "dfb4d430-c500-40e9-9299-d865ab7cf93d", "value": "T19DF33A1C7A4ADA62CADC5F77C0EB600582B5D2E3D9A3EB074EC9EDD11F562DC990E840", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386106, "uuid": "59a58ae1-1aef-4bbc-aa9d-85d433c79559", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386106, "uuid": "39f06150-cd0c-4550-8819-1d3d3f677590", "value": "3072:Wk9SfGGb099IoVgSbXM6I9f5SILXZ5KeXcGZrTRnobWBMLY:WknGgPVgSbXM6I9f5SUPKEtFlobTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766386106, "uuid": "e3169e37-4652-4c30-9ca7-4f10376ac88f", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766386106, "uuid": "ade46dff-16d3-49e5-aeea-fdd5e93eb0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386106, "uuid": "27f544d4-83fc-4e17-8759-829cc2b4e970", "value": "50820c53f29745d4aa6450d81182c500e1faa8c563835b2bad2e789c679214f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec3a4bc-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387460, "uuid": "427a1fe0-64bc-406b-9766-997d8d063652", "comment": "Malware payload (Mirai)", "value": "56ee869d95c5e31f37204f5193e6c557", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387460, "uuid": "e3772cf1-a1f9-4c76-a9d1-288751879023", "comment": "Malware payload (Mirai)", "value": "509a2b093c0328576a3da7ad1bd5bb880c42526167519b95f0fd371bc68552e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387460, "uuid": "90ef5416-1548-4b57-9d9b-26b96a0fc66d", "comment": "Malware payload (Mirai)", "value": "bab361a44d6c5a65083eb97f7862045790d51733", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387460, "uuid": "79de4028-3707-43b0-b4f0-d5ae5884c9ce", "comment": "Malware payload (Mirai)", "value": "e39e19323fb31142cee85a2279e7299bfba0b1a3ac02fb2d91aff126b310c9d264a8cd750b8ad4eba5a42b1f7fb37483", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387460, "uuid": "dcd397a5-3fa1-451b-bb4d-f8fc3fe76764", "value": "T1A27312B221A6CEB1D6B2803363877E59BD238865037453BA7C79531FF4C2E115C4C85B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387460, "uuid": "9640bf1d-964b-4cc1-92f6-ecf28e37102e", "value": "1536:a8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmtzzlory:hzRnwP0bMQ2RijvDZZ1rYGhG13t3lSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387460, "uuid": "38aeac1a-b5e7-4e12-b462-287f87c19e27", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387460, "uuid": "da7159a6-2571-4f67-9a66-ed35c53c32e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387460, "uuid": "3aba3e27-1f87-4dfb-b2a7-5446953288d5", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92e065d-dedf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766371398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371398, "uuid": "c444bad1-dc1d-4e71-b01a-ea6511b27448", "comment": "Malware payload (AsyncRAT)", "value": "10d2bc1104971b41eca754e632aa2847", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371398, "uuid": "ad2dfab9-bbf1-4c16-8a29-7a1811665689", "comment": "Malware payload (AsyncRAT)", "value": "509f73b6a8d94e7db271d37572a1570dbde4a54d31f49f8907c2e47642ffd6d5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371398, "uuid": "d3a24d76-b341-47c5-8b55-55a0c33eba98", "comment": "Malware payload (AsyncRAT)", "value": "46b55fbc930845241c7067f2f709450a28f05a75", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371398, "uuid": "ed6d86d6-48b9-4440-af19-17638279a3f4", "comment": "Malware payload (AsyncRAT)", "value": "f1be2d97b7573229d165e1f10855c2cf8a91ba3520500c577dfaa50bb0d3bfc791a27398612c60ffb097638333eadeea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371398, "uuid": "73501c7f-cf1e-41c9-be39-a5875715deca", "value": "T1D9232A143BE95216E2FE8F79A9F11545CABAF6132502D74E1CC002CA4A23FC6DA527F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371398, "uuid": "1de7e761-1eee-42dc-8c3e-018dd20a8ffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371398, "uuid": "890eaa0e-25e1-486a-bafa-2ba46cb2bfad", "value": "768:xseYmfC0mCcvenc32fqNz6A5RyIvrR4Aeb1ngUptWcjJrAK8RcctrWBNpR:ECcS02fkzNRbF4xbuU33jJrvYcS2pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766371398, "uuid": "9a01d85f-3d97-4b7e-8ece-d8a9522be64c", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766371398, "uuid": "9802a33e-3f49-4c31-aad5-c15542924c5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371398, "uuid": "d30b2931-4200-4e37-acda-2f6e61157aeb", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca22029-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446298, "uuid": "e374b838-2f1c-4377-8f79-01728b5906c6", "comment": "Malware payload (Mirai)", "value": "9f84aaae31e4e608cf509ecabf7a6b03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446298, "uuid": "ebfb74f8-8805-4db5-8abf-233128070e75", "comment": "Malware payload (Mirai)", "value": "50c0df3bd20a10cb759b83ecce5070ba6390464481af607ea11326b774b482c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446298, "uuid": "27abda53-e74c-47bf-9152-d91d8467b845", "comment": "Malware payload (Mirai)", "value": "e6f14b3a8d0c2bfc8ac53aa1fe90101750a49334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446298, "uuid": "5fd7f3e3-8d1d-4315-be0a-94bf87b69eca", "comment": "Malware payload (Mirai)", "value": "8f25468c6b4680f560b872253c72e2c325554da561997ef3ca1ea4f9f8143486bc60129ee2bec343597826f8c4911ccd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446298, "uuid": "c0f78492-81fe-4b27-9064-e6078682a7ff", "value": "T197A30886FD819B21D5D522BEFE1E518D331317B8E3EE7212DD206B25378A92B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446298, "uuid": "79c29840-0e34-4134-bcfd-114c6a690c78", "value": "3072:hckXjdEF+312H7mY2u4SBJyCiYv87ExYSqT2l:hcyjdI7me4SBJyC3v87uYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446298, "uuid": "8bb96561-c00e-436e-b4d6-09e2a40059e8", "value": 105120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446298, "uuid": "d8dede1b-f149-4560-b29f-55a6912ed980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446298, "uuid": "f1839840-a85a-4bbe-9104-5fb53c0f984f", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e659f491-df62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766427631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427631, "uuid": "9265ff8a-e5e5-4b1d-8498-a8e6e79b5faa", "comment": "Malware payload (Mirai)", "value": "54cf0179e08c9df2caf4e2ae6a461191", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427631, "uuid": "eb8b930d-e90b-4b8e-bad6-51242c136f01", "comment": "Malware payload (Mirai)", "value": "5183c81cedb39d7e11fd6104452381a649f653da4071c27c19d313d5b32d513d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427631, "uuid": "832a6676-1187-4c7e-9246-a6f406cbf8d2", "comment": "Malware payload (Mirai)", "value": "847bb43e5b455d12bf0985f41782f7691f8b1352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766427631, "uuid": "a9edf071-7b6b-4c78-89aa-680b05fe3b83", "comment": "Malware payload (Mirai)", "value": "2d62f16712b59762618b0d83aaef7d6375ca14d67246a769b09541fcc46db5c11193c3841bee3cdb2852e7fd07834be8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427631, "uuid": "e9e1a70b-a009-4257-a6f9-37d8b4d36d3c", "value": "T131C317327A611D1BC8CC533A51F78360FA723769A1A8C71A7E930E996F3C394B1173A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427631, "uuid": "5b52f98b-a507-4578-b3a7-8dc2553285ab", "value": "1536:tNZNliplqjpEpEIFL/NqdVqa0fLLB+0iRIljjNWFMPTP+yYKM2m:hCzE0DLBvi2jjNWFObM2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766427631, "uuid": "5d92803d-3300-4af2-a47e-b389ca5a4b4a", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766427631, "uuid": "a7121271-e67b-4807-a862-9a1513ce046b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766427631, "uuid": "1b9433c5-ea61-4457-9b59-290b3f7522c4", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291c46eb-ded4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766366325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366325, "uuid": "3c7164b1-04d5-450e-bde3-df6265daa852", "comment": "Malware payload", "value": "8232f99522dba0268288c7656ae052a2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366325, "uuid": "83bc959b-309b-42f9-b882-7113fbef9b79", "comment": "Malware payload", "value": "524f37aa2bf91d6267fea83a24d5b828c9028d3c96592f0ce8e87f5459303927", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366325, "uuid": "20561d37-0abf-4161-b02b-38c44ab54a18", "comment": "Malware payload", "value": "e5f0ae219a9f216f365c4121f6921ddfd6e95166", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366325, "uuid": "b4cfed44-3814-4e57-a96d-277bfb3e631d", "comment": "Malware payload", "value": "c36ada6d355a9efce3790683e6127564ee98a2e51fc713901c7d87d3c307f79e542330c7689c20c8b281e17f14be00d1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766366325, "uuid": "087adc4a-effe-4b80-a067-28acd6293699", "value": "T1FB671249FB0C9E2BE8F3A0794C0A16B27A721D15D711A7473910766C7BB36D88F993E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766366325, "uuid": "a0a6f5e2-a1d1-423b-b106-c06ca4c7bd8f", "value": "786432:gud1YVxiuyzq1BxvUkpznS+wh/BQreR3Rk2ME0FkG:5dCxd+WvnlwvRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766366325, "uuid": "1bfd4157-bb8a-4977-91ac-3d8f4428b15d", "value": 30115009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766366325, "uuid": "f032c82d-3d4d-4d9e-94e7-28d994ede847", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766366325, "uuid": "b8197f50-1ab3-4f78-9803-2b9dc554c4ab", "value": "Ultra Manager 1.0.6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc47978d-defd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384235, "uuid": "685f4cd8-fb5a-45ad-ae09-f66e366e61e3", "comment": "Malware payload (Mirai)", "value": "8f69e9f9857078d69ead5084e783a977", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384235, "uuid": "9aa4fee1-6783-4df8-8364-858f84728db5", "comment": "Malware payload (Mirai)", "value": "5392edc30fc8c173149a7faf672939e5b36e74ce5032e8597a855a847ed9ef51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384235, "uuid": "de02fb07-d021-4252-9551-56423ab4f184", "comment": "Malware payload (Mirai)", "value": "3bac6b0518dcbd537f128a1ba554b95e51eeaf45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384235, "uuid": "94496db9-7a24-42f8-8655-724641a9a76a", "comment": "Malware payload (Mirai)", "value": "94d748bacd83b8f15da65662b8e7c5dd20ca8db95686adde959dcc1e6cacba95c3886ecc8139a0c808a10a97795dae92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384235, "uuid": "bc4c3af2-8de7-43c5-9f10-1bf57a6c5158", "value": "T184B3F946B940AB26CAD21F77FD5F034633278B58D79B330299141BB86FCB71E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384235, "uuid": "b3613250-6635-4bb2-82f0-9601e65f0196", "value": "1536:PgnwvtRf7643zUHKrLn3jzzbVwlFncFml4yRoim4lbjyo9GsPgz+74AKyGfueT:xthDz9rLPzbVwlF3w4lbeLXiG7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384235, "uuid": "0ef62eca-8cc0-41c7-b474-fa5bd034136c", "value": 111669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384235, "uuid": "fa2f03c5-a7b1-47cb-8970-6de38346da11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384235, "uuid": "12f2ea5e-4672-43d5-9c30-94131c827059", "value": "n8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987e7069-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397865, "uuid": "ec8634ec-9f4f-4511-94a1-da124a2bba38", "comment": "Malware payload (Mirai)", "value": "fc4481c693cef3067905d1466e1ccb6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397865, "uuid": "2a5d3f7e-3ac4-4ab4-8e0a-6b9dbb41be02", "comment": "Malware payload (Mirai)", "value": "5495a81fbd02cfe75bbc9b5a41b8d82ab1f4158d8af1bbed42e71493c50e31fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397865, "uuid": "61da6250-c3c7-4c03-a50b-a96483330409", "comment": "Malware payload (Mirai)", "value": "23a7387c63211badafb009407249bef469f01c99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397865, "uuid": "975d00f4-e496-41c3-a084-d62a65b225ab", "comment": "Malware payload (Mirai)", "value": "3af533355318afcb58b626cd23b942ed07eb12de6afa0dba2458b06b80268dab7063c129de6f509f913c2dee5bc3988f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397865, "uuid": "fead244a-8788-45c0-81e7-09836b87e032", "value": "T14AC317327A611D1BC8CC533A51F78360FA723769A1A8C71A7E930E996F3C394B1173A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397865, "uuid": "0b4a7cf9-9efb-41d0-b33c-d788a9089591", "value": "1536:tNZNlimlqjpEpEIFL/NqdVqa0fLLB+0iRIljjNWFMPTP+yYKM2m:hCyE0DLBvi2jjNWFObM2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397865, "uuid": "88c02ce1-f208-4263-8089-2ef52518a27f", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397865, "uuid": "e73ed374-2f26-4677-b20d-7b7cd8590f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397865, "uuid": "343838d0-8d0e-4dac-b5cb-ce40be7fc806", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccba53b-def8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766381873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381873, "uuid": "7111ca77-51f1-41ac-a2c7-a42ed76c0105", "comment": "Malware payload (Mirai)", "value": "cbded763b2926f381279fcd172c11398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381873, "uuid": "38241f9e-6e59-462f-bda8-01c8bbe41501", "comment": "Malware payload (Mirai)", "value": "55495dfe885a78fe26340c4d1b99282293f8f9e0501ebc642ddd6b7d6bc196d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381873, "uuid": "c94fef80-2e00-4b90-8dfd-7285085f9f59", "comment": "Malware payload (Mirai)", "value": "583150830c26cc8a2515470a3ee28ce55a7ea651", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381873, "uuid": "6e448679-c610-44e8-9883-68e84926c184", "comment": "Malware payload (Mirai)", "value": "da08a45b9480898d0ba9971e29d02ebb54df5bbea813de7b236ff106986cefbfc2df773c8101095b4f8cefba0196a343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381873, "uuid": "3717900f-13b5-4389-bc26-72e8eb0dba16", "value": "T115B3FB1A3B51DBFDF1AA877447B3CB3496C8229113E48786E29CDA182E702C95D4F3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381873, "uuid": "ec74dc44-d450-4469-8648-c36b1cf6a994", "value": "1536:RD42KjL0HbLvpuCGi63kFmzQ1C6js31IpmJ/drFdKc9QAO6rBceBNFYWXzd6hXCL:RD42OoHbLFjQLSQ9NFJdZ9DwC63ZKhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766381873, "uuid": "8098dfb6-420c-4682-a7d6-8b65adceef4a", "value": 117354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766381873, "uuid": "6db47781-4144-428e-936b-b2a9e61c53e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381873, "uuid": "99b8c90d-cacc-4c95-b610-3dfd46e78ae7", "value": "n2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e90031-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397852, "uuid": "24195c48-09fe-4c83-961c-2babcc26ede4", "comment": "Malware payload (Mirai)", "value": "efdfd198da2509c50a4162e12c7df61b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397852, "uuid": "3212f6ee-0301-4352-81d5-62683e545240", "comment": "Malware payload (Mirai)", "value": "55d336e97df7a5a11b7bb9c2866f461856801a1bec099bd2339aef83019bce79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397852, "uuid": "111e46b1-c76d-4899-9276-651146bb155c", "comment": "Malware payload (Mirai)", "value": "292e6670f68f186827d649cf567d8db2ff875ed1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397852, "uuid": "7a57ca53-68b9-474e-be6f-3db5d6b9d5a7", "comment": "Malware payload (Mirai)", "value": "9660db7f5fead4846cc081b01d254a03c49de14d2b64bc94b8dc53305984581507c69438ffd8f0da2decbf6189360a9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397852, "uuid": "586eb9b9-4418-464e-abea-15e5b7a21d9c", "value": "T12DA35C03B58084FCC4C9D2B84EAEA119C932F56D2272B55F37D4BF263E5EE102B5B265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397852, "uuid": "9901229f-26d7-4870-9d71-84fb4aa407c9", "value": "1536:GUDlNkrgGwkYmttWS7jD1xsKrxo0enbPcfQSu64VNbIgCnEgC:Gy8Ym17jD1xsKrG0eb8QSmzbIVnEgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397852, "uuid": "d8f3b942-b59b-49ae-976e-614025eef662", "value": 98688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397852, "uuid": "9363aa5e-945d-44cf-9402-453957efb820", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397852, "uuid": "2cc75270-7aa2-4676-a05c-582182a43ef1", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66848fdb-df8f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766446744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446744, "uuid": "61d292a4-647c-4c6d-a6d0-9d3a50b854da", "comment": "Malware payload", "value": "9d299f21da4e8899459d0e42fa25bc22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446744, "uuid": "4380cbb2-fc5b-49ed-b43b-dcef607e43d6", "comment": "Malware payload", "value": "5627078a76f8ad2eff64b82a472afe1ec1701a609833a6373a89fbf575de4923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446744, "uuid": "9c67c260-6845-43b7-b60c-2fbf86a37b05", "comment": "Malware payload", "value": "b4f8e07eeb5a6e043de3e4a6b22a3af283b1cfc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446744, "uuid": "a02f0105-9e7e-4b76-bc48-c7460d68d49f", "comment": "Malware payload", "value": "d5eb5416dd9ff37f2d0cf4d166e1e063dc0241510f46f86538225cac7cbf2c9bc85c9e4f859395e44e2ee50af044bfcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446744, "uuid": "e8d62954-831e-48a3-8c6d-625f60ae7168", "value": "T146D5D0BC7EF14D2CCD50F1F9ADD87A14E5097D25F312328F21BE65638911AA9AB02C2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446744, "uuid": "2682f74e-4b9f-468b-8114-1371353d63c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446744, "uuid": "463a9c30-ace7-4c2a-8040-d6dd7e630ed2", "value": "49152:LJou8aPmfq+0vnFFaZy3ojdGpYxX0SKT6KTqa7anKy1S9/aOHRnPBxMawy:LWCy0vnek4LKT6KTqa7im/aOWaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446744, "uuid": "e7034034-d3e3-4a6f-a2b7-a8b503c46f49", "value": 2861568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446744, "uuid": "9380882b-150a-45a8-bfbf-930f3c93f290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446744, "uuid": "20acedc7-67e8-4ded-ae36-3cef5536a91e", "value": "FrameworkUI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b8210b-df59-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766423462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423462, "uuid": "4725fad1-e35a-4244-8349-80ef52e8d28a", "comment": "Malware payload (Formbook)", "value": "cfcbb8d411fd850a4534e199d1ca8e4c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423462, "uuid": "75d25076-e01e-441d-b06f-cba8cd9af357", "comment": "Malware payload (Formbook)", "value": "56973e4b94aed3715bee770815d287fae869e3c1c35a7307e252f8e2950dac67", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423462, "uuid": "9017befe-9b6a-49c8-ba98-f06936a42f4c", "comment": "Malware payload (Formbook)", "value": "31e40639b0a34474c4b8b4ae32737fa4442806d3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423462, "uuid": "d7233213-c230-4fc6-8bc5-92ec781b0d46", "comment": "Malware payload (Formbook)", "value": "0880480cf735a74251eaf08408515d4ab1a2cce3482158482d17e588bf7cfd937aa3ea4bb5ad028d51f45b8945587410", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423462, "uuid": "38054d50-e6a8-49a5-badf-aaf4dea28ea7", "value": "T1AA859D05E3D405A8D16BD378CA6B9732C7B1B8810776D68F1696EB4D2E33BD09B3A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423462, "uuid": "84a2858c-0189-46d8-b6fc-46e83f5d25e1", "value": "d3774c8b4fb397ae74273ae43189678d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423462, "uuid": "7c4813d2-953d-4941-a4d5-ffb5c7ce7bd8", "value": "24576:nwYPMb5r7w26pd1K2ObFpdSuw2S7Drlgp2l8eeJKqr7F9ARNvb6x2hMnTxjj1uZ:wYPMt7LtbSjlgMl8eesIjAulpj1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423462, "uuid": "d549d447-71b5-4079-889c-1f323ea91cca", "value": 1769984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423462, "uuid": "21fb848a-902d-4e0d-bb01-f7b2f023454d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423462, "uuid": "e33d2297-9a91-45f0-8fc4-5a816104e4ac", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687b219a-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387476, "uuid": "38a6a951-6c01-4fcf-a04d-359ec9acec95", "comment": "Malware payload (Mirai)", "value": "511704ccf8689d4a06a01ed26f011a69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387476, "uuid": "0192e92f-82f4-4ca1-8034-ee1140e16c22", "comment": "Malware payload (Mirai)", "value": "57bbaccebcaf065128022f68e01a91bdc58097e35ec9eac390e50f4ce219fed5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387476, "uuid": "ff4bd8c4-5c64-44c0-88af-74ea6ead742e", "comment": "Malware payload (Mirai)", "value": "0edf36262c390ab83befd11c40b7b3e4858edd79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387476, "uuid": "20518d00-6c9a-4b79-a693-875949dd21bf", "comment": "Malware payload (Mirai)", "value": "a347c52d5449f307591dafe83a730cc7a82fc43318bbb9752350ea3d04bee441dfd979ae334ed55bd9d329b9c198307e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387476, "uuid": "2af291ac-27a2-47ea-a5d3-ad72334a4bbf", "value": "T1A2146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387476, "uuid": "4d83e048-0747-4e86-9a9a-1da981a7ac3b", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtG:BZAyFzQSdS7IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387476, "uuid": "678a31dc-9b6e-4509-bf7a-c362a2680c71", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387476, "uuid": "54894bc0-f5c4-48bc-8114-652eab600ecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387476, "uuid": "c6cd0059-b56c-423a-a154-083361d8ff2b", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3c92d8-dece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766363807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363807, "uuid": "2d434249-3cfe-4644-bb41-ace4440bb1b6", "comment": "Malware payload (Mirai)", "value": "ae929c17339fcd86a61be0a5a8e9698b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363807, "uuid": "c6bee725-f17d-4495-9bdc-e846a052ee9c", "comment": "Malware payload (Mirai)", "value": "57e333c23e06e6a4366ddbe4f8fffa3202b95f009d5c0505d932d4fe357ddf92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363807, "uuid": "d6ccc115-2013-4abc-bb04-c6254bd22da0", "comment": "Malware payload (Mirai)", "value": "a602b73b2805749281df5b947af039acc66177c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363807, "uuid": "3a3db431-8ff4-467e-8b97-599c1ab9d360", "comment": "Malware payload (Mirai)", "value": "81b7ada23b77d3aad0d432a28afaf55c16e2fef4eb9bf8748f41cdaa2ecae3619f9d2ab368bf1cb51f9e0d79539f574e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363807, "uuid": "9745107c-73e7-4450-9b5a-796527aaa866", "value": "T12DA34B92BD91DA12C6D162B7FB5E428C371713F8D3EB32039F256F21338A51A0E6B591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363807, "uuid": "9f224a7d-4092-4002-be8e-68957a58c508", "value": "1536:Hj3EqudD4L+aSISKwy5yupFHxnoGEOpp4X7d43l0KFz/dOMlCWxnrz0MY079WSe2:H7EP2L+IPwaHxno6ppG7W10KxrrYMT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766363807, "uuid": "f9219aa8-0429-475d-bdb6-5d21bfafd6d9", "value": 99540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766363807, "uuid": "50e0c5a3-ae9d-4037-bd0f-51e070d5ee73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363807, "uuid": "6e32c122-caaa-4c50-afc3-0d086e478a2e", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b2bad9-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387475, "uuid": "65407b51-654c-45f6-8e74-b4057b24ce65", "comment": "Malware payload (Mirai)", "value": "fa599ad494a2b23348257029b747963c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387475, "uuid": "f40e28c3-6c4f-46f4-a9e0-bb4fd8b319bb", "comment": "Malware payload (Mirai)", "value": "57f56c7a97484f12de3ce3816631516f6a486ab0f6dab87b1bc3792a9db5b9ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387475, "uuid": "f12db7d4-47c5-409a-99f4-004cd1b6006b", "comment": "Malware payload (Mirai)", "value": "f3ca52320fd62de85cf404f148432dcf004b2cb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387475, "uuid": "31f67bae-d7db-445c-803a-dff00b48c5d4", "comment": "Malware payload (Mirai)", "value": "9b6e83fb0cb32aef8d33c2e0387dabb6d9ce77b254b524191599305042559c4f1a899289cff7b4d9403668744bd79483", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387475, "uuid": "368d989f-6517-4902-b78a-df396f1b2e83", "value": "T1FAF3392F358191F0FA411B746BCBD3A76C690BBF1199A0DF6B416329B6E0B77A02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387475, "uuid": "f7d1ffa3-a5ad-4392-a51c-348a24321cb8", "value": "3072:/l0/HEqoP7eKj3hYLaD5dqO7fYO7/6ZEOkNXINWNQhtXiy55+nUXx:/msq+aK8ef2jGCOQbiy5sUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387475, "uuid": "fd78a3ae-33ca-405c-ba6f-7bb5b8fc590d", "value": 172660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387475, "uuid": "138f1301-4e63-486c-9963-430b2966ce9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387475, "uuid": "416a73bb-0f11-46e0-93e2-a44678ab7417", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2acc6b-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446295, "uuid": "6a70fdda-ba6e-4a33-b06d-78fee157fcdb", "comment": "Malware payload (Mirai)", "value": "b9c63cdf057bb23f02215eb0b59c80fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446295, "uuid": "91126dea-3a52-4e71-9fcf-352069709c85", "comment": "Malware payload (Mirai)", "value": "5827ab22c27a3de7ae37378f9fc1af2e2216b5b68787f2523a850f8b267f9989", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446295, "uuid": "ddc9548d-0fbb-4a44-98c6-8a67a6f851f3", "comment": "Malware payload (Mirai)", "value": "37749c01dabb542814553351e84aaadc301247f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446295, "uuid": "fe487952-f445-42c3-ac13-0a3430efc099", "comment": "Malware payload (Mirai)", "value": "d017002c813b2f2d60be99062199e4771fff4a6ca8fd5c1239c626b4eb58bc77cdba3a2a0ae39f095bc7f0f2529b87d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446295, "uuid": "5877a567-a16c-4aee-9c4a-c483a59b21ac", "value": "T170A3C51A6E159F7DF76CC23587B78E20A75833D23AE1C645D26CE9005E6034DA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446295, "uuid": "b894c70f-8b1b-44bc-9bad-e3df734d04b0", "value": "3072:2qj+vh6NLunfcMlMSzgv3TdMQ+jSyrT2fe:2y+vIB2ST+QiHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446295, "uuid": "7ed609d2-81bb-4f53-9a56-90db50985cf4", "value": 105516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446295, "uuid": "c747ca88-1453-4d7a-8f9e-a59355812dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446295, "uuid": "2fa54e5c-5adb-47a9-af18-a2ca6c0db4b5", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef226ad6-decc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766363221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363221, "uuid": "625536ae-ea0d-4124-ba73-d47e448b316b", "comment": "Malware payload (Mirai)", "value": "e4304eb29a362d13ec9ed81d7e22b85b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363221, "uuid": "14058e67-40d3-45cd-bde1-f1797d22140a", "comment": "Malware payload (Mirai)", "value": "584bcf138445917e18c427d8e8a7b59d9da45693c3e24ac0031459609f0dd98d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363221, "uuid": "9899cd03-893c-4184-8522-0e485ed48f0c", "comment": "Malware payload (Mirai)", "value": "24d36b55e1d31ce6db74a1decc2bfd8cfb7673f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363221, "uuid": "881548a7-29cf-4f1a-97da-a92500c3da1b", "comment": "Malware payload (Mirai)", "value": "0b90dee8db30f1b5ddcbba6af7bf265bfe81e9dc4ef6264d61c6e84f71e77b30648c9616591d0b371448b37e6f077e0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363221, "uuid": "4dce72dd-d83b-4779-85d8-12af2fe963a4", "value": "T181E3AE63F34B1490C82546F417CB6BAC2D3321438E6B86E3BC6A723A6E765DF4905BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363221, "uuid": "71d7f9a9-67d6-4f9c-88eb-46884c881101", "value": "3072:vA9CRMLhpwEhUBuCGygqYMGcqJvLvgkC42KvULyq:o98MLnhUXGfEOBFC42Kgyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766363221, "uuid": "8fc46f4c-0c73-4be2-a280-6b75af5e285a", "value": 157272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766363221, "uuid": "5ee0a058-33d6-433d-93ad-8ca288a7cc91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363221, "uuid": "a7d302f4-7431-48c2-9ef7-bae8c9983315", "value": "yamaha.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc744fb4-df32-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766406945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406945, "uuid": "864185f7-1f83-44e1-9971-4d1668d5593e", "comment": "Malware payload", "value": "4f852874b305b69eafa56331d36f229d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406945, "uuid": "aeff6a35-593b-4ff6-8673-df9616688673", "comment": "Malware payload", "value": "58a45db0e8d248a13b58024ddc217512e5d276d5f8d29a530b1e02a8e0d537d5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406945, "uuid": "e065e58b-f6cf-4cc4-bc7c-4a479d49089b", "comment": "Malware payload", "value": "1bed991b05e4195f918758ccdef267d012129dee", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406945, "uuid": "a49dba55-c969-40f0-8469-e17dea3d76fc", "comment": "Malware payload", "value": "7927b5b43921ee6cb16f4f0f059c9d73ffa932a0e2122cbc0e963a75787b539c33dd7e886715b664ac3874bed453ad8c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406945, "uuid": "2fd6b9b8-dfcb-4976-b773-326a56957859", "value": "T122F533B0EF11BBFDCB2582BCE4574ECAB37A831345FF3E9428A61727AE542B90515421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406945, "uuid": "3c5cf2a2-e711-4aaf-81ff-42e2c9f0f56c", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406945, "uuid": "5015579a-f6a1-4f94-be4c-a8e4521e4ca7", "value": "49152:cfSqZCLuJEu1/kHoXLoybMdgpQyOVA5RuL8sVTmJa3EH6M/qK5NzjhZyB2ODw50:cEuq3IXLoybMCQDA5siau6aLZyB2Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766406945, "uuid": "532f927a-f21b-425a-823b-14731b80c029", "value": 3334656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766406945, "uuid": "c54068db-e748-4ab7-84dd-2c80b16d7405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406945, "uuid": "121338ea-fdad-4a7e-ba55-934036963f0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff99c985-defb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766383435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383435, "uuid": "ccceb07f-6e2d-44a5-b56d-ea4156383cdb", "comment": "Malware payload (Mirai)", "value": "c2059721c0e39ce424fa29ccf9e72d6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383435, "uuid": "fc343a66-4290-4618-895f-288b7fda00b1", "comment": "Malware payload (Mirai)", "value": "595e67a0aa012fa9f2a9ad2919987dd362429b9eca1d5e94343a7fc64ca6bbc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383435, "uuid": "5bd317d9-4c09-4664-a102-907d4d849cf6", "comment": "Malware payload (Mirai)", "value": "187cd48b11fd5d1b95f914ebf8d8264e24ead11d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383435, "uuid": "b75382aa-c3d9-4cc3-a6ac-8b42aeb1fc4c", "comment": "Malware payload (Mirai)", "value": "06586f9dd3b2f64b76f1cd74bb0eab8f80dd9938323276585299334b4fffcaad2b1e76b9c8fb769b59b0eefd20c50adc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383435, "uuid": "5fec8c59-57ba-4804-bf1b-6dc6993df352", "value": "T199D3F60AFB614EFBE86FCD3706A9070521CD655622B83B7A7934D82CF14E24B1AD3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383435, "uuid": "b170e835-7fbf-4b4d-9cd9-b2f885944b4f", "value": "3072:2W5z6y9CaNf+SafwyqANpJ+ooC6YmmnyrymGJ5jb2X57QjZHEIgeDjThMO:92y9FsSafwyqAK57QjSI/5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766383435, "uuid": "76c1eb6c-f649-445a-b284-f4085c2961d1", "value": 132924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766383435, "uuid": "c5acddbb-69b7-4028-9dbe-1661dabb56bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383435, "uuid": "0a3b20d2-7076-4621-ae0b-6cd3b6affeb0", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1faeb15e-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370174, "uuid": "874d6b7d-63f0-422e-8ed4-9473d88c57c8", "comment": "Malware payload (Mirai)", "value": "3af53cdbd6d1d58934611f840a4532d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370174, "uuid": "8c3283a2-a809-4287-82b5-abb677170a36", "comment": "Malware payload (Mirai)", "value": "59cfef7aad7d892801a4ecfb54cf38660e1b6612a0a54723ca59f967bb516694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370174, "uuid": "e32c3111-9140-4075-9dc9-8e5dd1bdffaf", "comment": "Malware payload (Mirai)", "value": "79c62fc86fbbb1db00fb9189daa2462758e8b176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370174, "uuid": "a74e8b59-83d9-4252-8ea6-3a94bd6f273a", "comment": "Malware payload (Mirai)", "value": "284ceb94816833cba5a77af808d586f0dbca39b8a12adb32ea3a7c51379fe40abb920d70d5883c80aa44d6d3c02f2693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370174, "uuid": "6531089f-ceff-4c43-9902-bf8a2e6a02f5", "value": "T188630956F8814B22C5C6027AF92E118E332357FCE3DEB2229D206B2077C696B0E76D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370174, "uuid": "5c111e29-bb01-4cc3-99a7-7ac041dbd0ef", "value": "1536:tpnqh/sOR5YbAP+uppI4NEiGaHA1zuInig8F2+lhyS5bYon0:K/9R5MEmaO8F2+lhySRBn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370174, "uuid": "361d80e6-c99a-458a-987f-43077c8be209", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370174, "uuid": "cb331141-1414-4835-ad92-bc7082e61386", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370174, "uuid": "b6c5a9c7-264f-4eb0-8861-5e44c94794dc", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5f14d2-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446294, "uuid": "c1aa45ff-2fb1-43bc-b623-dc9399f2b632", "comment": "Malware payload (Mirai)", "value": "cc6fb3e63446a705b4a9c88b65e6b2f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446294, "uuid": "65955ed3-e33a-49cd-b7a4-e38fa0b77498", "comment": "Malware payload (Mirai)", "value": "5a3309506eec4a2e43f010ba3bfe47d9ad86ccf502668c0b15f47186a9177a1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446294, "uuid": "67312f79-1baa-4483-b7de-9ed2e3cf3d49", "comment": "Malware payload (Mirai)", "value": "aacdf2ba57d8420367de9b5559a7ceb64d0a548d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446294, "uuid": "564e0623-5820-419d-a3c7-52e379dfb091", "comment": "Malware payload (Mirai)", "value": "264fb824d754d77b14bc18f1db4d1fd9a19b070e4802c232ada4daee58907472c8ec0ab065723679e97961ea4f0a220e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446294, "uuid": "e64c2139-fc03-4670-84df-0e7d40e30e24", "value": "T1EF83A41E7E719FADF66CC63183B78A20E75423D622F0D685D26CE9045E7034D682FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446294, "uuid": "3ece0083-afab-4892-96f2-48f2b6e5d507", "value": "1536:BwUKvfOjZnAQLPvgYNZ7yWlxhaB3iBVriBBTIvakBrCxD+YrOT2bVRQ:+cBPvgYNlyWLVXC3rOT24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446294, "uuid": "d868bc5d-be6b-4f11-8c76-e2d64e9cb110", "value": 80740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446294, "uuid": "f2e7786b-227a-4738-86c4-11c98efb5c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446294, "uuid": "36c33bf0-6c21-4bab-8284-595ea65ba77c", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7d34d7-df71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766434035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434035, "uuid": "3ff8dcbe-352f-4eaa-b196-afdac47957a8", "comment": "Malware payload (Mirai)", "value": "b41559e27b8a6b9b5288a6956530219d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434035, "uuid": "1712a244-04b8-4bfd-b933-ffa02c6795fb", "comment": "Malware payload (Mirai)", "value": "5a793ade4210f71c7b42b3afac415b5d476503d564c22698ac3ccbce6408cb45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434035, "uuid": "68c10e85-bf6c-45e6-b26c-856c3a7725a9", "comment": "Malware payload (Mirai)", "value": "a99adaefe6d92d4e5dd0f927dd5496cddde9c845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434035, "uuid": "89952082-b0aa-46b6-a9d9-ec570d0f7df6", "comment": "Malware payload (Mirai)", "value": "692465493cfe4caee6e659899586ff77609d2208e9c7df81e9ce3920605acefc2e82d58138b06b4995b6681409a638a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434035, "uuid": "c829f6fa-7a18-413c-8848-2449d9242a25", "value": "T1C6B30995B885AA12C6C256B7FF4F428D7716539CE3EE3203CD185F64338B96B0E2B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434035, "uuid": "83f9de6d-9565-4ba7-aa5b-413094778c57", "value": "3072:21drPhr6Me4HVbVHJSEw5wzeod81nheu5znz4:ORPhrL5HZVHJS35wzeod81n4uB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766434035, "uuid": "2a462bdc-b61b-4d82-bc38-443decd689e6", "value": 107724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766434035, "uuid": "ce2eabae-b653-496c-8194-8756696ec0bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434035, "uuid": "c2476b98-f073-46ff-a4ef-7cc0a5ca3363", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9607ae7c-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388841, "uuid": "225c3408-183d-4508-add8-6c159842ca3c", "comment": "Malware payload (Mirai)", "value": "db7c50e1f57ae8541dc9cc7be30e4149", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388841, "uuid": "e16a1d1e-1b60-4c47-aa6b-ecc77f7ad27c", "comment": "Malware payload (Mirai)", "value": "5ad14d41a3d5750746d105492fb3d499ea6b6a345fe02c8356539bd43a169f15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388841, "uuid": "8ab01db0-916b-4075-be4e-8952b50d7eda", "comment": "Malware payload (Mirai)", "value": "9e55bd0dba107b92c5f6fd456e5191d0332492df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388841, "uuid": "3069266d-3736-4b03-ab38-7e90bf48dad3", "comment": "Malware payload (Mirai)", "value": "3d8c082bcede4a6bf733082a9a091b66106534cf5a06824cfeee2d42c78f80a87b88f9740895b6c249f808dc348f0281", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388841, "uuid": "0695f1b0-4ab6-4ef0-950a-efe00bcedbaa", "value": "T18EB2DF3C1B111B98EE1EC0BE83AD0B613DB41B3591829D5B7207ED879F968747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388841, "uuid": "f07370b9-79c7-42f2-9233-f8d54e33c927", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiXmdtJgGlzDpH7uNj1JA4A:YeD8ZSWvZHZbs1row697qohQvg9XitJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388841, "uuid": "1e51e4ab-b778-4cb8-b7fa-76ec302dfc33", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388841, "uuid": "fda7d030-e179-4464-90aa-ce4ac9aeb5b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388841, "uuid": "f26a1211-37d2-4bdd-ba83-71fbea7f1fcd", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e5370a-df42-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766413705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413705, "uuid": "1ec5b7b3-e7e3-4fe6-ae67-505e9e9c32f6", "comment": "Malware payload (SalatStealer)", "value": "ab0059df8e04f064fbd955fe310a0b7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413705, "uuid": "30102ce0-01f0-4cac-834a-0ac10c33986e", "comment": "Malware payload (SalatStealer)", "value": "5bc1a21631d630a40f166f31e559ff837c916cc5865e4550c16927efd1ca5879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413705, "uuid": "4d7146c6-bc7a-4c5f-9b86-91c058435927", "comment": "Malware payload (SalatStealer)", "value": "a9b7c08cb5620fddbdb0be369fe7001c884cfd5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413705, "uuid": "b6b9d6fa-e5af-4909-9e9e-51263c02d880", "comment": "Malware payload (SalatStealer)", "value": "bc67756949d4d2856a8fc525c11ac6f1ce2701df823d6fb5d3e4bc32444276c507ff58d88688d88f60b42ee12e6e5124", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413705, "uuid": "a7c443a8-20b1-4f32-bad8-11293085d8ba", "value": "T177C65B41FA8B54F6EA031832415BB23F63305D049B28CBDBEB547B6EFC77681197A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413705, "uuid": "f7c0d94b-1718-42aa-9ef8-9e02889c4669", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413705, "uuid": "8b570a7e-ff65-4736-bfdf-648efe8da19a", "value": "49152:pG6Dsyf57KbEhu6sTFWb/1ekLsMBwuPeofNiaty34N5p8xiSVlQtw5yXz0pqyZq0:Uqsw5Dupx432VYiRfNdv/KgPrkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766413705, "uuid": "7d21bec3-0971-43a2-af53-9a443cd5a816", "value": 11654144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766413705, "uuid": "7354bede-63d7-4f97-92f2-bf7e69781a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413705, "uuid": "7bd0e914-4bc3-4fdf-8706-385283c2b04c", "value": "DMAcheatforfaceit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fec87c-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388840, "uuid": "4dfb324c-9350-419f-a476-8738a6d5cae3", "comment": "Malware payload (Mirai)", "value": "85cc06f863e7cfdba0532e6ed30061ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388840, "uuid": "61f1c282-05bf-45e1-afe0-cf38ed8870a4", "comment": "Malware payload (Mirai)", "value": "5bd6f4a83cd4f098bce77d57ebd52ca63a90ad7c72a82309eb3745c390e8225f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388840, "uuid": "86eba957-e9c5-481d-b444-836a362b2d6d", "comment": "Malware payload (Mirai)", "value": "5c2503c626ca4f877cb8cf67f0bb9d3935c72fc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388840, "uuid": "1a957397-da54-4cdf-acc4-8dc17c69229f", "comment": "Malware payload (Mirai)", "value": "231a7e0c547155eb85b33a44ee4ab349e1269e29f1d13df566ea7ccca92cbb1b5424f02513e734414a62972ebd239c0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388840, "uuid": "28ae6ea3-8755-4cc6-945f-ea3a12a7baf6", "value": "T1E7432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388840, "uuid": "4f7c795a-36b0-42be-84b9-f47abb54e462", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw0:RqtmZPuutfbltZFBSJsBcfDSTFI+BE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388840, "uuid": "88d0d1a7-41b4-4910-98b0-8bda137cda7a", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388840, "uuid": "a4fc8a9e-d439-4892-b40b-c626a8b5357d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388840, "uuid": "1666b88c-4aec-405d-b56c-6fe91c8b69a4", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3260e35-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388863, "uuid": "96a6e06a-6657-4bd9-8a31-b0d0f1a27714", "comment": "Malware payload (Mirai)", "value": "04c7943a653dfae70c96e76c449bc6f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388863, "uuid": "3392db7e-fffc-4cae-892c-23482cd6f508", "comment": "Malware payload (Mirai)", "value": "5beb9c8a2bfad21d16b4b0661f9715a0a5d02718671d3b7cb2404741e80fd65d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388863, "uuid": "d23a4c65-eb4c-4dcf-a14f-922e76d7ecad", "comment": "Malware payload (Mirai)", "value": "93b1e182981e207d454e4d7c44b6b7169b5aa630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388863, "uuid": "245a5b3c-6e44-4994-aae9-5ff17e1cce27", "comment": "Malware payload (Mirai)", "value": "c492716edfc0bc8b4035b4dc33e19fa7ff36f73306c454fdb1800bde3bffe8dc8cc8c93ae58a7bc837caf7f86efdd1d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388863, "uuid": "bbabef6c-d546-4f4f-85bc-f03b5c9b88fd", "value": "T1D7230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388863, "uuid": "22378c76-933f-4258-9bfc-955c54b5e9f5", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THN:5DmKF7Gxyk8cqoHAmWurAufsG5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388863, "uuid": "17170799-1dbb-478d-9c28-13a85998d0d3", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388863, "uuid": "bfb03892-300a-470c-b086-935f2c5904e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388863, "uuid": "6349d2fa-f149-448a-b2dc-bd5e2d38cb58", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81279c4d-df8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446788, "uuid": "f9f0c0f1-c406-46f2-ab33-1a07e794e058", "comment": "Malware payload (Mirai)", "value": "5c7496ff62d5b68b70ba610135a70879", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446788, "uuid": "56f39988-e8a1-4416-8dc8-5d256ce33e17", "comment": "Malware payload (Mirai)", "value": "5d3ade4d1a754e949719fbddf7d447c6b967c308f86853f57fc7f7173dd1a2e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446788, "uuid": "fc5a4a0c-3c35-42aa-afc6-af203a5f8c14", "comment": "Malware payload (Mirai)", "value": "9148e96568b111796e26cff3a9997a476a167fcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446788, "uuid": "e02b4fe9-3792-4aa2-a796-ae17c9e72973", "comment": "Malware payload (Mirai)", "value": "75b548ef9a14e958d7689f0ebd176b07fa065c346d934fa7171dfb45e862a577687ea34adb2a62bf5ee2f32433f82034", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446788, "uuid": "9cc3f2d0-1227-4e55-b554-88da6a00edcf", "value": "T1E293F706BB644FF7D85FCD3745B95B05258D920A22B83B3A3A74D818F64B15F0AE38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446788, "uuid": "0143f870-bd1f-4ddf-8075-1a58639e5a87", "value": "1536:zdzAZptTN2acSK7vn5BClDR1xhc8F3Oo/mbjPh82hjTAbVRF:zOBNhcH7Ro1Mi2pTAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446788, "uuid": "3521018a-8564-407d-bdde-6dc842cb9f5e", "value": 97464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446788, "uuid": "2eaa3c83-a4ca-48e4-a86a-8cd31d9e09e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446788, "uuid": "905fd9fc-7228-4f71-8f09-2fc671591d37", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f885827-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387461, "uuid": "5036e8a8-be54-43f5-8cf7-a02bd4f47e7b", "comment": "Malware payload (Mirai)", "value": "508477c4072f5b5fe515a68991a52a48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387461, "uuid": "bd2cd641-dc7c-41ee-8f96-1260821a19de", "comment": "Malware payload (Mirai)", "value": "5e68511dfe9da9a6d1e081d058b7dc3bd1ddb189bfdd748c629aae43caf335bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387461, "uuid": "4c72dcaa-cc79-488e-9aa3-2c5c0b1dc66f", "comment": "Malware payload (Mirai)", "value": "2099e5448c2cb68280931968287f15afa0692ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387461, "uuid": "28cc0743-6916-41a3-a403-fa5eda08b372", "comment": "Malware payload (Mirai)", "value": "df2beb3cc02bedf1798d1bcffabbd75665332d3c2532f36d32c0c2d911f428e7b01f4b9d1d6bfbd7d668ab2f1f1d30a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387461, "uuid": "0a58a29f-fc64-4ea2-90d7-f43bf67c6b8b", "value": "T170147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387461, "uuid": "ab8d875e-2c94-41f2-aa7c-fbaf26bba7aa", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCR4UKG:IcY5JpMByVs9jS/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387461, "uuid": "f2296f00-eb34-4a66-a19b-dcbd8d794cf0", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387461, "uuid": "912ebf46-206e-400b-910b-8de676106d01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387461, "uuid": "5148cf94-2ffc-4471-b3ac-92a1f56c74f6", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9f415c-df74-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766435236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435236, "uuid": "e38e8a08-3cfc-49a2-a302-42bd0def6787", "comment": "Malware payload", "value": "a6b06a79aff2f61680f88d0a3420bcba", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435236, "uuid": "41dcf8ca-fd67-49f7-b1fa-73b1f5154feb", "comment": "Malware payload", "value": "5e6edd1c21f6dcc912e5bd99d8bbe3fa7462b544a55554ca900e9afbd5955d8c", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435236, "uuid": "a4595639-bc51-4d0f-a287-37795f5c314d", "comment": "Malware payload", "value": "3f5c10dbaf91248086c1edfd10d6e99d87bf528f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435236, "uuid": "ad570876-3d02-48b1-9dac-dc11a277bc08", "comment": "Malware payload", "value": "f7b1707efa449915694d5625977f236244ff6c944b899bd1f0cc2e6049c3ca43026aab7a52a5fedb0bdc3a8da52047ee", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435236, "uuid": "4c7f52e0-520c-4711-af87-90d8bc852c10", "value": "T17FF6338C1125ADE9C24052B036A7A31A7D67E3972DAA9E7133C57EC75F2F3370943A18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435236, "uuid": "1595df7a-1483-42a5-9a59-05428baef8d3", "value": "196608:Sq+l2aR/k+BUZ5fSPp0fJSBTgX53wRgtPkRwebxr2gwVbcgEmSzKtlo/zrPGJ1gt:S7u/YPuJBWRgt8DgDk/c2kv9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435236, "uuid": "ca0ab4fb-82da-47a0-b94b-534388defcaa", "value": 15517696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435236, "uuid": "f6c103ee-5148-4999-b381-13eed56eab6f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435236, "uuid": "8820026b-c8ba-4cc3-b237-b1f78ff0779b", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9594d7de-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766397860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397860, "uuid": "496e863e-4c4b-4b8e-9a0a-83888a0f7b44", "comment": "Malware payload (Gafgyt)", "value": "08ae1ca231b8af4551721f79d6d0f886", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397860, "uuid": "a632ae30-f98a-4d58-a9aa-02d79773aff2", "comment": "Malware payload (Gafgyt)", "value": "5eccf4d0e8b651a35e4fc75428f786962cec26c59f7248ce133997e414a1da72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397860, "uuid": "a870b0df-8dde-4e50-b810-35515834755c", "comment": "Malware payload (Gafgyt)", "value": "62590ba30a572275a8b61a88d13feccebb2087ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397860, "uuid": "27857788-1bea-4832-b12d-cbdd868ed0b5", "comment": "Malware payload (Gafgyt)", "value": "fb0885d990ac53011036d00005416a2d7853a924c1d872627c6ef14387c99801a5803949f5e949d9dea5ed58d7fe20ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397860, "uuid": "5d4942bd-a74f-4a7b-aa2d-3a5e828dfe6d", "value": "T121836D83EAA3F8B1F821107A167A93A14933F2352461ED4BE7A42F71ED55700EF0676D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397860, "uuid": "949d7eed-acb8-44ef-8ea1-584067c2f0c6", "value": "1536:k/2Cm3VO75Uh43qFpRagoM6F24rJ7NfEYCBs4ZaDfNc/PD3+Di6K/8R:/wUnohp7N60fNCjI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397860, "uuid": "1da80171-198d-4f75-b2c4-6d1c412d2e66", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397860, "uuid": "b80f72f7-fc83-4557-a5de-8809e33e68b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397860, "uuid": "673f5f97-7c46-4b1b-abb9-db7cb3d16852", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa79ed88-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446562, "uuid": "ad8ce0dc-7ecd-4f9a-bc57-6b9c4e131afc", "comment": "Malware payload (Mirai)", "value": "2a50ab3777177b0f52168daaacbadd2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446562, "uuid": "d823a8ec-b06c-4987-8dba-1a4cb9109cca", "comment": "Malware payload (Mirai)", "value": "5f276f7c2d8bcac745a8d82ae70931f30a0e3455402bc18897a5cb6f87d3552e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446562, "uuid": "2227b6bd-718c-410c-824f-b0ea1a22b23a", "comment": "Malware payload (Mirai)", "value": "24b3213d2d8ab876274e3a1f0048d3f3f32eb212", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446562, "uuid": "5f21b5a4-8332-450c-9602-fed8acdbc674", "comment": "Malware payload (Mirai)", "value": "499663c10aa7f98387422ad6df77dafb8de86bd5a63e1fb41e926a0ede8ff4dd576d1a2e8ba748c1e879d3a1201943e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446562, "uuid": "84a72619-1fb2-4004-8298-2c011a8c0f0e", "value": "T1EDD30845B881AF10D6C626BBFE4F118A331397ACE3EE7202DD145B2423CB95B0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446562, "uuid": "ed861ec6-33d9-4fc6-938c-16b3874f360c", "value": "3072:ma0CzrL+t2gDIGSrR6YhEICrVJtO6RIwTa6+qD5eLz2mKwPydMjafpnzE0:b0i3+t2gDIGWR6YPCPtO6RTTa6+qD5ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446562, "uuid": "6d36179a-dfb0-4474-be9f-067efbc24d6d", "value": 132832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446562, "uuid": "48c741ff-7d6b-4286-ab6f-f1e6dfc14604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446562, "uuid": "00f93a3e-96d2-4d1d-adab-84d6928987eb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cded981-df91-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447586, "uuid": "ac59e316-2dc4-47c2-af3a-66c42afd42a3", "comment": "Malware payload (Mirai)", "value": "a10a92f9d504cf3251ea9e8f640a8b82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447586, "uuid": "73d4998a-3f3d-49dc-8a7a-3b655ede1556", "comment": "Malware payload (Mirai)", "value": "5f4b97ae410e7773aedc46d786937117dca781e2cfdf7ee24b48a4a5c93bf1c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447586, "uuid": "e6a3230b-0a57-415f-969b-66c4edcbf4eb", "comment": "Malware payload (Mirai)", "value": "ad795a6dc7bdbdcbebd6588a560f7cee20b15f47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447586, "uuid": "54b51b94-8b5a-499c-a25f-3c0dd9a456bd", "comment": "Malware payload (Mirai)", "value": "dc7532efd87b942a5c73027520c7858656de6eec6b3c6eff2d9fdf7c6cb3f46978490b3d0add9681afc43b87498b8c58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447586, "uuid": "1ba521a7-b8e9-4a7f-9c8b-06c488e38eef", "value": "T16A635B21BEB62C2BC6C4653B50E34635F6B7574A217CCA2B7D720E9CBF149503207AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447586, "uuid": "d2c7e115-f4af-4979-bd7a-996348812c85", "value": "1536:xvaZeN8XVW/hHP+YVaJ1ym70N/o9VQz8zm7uhUw:9ao0MVaJ19Q9z8zmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447586, "uuid": "1a07cd75-f79e-4e8c-af80-b10b93f69448", "value": 67236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447586, "uuid": "36d8a000-5ca7-4061-ad37-c5445db3912e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447586, "uuid": "75baae91-fe73-47ca-bddd-b053c4065003", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326dc6d3-ded3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766365911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365911, "uuid": "4298e365-2fdb-4ee9-8613-99b2fbe672ec", "comment": "Malware payload (Mirai)", "value": "d686a737e6e56352e3a2c063dd27083b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365911, "uuid": "97dac11c-4748-4908-a83f-f242c7b5f166", "comment": "Malware payload (Mirai)", "value": "5fb357cce5bf1aae2e65de04908eb13f706a486c527b67a5305aab0e159e594d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365911, "uuid": "31cba97f-89d3-4175-a0e3-73c740104345", "comment": "Malware payload (Mirai)", "value": "fc25f6d7d66dcfcef6ea6d21071b54fe4ec6b25e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365911, "uuid": "eb8d871d-d78b-444c-98f1-1f33cacd31fb", "comment": "Malware payload (Mirai)", "value": "734018af49a8ad088aa49b0be11295d72c88928d9439899cdc71109d3afee5ca8a2ee5bf882db13ae80e0c826b8693e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365911, "uuid": "70f94b1d-bc96-4726-a93f-773f1b4aaeb7", "value": "T139634AC59A53E5F5EC19093514B3F7775A31F4351028EAA3E3D5AA36B842302FB4B2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365911, "uuid": "406f3c34-6682-4554-8e2c-845d5ddc0932", "value": "1536:Q5CPIv7BNZUMoVQ8zPDYtLNevYWHy4ipBxuR1dPRR0:Q5UIvF7JoWi6LSYQZCjcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766365911, "uuid": "a658b381-9ca0-47de-af68-9e39b268beb7", "value": 68240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766365911, "uuid": "2fe9fb91-abf3-4a0b-9f1d-8a0e8b578291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365911, "uuid": "eb7093f5-4174-4a49-b146-d27fea143008", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e824afc2-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384684, "uuid": "fd6e2b64-1dde-49f4-9d00-eb3db53bf18d", "comment": "Malware payload (Mirai)", "value": "396380b6fabb114fdd3ded2a5c084796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384684, "uuid": "c75609ee-3c25-48c2-9252-9613f0f99ae0", "comment": "Malware payload (Mirai)", "value": "612dd780b6afbdc36c1d19f5730673318a293a646feff8361c13f011dd776289", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384684, "uuid": "477fa128-95c8-4c63-b047-d36ec8a93158", "comment": "Malware payload (Mirai)", "value": "bcc94080742780593ab9c9faa888992efd93ba12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384684, "uuid": "a0e40cf5-7285-4d25-b636-7f7acdc35da2", "comment": "Malware payload (Mirai)", "value": "9bfd5d762e61d2a839ba7e9a1542bea393f723d838d378b44cd5e54dbfcb76aef2bd0b258cf36b53f7a463aa992ca86b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384684, "uuid": "fee5e64c-c6a9-4c7c-8e77-4c62f4a5be0f", "value": "T137239EB7C8796DD0D1588274A9258EBC1B23B405C5A33EFA5E45C26A8047EBCF62D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384684, "uuid": "d2703334-c2eb-4bc1-b1f1-ee56cea69a5b", "value": "768:1anwtkuoz8GeqUy4P3uz6qxmruCynnkx7Cdotyr74OCJ0I:1anwtk5bxw3uVm+kx75t04OC2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384684, "uuid": "d8b48bf2-c6c9-4f4e-a4e8-28fb885e812d", "value": 47684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384684, "uuid": "2adede23-3117-430e-89bc-d99faef4d808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384684, "uuid": "f7ba547b-d6c3-4a1b-a5ee-766a25f87125", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae69faaa-df8b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766445146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445146, "uuid": "011d508a-757b-4dec-a1d4-07cd5d7c36b5", "comment": "Malware payload (Mirai)", "value": "e5b28bd61447044a847f98f8f0eb133a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445146, "uuid": "fcf892e6-d04e-4030-a949-e543d155ccf8", "comment": "Malware payload (Mirai)", "value": "61bc8ffdbd6157296516c1f8cb8b68be77a0e3ab668bd806ad5de6613cc2a9de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445146, "uuid": "daf982b4-2c33-48d5-ab14-7541f89763c4", "comment": "Malware payload (Mirai)", "value": "401194b4b456c4579d03dfecc630d41cb10eeb94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445146, "uuid": "5322def5-e32b-4c6c-a319-cc7b86e506c0", "comment": "Malware payload (Mirai)", "value": "f7f69c65631a3136070742a2f9fbadb16927309389d3ec1993ef07058b1324e8169c83fa36e777892e97af3807bf2467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445146, "uuid": "7580e8f5-8e97-4a6e-8420-b7fbc0705c53", "value": "T14573027221A5DDB2D2B1843223837D9A7D33887A03B463BEBC79575FB486E10684C95F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445146, "uuid": "7df5b1cd-28b8-4e70-9d84-093aaca69ec2", "value": "1536:a8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmWLor0:hzRnwP0bMQ2RijvDZZ1rYGhG13WLS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766445146, "uuid": "376e9fc3-d9d6-4e11-ad52-7f75c3e4767f", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766445146, "uuid": "aeb6c19c-45a6-4018-81c6-a85ba56c143a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445146, "uuid": "dbfee0b3-3915-4a3c-a467-1c67ad936a30", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694581ed-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387478, "uuid": "a6c2c9da-ca1b-4b16-ac66-a5a66f33c9f7", "comment": "Malware payload (Mirai)", "value": "7647987653f38f26d6f8ccc62a1a7ba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387478, "uuid": "b909ffe0-25d5-4d17-a27d-4d2704fbfde3", "comment": "Malware payload (Mirai)", "value": "624719a933aee7d9dbe2c8a899569d268e6ff13ba5172b6d535921660d6f8b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387478, "uuid": "42d5fd8d-a999-44d0-a993-8a1da914f3fe", "comment": "Malware payload (Mirai)", "value": "382cbfb4decd43b44d0ab4e4fac135d56291b49d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387478, "uuid": "a10052c6-08e5-4795-9b35-099c28eae3be", "comment": "Malware payload (Mirai)", "value": "b0333989bad2d78d1ae972156c24be69ac48881a846b309a9084006974e48f628dfc4de5b18e982d07e6f71ff5e518b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387478, "uuid": "4088a94b-f6d9-41d1-b255-285895e4417d", "value": "T1BFD3B021E4006DD1EC2129F578BA97B80350EE740BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387478, "uuid": "c753882d-b916-4df6-a597-e257b5f694c2", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xV:PiySSGp+PMmT7zMplT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387478, "uuid": "ed11c893-3683-4b26-a437-2f6460dcf5dd", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387478, "uuid": "3cab30cf-6717-444b-8c6c-25dab39a6586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387478, "uuid": "34b7e8e2-f0cb-4fe0-a8e4-88fe204c39c1", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5befcef0-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446296, "uuid": "e0b7a4c3-9818-4fb9-ba6a-c40acb354cc6", "comment": "Malware payload (Mirai)", "value": "17298e7ed93967268e9525bc3d7c9cfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446296, "uuid": "7c903a7a-b7d9-45c7-81b9-7c0d3d96a7f4", "comment": "Malware payload (Mirai)", "value": "628d7d768ce6af5342fac64905dd6a1d0338c9dd9989498b8e5e683fbddb576b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446296, "uuid": "a9c0e880-dca9-4411-b420-b006b98affbf", "comment": "Malware payload (Mirai)", "value": "71df7ae8c2e892d944ced7f15dd3a49164d556d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446296, "uuid": "476a8dc3-7a98-4e8f-adc8-afbff7ee6166", "comment": "Malware payload (Mirai)", "value": "877b4106da695ada66b160ce40d124f46b847b04f5296f8dc3d39352105534afcd603a23ae036eb30eae3b7eff6178f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446296, "uuid": "dbdb05ef-6201-4e63-ab71-a6e0c72ddbd3", "value": "T1ACB3D74A7B650EF7D85FCD374AB91B05259C920722E83B3A3A74D818F24B24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446296, "uuid": "dd5c6bd1-aa59-4869-b2ef-37c65dc06c5b", "value": "1536:Bt+wzhpYhVKRB9NMc9tn1bOqD/A6gYLEaMIYFtl9PRhkUVRFRT2bVR:BlYhARBYsLbDjANVDRDT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446296, "uuid": "dcf89ac0-560a-4dcc-85c3-ec0f47c0dbdc", "value": 109420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446296, "uuid": "1d3db7cb-479c-4917-9129-25217284a854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446296, "uuid": "854f846c-6b75-4414-9991-80488df0bdcb", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996c5c96-df0d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766390995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390995, "uuid": "00da547d-7dab-4996-9230-93f126ab0d50", "comment": "Malware payload (Mirai)", "value": "26af2607ead9cdb7190dde10a8c5cffe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390995, "uuid": "59ac65ea-f0de-45ff-ba65-e12bf67db498", "comment": "Malware payload (Mirai)", "value": "629a8a33e8baf5a26c87e3e026222fefa0a60da32c392f14a3b7d8913276e57f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390995, "uuid": "08fe6e01-233d-4646-85cf-6d54508823cf", "comment": "Malware payload (Mirai)", "value": "829f56fa7f42f8463bb9ffe6c1eb53f9af62e771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390995, "uuid": "f1452e15-0fd6-4c31-83db-daba0279d866", "comment": "Malware payload (Mirai)", "value": "10af170281a7e421f9e254b59f555402a7cc7edd3343f603ccbf83ef1f1cb5841a9252335757ae70d681c9356e144132", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390995, "uuid": "34f58c3d-4048-4e09-97a3-3cca6ee19e96", "value": "T1A6B34C62BD919B11D5C216BBFE1E518E331307B8D3EF72125E14AB21238B96B0F7E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390995, "uuid": "4de2eb0d-ac24-4639-8a72-8915973e8893", "value": "1536:sJna9dBgpvrpE2LOPRHrzF/2RZ5C2Qa6ZNCwIadwi8vsL3Wq7aAY6XemI:xdalE2LOJZqZI2Qa6cvsLGqeAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766390995, "uuid": "2a5e0d02-2988-4916-92d0-9c49c3e18af9", "value": 111828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766390995, "uuid": "ed690c64-4316-42de-871c-4f96034efaba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390995, "uuid": "f07cd7d0-95d1-40a6-be5a-d1cb8e0ea21e", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d60f9cd-df21-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766399537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399537, "uuid": "4926146f-4899-4723-b846-cdf43efc0ba7", "comment": "Malware payload", "value": "2b1101d52c595429c0c3536e19dcde40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399537, "uuid": "255ec102-84c1-4062-a7c6-2f745e14fe55", "comment": "Malware payload", "value": "62e114cd1d8b373d1c2d0462068f20cf478d13148214073545ef5b3a8f5ba251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399537, "uuid": "b29e03b0-fa72-4d81-9abf-1a22058f6694", "comment": "Malware payload", "value": "0418f375d0b35e159ae55de1139b952746943598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399537, "uuid": "ce388157-011a-4c1c-93ba-b4556163932f", "comment": "Malware payload", "value": "ac4381364dcae9097161b1ee914a4ca309ba75065371cbf5380963d9629650870220e0fb88229b21b5210f2ee7fbb3a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399537, "uuid": "8c079092-7c2f-4bc4-b8c1-15636769b388", "value": "T137F28C1FC94064B2D902FC7194D39DFBAE3662714E4987B7EFA4C404EB62740558A3BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399537, "uuid": "f7eca2b6-813a-4b5b-9447-d73452d67625", "value": "f4427311c2e221fa342bea0884688909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399537, "uuid": "891a3840-ed24-441c-9155-f32b4b0dee9a", "value": "768:JQLwMZTQo269VBzNTpbAJalxeXDFsmsgmuC5ALP:e6iNAa6Xqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766399537, "uuid": "37f8c6b0-c4d3-4357-8ce7-02a9488bb994", "value": 35808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766399537, "uuid": "1e439b81-8164-4347-bf19-dd83b9f6aecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399537, "uuid": "cfb190ef-2958-4033-8e90-e62a47f92773", "value": "elf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792291d5-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424871, "uuid": "bf3f108b-6099-4b31-9b75-b947718491bf", "comment": "Malware payload (Mirai)", "value": "5338288fffe6db1ba01d5339cdd878f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424871, "uuid": "abb696fa-151f-4019-bcab-6bd62317191d", "comment": "Malware payload (Mirai)", "value": "6361519beb5e080b0c8b277993328951e7628c282d33703657c7b890df255f90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424871, "uuid": "c068507d-463c-4adc-9da9-f3894cd5ea08", "comment": "Malware payload (Mirai)", "value": "8c092794ff2d64c238e4df00c2bd2fdb92fa2e39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424871, "uuid": "9b2f9938-f397-4aaf-8c24-898583f9e167", "comment": "Malware payload (Mirai)", "value": "333be02961bb4c01652b9000cd908cce340e0e79b3f3071bb21845d1bc4647916c2a01a79394e2f91c60ff84dc56d246", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424871, "uuid": "821c9f24-bc5f-4637-ab27-ee4cf413e890", "value": "T19E935CC5F683D4F6EA5705B15137A7329733E43A602AEF42C329AD36DC62910DA1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424871, "uuid": "bca9121b-d1b0-4644-bf48-491095dbb097", "value": "1536:WWmseUZNsbsQ+ge96KM/MQuggIyB2PRf1SwRXXy:VOUZcsQVM5aMvgSBu8wU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424871, "uuid": "0ba3acbc-9ef4-4606-937e-c85688bc6459", "value": 92108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424871, "uuid": "6ce510e1-ce90-4e16-95d0-bd66acfac963", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424871, "uuid": "932c33e5-7c96-46f4-a4f2-5ea802dd5958", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d7285c-dedf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766371393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371393, "uuid": "f919087e-5f8b-494a-9b88-7714f0199b28", "comment": "Malware payload (AsyncRAT)", "value": "acf12abfe0bd54591b499058d1ad63df", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371393, "uuid": "921c85c4-d1de-493a-8eea-d265821ad382", "comment": "Malware payload (AsyncRAT)", "value": "637d0b1ee2f96b9a2330a1ce21468b1bac565d377ad608c2a59dd187077a1503", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371393, "uuid": "c853356f-3ed8-448c-9aad-276baf564be2", "comment": "Malware payload (AsyncRAT)", "value": "f513548567cf3596ede6596b5bb5fb32017ae0e3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371393, "uuid": "4eb16eae-c466-403d-be59-73735ea93ca9", "comment": "Malware payload (AsyncRAT)", "value": "bd422f63fe7ba6dc39f03e20877c252229e8a665b873f504b8a4771f54934003f645afb436e2d7b7b2862c985fcbc134", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371393, "uuid": "66844a81-bd68-4fce-893c-285bc79f71ac", "value": "T1E8532A143BE95216E2FE9F7D99F12545CABAF6132502D74F1CC002CE4A23FC69A127E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371393, "uuid": "36c71b7b-1482-4e56-baf5-a75cb1affbdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371393, "uuid": "a5d32c22-7182-4f73-93c4-9d92d8f9f303", "value": "768:8seYmfC0mCcvenc32fqNz6A5RyIvrR4Aeb1ngUptWNuIrAK8RccjrWBNOR:JCcS02fkzNRbF4xbuU3CuIrvYcM2OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766371393, "uuid": "be8b9878-2fa9-43dd-ac41-c28356953207", "value": 65548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766371393, "uuid": "5940db4e-bad2-48ae-b093-784cea9b0f23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371393, "uuid": "dc20b956-220d-4dab-a255-58b2b8234ff6", "value": "uxw5rr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edd3a80-df59-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1766423511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423511, "uuid": "07fed7c5-3ab9-42f2-8186-e617fd3cff36", "comment": "Malware payload (ConnectWise)", "value": "f5bb999c1e105b60dd04ccb5ff40e4bc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423511, "uuid": "e84b8750-9db7-4897-bb8f-198c4a999603", "comment": "Malware payload (ConnectWise)", "value": "6403d0ce6a2da715fc9c33bbde98ed94c08f6ebb1f71320e3dd0e52ad8ac153b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423511, "uuid": "4209a96a-01e5-4d50-b715-8d1c1d256a59", "comment": "Malware payload (ConnectWise)", "value": "af078d306f2562b0c1693dabcbc112c7366f58ca", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423511, "uuid": "0fe40154-9bfd-4413-8d76-459af02529ea", "comment": "Malware payload (ConnectWise)", "value": "f0bea4c204323e1c0ef604d237f9a2a5020dd8c602d1a2d305791ee6612b7eed085d6534ce45f8ff842e7e2b91c7fd99", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423511, "uuid": "1f9eac90-6c19-407d-aaca-d71db78c23fd", "value": "T178C6231167F85524F6F31B36BE3A55A15A3ABC25ED22C12F0228B95E1673E80CD72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423511, "uuid": "01c93e91-0f79-4d08-a38f-64264714ee2c", "value": "196608:hsuCcGaDp+mcYMDgsuCcGaDpMsuCcGaDprsuCcGaDpusuCcGaDp:yuG8hMDPuGuuGFuG6uG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423511, "uuid": "ce04733b-3ca3-4db5-adcc-7faaa1d3bd13", "value": 12349440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423511, "uuid": "e43f97bf-f232-4a1b-b271-54992c50b2f0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423511, "uuid": "bd3a0fdf-d9a8-4227-9a8b-489537fd36d1", "value": "VIPINVITATION4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03760a12-df28-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766402339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766402339, "uuid": "fdbc341d-5d3c-4ebc-a24c-f66c83d4d741", "comment": "Malware payload", "value": "5884501fe2c98df6fd03db5c47512f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766402339, "uuid": "85686be6-029d-426d-bdca-065317e6c416", "comment": "Malware payload", "value": "64292ff235908c90b3f38e3c37a4bb2e474b76bede9a2f4a9a60e5d1a3d1258a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766402339, "uuid": "ed677aea-0427-43e7-9c5a-2ef226b6aae0", "comment": "Malware payload", "value": "9d18dd10818294b729e30d05dc35ac9f9f60e5ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766402339, "uuid": "a3714506-78dd-479f-8cd3-94de97ca22f6", "comment": "Malware payload", "value": "f270c321732044a1380490229bab4e02ddd8fddcf071988908b6b6dc2ad703cc66780f713ecd79a36c569671c3a025d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766402339, "uuid": "91d0cb8a-377f-46bd-9f9e-573658df5de7", "value": "T19BB67E6BB7B48569C16BC13AD0A78F509932BC750B31D2FB625236682F316D09E3E371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766402339, "uuid": "ce873f64-039d-4721-9d5e-4eada58b69be", "value": "a2e5b9eaf1551dd8041be474664e38ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766402339, "uuid": "c6ae0c4e-e3cc-43ac-965f-d9da66e50205", "value": "98304:HSAmX6MlaWbC6JwbP7Wd6ZcgzinbRpnVI3LEWBZfXoeoYJXNHfkDrhD8i:ySNPRsnbRpjWvoeoY9xsDrZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766402339, "uuid": "626a66f8-e60f-4ae8-9bf8-40504117b12f", "value": 11016416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766402339, "uuid": "88acbc1e-5215-4a3a-9448-27ad45f25694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766402339, "uuid": "d410cbc9-7045-4228-a400-cf956e8ccbe8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccef841-df8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446056, "uuid": "62eca958-58f4-43dc-aae1-6f484ce4ebad", "comment": "Malware payload (Mirai)", "value": "4dfe2c73bf2517e16c00e89318728cf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446056, "uuid": "52b934db-ff7d-4d48-b3ab-bb63670829af", "comment": "Malware payload (Mirai)", "value": "64377fa21d4d50db0faf3e423ecca785d621579f973855a2183f949ea054a27b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446056, "uuid": "296d5a8e-7b44-4558-83e7-054df8b615fc", "comment": "Malware payload (Mirai)", "value": "3736138aad7b4a8294356428c101911614860f5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446056, "uuid": "3ef75c20-03f8-4c69-868b-17f012fcc443", "comment": "Malware payload (Mirai)", "value": "2c32232320649f0f5f00a604186aee57643031d068be61094cf259e14779228feac321f5b5b64ba51fcbd339e19cffd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446056, "uuid": "049d4b5e-6356-4873-bafb-9d771f141bd2", "value": "T1B293F996B8918A11C6D452BEFE1E51CD331317B8E2EF73539D146B247B8B82B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446056, "uuid": "cbd3c5fb-1b6f-4b41-a1de-801d5ec02469", "value": "1536:dtn/4D/G9jAMGOfEJtCFKIFw25qbUwLIPPOp1+Cn3IT/ysm8rUi3gM7iDPW3uj+n:pjdK2YDT+K3ImsrePW3uj+xT23rT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446056, "uuid": "cf88351e-cdd8-4d06-81b0-cec951581458", "value": 91708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446056, "uuid": "69fce7a4-3555-4c65-a7af-21b4c20cf202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446056, "uuid": "f8883f37-c980-4e66-a6fe-d8092a595aae", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7127abd5-df89-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766444185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444185, "uuid": "9481a634-ca57-42f1-bd6b-83fbfe0f5be9", "comment": "Malware payload", "value": "e7cc6a87b8d834e10e05f4ac6a128f65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444185, "uuid": "b4b8bc14-0784-43bc-aeb9-6703eadab8c8", "comment": "Malware payload", "value": "66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444185, "uuid": "e2eae6b6-2f0b-41a7-92df-55f6fd2d11cc", "comment": "Malware payload", "value": "0972a6df5cd628f6cf49eb9526c311f9a40c0c63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444185, "uuid": "bd10b852-c25f-438a-9e1e-142780c8ea80", "comment": "Malware payload", "value": "70beaa2d407f737a9fd799e9ed90b3ebb82518ac67e2af85f5bec583c9d92e6478a17eb0cd20c038a54eaa416c4bb2aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444185, "uuid": "9b8eaa0d-451f-45e5-8182-7fc0207cf4cf", "value": "T198F60257E2E360FCC567C174876B9672B931B85502347EBBAA94CB301F32E60672CB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444185, "uuid": "8b7e2483-4a65-46a5-a149-c44c0b22e04d", "value": "33e665144370dc8abe957c1e6de012bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444185, "uuid": "860c15ff-139d-4c82-b287-53027359d57e", "value": "98304:NaoqX0osWPm1zODmp1dseSQemF6U3tcbQLxp8jqdseSQemF6U3tcbQLxp8j:fxosWP1WdKcdmbQVpXdKcdmbQVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766444185, "uuid": "5b796b86-a093-4724-97c0-9eff7d50d07a", "value": 15915520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766444185, "uuid": "b190264c-a42c-4ecf-9697-fd7d7fc86216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444185, "uuid": "26b3c207-49e1-4f4b-bbba-da841f002531", "value": "e7cc6a87b8d834e10e05f4ac6a128f65.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d425e9-df2d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766404724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404724, "uuid": "60b9ea96-e387-45b6-b314-0acd720e08e7", "comment": "Malware payload (Vidar)", "value": "152e4aa5616818d2591d6f11aa362d70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404724, "uuid": "492f3e64-1ff6-4798-baa8-5db8f3bb3b52", "comment": "Malware payload (Vidar)", "value": "6728c0e667f40232d57f9c3b01f07f130851f756dcc25fa3faacbb5ff6e09749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404724, "uuid": "a9577ad6-78a5-4fed-989d-367e80fa1b63", "comment": "Malware payload (Vidar)", "value": "3f5770f0377e5d5d2261fd98099f9b4227c679be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404724, "uuid": "9310ac94-1b16-4937-a03b-942820b7c1a9", "comment": "Malware payload (Vidar)", "value": "c6cec15386a9a401592ccef41c9f350660edef59ca4c9a1770b1bb6addb97ab7d44529af52da10c0c1ae4ae519a1e4f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404724, "uuid": "a2b77d77-bb8f-47cd-bd88-403d6b40667f", "value": "T105564953FE948666C09FD17998B3924176703C48073032D72FA26B751EBBBC42A7BB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404724, "uuid": "1c203f75-2cc5-485e-9f9f-a105b4e289cd", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404724, "uuid": "3d21728d-7e2e-4a12-be59-8fbaa6da0cc4", "value": "49152:RYdaR4cY0fdmSBdNC2mqixOtIaJy6JUrsGTiMlBinQFN1xSD89OvdmhlKi2+:RjzmgJtISy6Jpgldn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766404724, "uuid": "0a5786d7-d5d0-4cac-8e81-ca6add67ce2f", "value": 6067336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766404724, "uuid": "5b5b5c90-de1e-4b20-9408-eb818a98373a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404724, "uuid": "cf101b24-ff17-442a-92ca-bf63ab997e67", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2fd7f5-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387483, "uuid": "06350b35-aa94-478a-aeb5-1491dd86b68e", "comment": "Malware payload (Mirai)", "value": "5a6fe5d516dca22012ce2814ffbb809a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387483, "uuid": "d94e7dc7-74c4-499e-aef9-35631323ae4b", "comment": "Malware payload (Mirai)", "value": "6737ccd8d7dc5945638e935dd11e9aa635b39af9b125b1f62e197b04e9dda3d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387483, "uuid": "fdfc409d-c082-4406-af50-8ce3475c5b37", "comment": "Malware payload (Mirai)", "value": "82717581777278536f10635b08daa53b9983124b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387483, "uuid": "1c1e0be1-8e9c-47be-8f6e-0fcab6134a8c", "comment": "Malware payload (Mirai)", "value": "3ecffb03983504c258f2b47e361930cde1ae153b4e431bcb6bae974ad9d27ae9d91a9babe0d1c7b3686a71e8c24b41d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387483, "uuid": "7e7e75f7-5833-4763-a56e-54e8f51d62d3", "value": "T1E06301CB6EB02F26C1D8A1B2703805D6CD3ADD8BE243869DD3E6EB55073952654C8B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387483, "uuid": "927475de-9615-4a4f-98f5-3ae0614b5c44", "value": "1536:kaxZLmYKVDNSl2y08yumeJyGYVmIMGrONY:kaxZLmYKX+t08jmeJhYTCNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387483, "uuid": "ca796565-6659-4de2-ab14-0108ba8db921", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387483, "uuid": "9c2727ba-47ed-4f6a-909a-913192c1e8c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387483, "uuid": "6ab1d8db-7f5c-4440-82dc-22864797615d", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b3301f-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387470, "uuid": "c964d05f-18ef-4ea6-9b1c-c78214c18e67", "comment": "Malware payload (Mirai)", "value": "c7193a8201e460ac2afd83df2d26e485", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387470, "uuid": "3ebcada3-08da-4910-8386-ac1d67cc4b75", "comment": "Malware payload (Mirai)", "value": "6739482cc3fe3f034c884e4ee6aef7bd0c76de6780591e4d88153cd2e0c61fe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387470, "uuid": "88d52503-df30-4786-b11a-716071f7d66f", "comment": "Malware payload (Mirai)", "value": "bb36b8676e758b9b35025dbb531f82937b259b9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387470, "uuid": "17118841-d5db-4a00-b967-d69ea2d713f2", "comment": "Malware payload (Mirai)", "value": "ab9517f7128f32c8a5157152c516f190f910f2a5ddf0559c08068b4e5318b07eff08cae84f127fcf18463eb06447cf96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387470, "uuid": "6dafda50-ccf8-491e-b6f4-78c463acd1d4", "value": "T1D153011FA2E0D99DD6FD2335610742179BE583A5EBCD791AF7C294EA2502C023F96183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387470, "uuid": "e663a3bd-fee2-4e26-a01b-d672bd29b9ae", "value": "1536:72lGUgozn1fET9B4Qm7rUH+nxkSb459E29n5AQU:Cl7tBETjVCrUHmxZb4/0QU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387470, "uuid": "1d78854a-635f-4583-9b7d-38ec0db7909d", "value": 61512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387470, "uuid": "0476cf7d-4866-4c9e-891a-7f57f0a3d059", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387470, "uuid": "193026f5-c81c-4f58-941f-5b3b5169705a", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a2ee16-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388844, "uuid": "83662f94-d8ab-48e8-88f5-0ee4d52506a1", "comment": "Malware payload (Mirai)", "value": "76d32b8f945f24a44fc7bf89207c82a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388844, "uuid": "0a84002c-0a0c-4c5a-9714-4e74222c42cb", "comment": "Malware payload (Mirai)", "value": "6962a2b046e3dfe4238f52f8d4717fab02227c089f5c8dc2a2e4c57b3951a19b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388844, "uuid": "1bc50ddd-ee70-4113-919c-4a7c4abc53a7", "comment": "Malware payload (Mirai)", "value": "9adac68aa91c2f469ae473209b187684ee52f0fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388844, "uuid": "d060507c-a980-4dfd-9943-c402b27b3ca1", "comment": "Malware payload (Mirai)", "value": "d8aaa56c7620da36966a6f73561af5b9f18bbf7c39da4470d5f45cc2b63dc653334f03747dec825b97b6b277f0b6a743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388844, "uuid": "497f92f4-8e3d-4af2-bae2-72b9fa7cff56", "value": "T104B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388844, "uuid": "28259ccb-3f26-4102-8430-fd380773b2a1", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1H/LWy:c9sSyzz36YaWWgg1Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388844, "uuid": "32b9ee3e-a000-4e85-99c7-f67a0929dc04", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388844, "uuid": "424a7944-66df-4fbb-afae-3f7b3d944295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388844, "uuid": "f268a618-f939-418a-9584-a39598ed032a", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e411d4-def9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766382207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382207, "uuid": "fdf5e045-bd35-4bf0-9568-004e65722f4c", "comment": "Malware payload (Mirai)", "value": "03d458c78830ef12fe57361924e1e559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382207, "uuid": "e3bdd3c2-f5b4-422d-86f3-4f08331d28dc", "comment": "Malware payload (Mirai)", "value": "69e71de8450be9341f492cefcb02d605dee6cdc02baeedef7a42bdb8edbbfb63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382207, "uuid": "2ab8c4da-f6c9-48a1-88fa-83777ff1829b", "comment": "Malware payload (Mirai)", "value": "c5c3327d91650aa488c53215422a987ba03e9163", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382207, "uuid": "93c58638-3cb9-45a5-839d-6c9ce22c0125", "comment": "Malware payload (Mirai)", "value": "d48fc7e8d8b5e54495810690f59b0acbdb9c0ead38988674b447c11006836b83903c0f74744e74ef9ee90a7f6c5f3ea5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382207, "uuid": "7348f6cc-93d2-4424-9b83-cf5b601ce9cb", "value": "T19D630258B3C76BF0DE149B38971193B11B9625C24C158B12761F29AD3CAF0B4372B5EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382207, "uuid": "97508e88-86ee-4fb9-a933-c42f6943f2da", "value": "1536:7Di0bLhB5s/X4vD8YoeAxtOCt2xxf3GV4eVLoYegUNucKF15mQRror0:7D3/2Qv4YogCyfGhMlNucK5S0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382207, "uuid": "fc404a55-ed28-4fd6-bd47-b0c07359ee78", "value": 72948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382207, "uuid": "b99d01aa-5dd5-4cc3-9b91-6e7d9139ecbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382207, "uuid": "bb14a66b-174b-46bd-a0ce-dd0480d4477d", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09eb12b-df71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766434037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434037, "uuid": "c6f308db-dcfd-40db-a4ba-32422a7dbc30", "comment": "Malware payload", "value": "4258604fb81d8b1597840a0df595627a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434037, "uuid": "109668fe-7a0e-4411-911c-c69e84f92c06", "comment": "Malware payload", "value": "6af21c2381c1078c46629386988ab032f9a31a341717d08c7ae7eadd06894ce5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434037, "uuid": "0d010c66-395a-45f9-b48d-9f47fcf0c993", "comment": "Malware payload", "value": "a3da17308e79aa17bcbde1067458325185be24e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434037, "uuid": "4e3a1825-9639-425c-a3e1-86146f777df7", "comment": "Malware payload", "value": "4360767be6dc3a3b8000037f8ee70f664c1ef5b50cc9ef0bf32a5a8967622ab8c3104bdf3a69cc9aa1b9e69e0dfee49c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434037, "uuid": "44345648-b29c-492d-84d8-91d12c6252b4", "value": "T186B35C02E31C840BE6E70FF037FB53E1A367675126B5E286360997445676B329A06FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434037, "uuid": "84cbf70c-3e6a-433f-a5bc-7fe5f255f143", "value": "1536:lzyAlJXgzcjPLflL1RDOSeO+sHwVWLK+EDhL0MqtQD2pXJV3nK9bKZ:lGADfjPLfreOZHfPEdL0MbmDmbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766434037, "uuid": "a29a54e2-8eea-4ccd-b07c-c74b43b00c8b", "value": 108040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766434037, "uuid": "da7b63b4-464d-4287-9d3e-a855b4f19207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434037, "uuid": "a11f8724-f5e3-424c-a79d-3c75094e4844", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f67f40b-dee4-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766373315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766373315, "uuid": "55c96602-9dd0-47bd-9d21-c7a9a59bff20", "comment": "Malware payload (ValleyRAT)", "value": "644d361093c60f8d742866bc9cdfe1e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766373315, "uuid": "5e7550d3-29af-4134-9d77-4430f063b83a", "comment": "Malware payload (ValleyRAT)", "value": "6b1432b24402839fc8b0ce0f8976acd35887e42b49a679d677f221dc8bcc9f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766373315, "uuid": "fa27a81f-3385-4d5d-b3d0-c488186e6f78", "comment": "Malware payload (ValleyRAT)", "value": "8a8dfbba96c8b8b4f9f2ee2237d8994f2dd283f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766373315, "uuid": "8cca5efb-8e7e-4510-ab7c-03c4afb01645", "comment": "Malware payload (ValleyRAT)", "value": "c8aa48d5afc818f4c64095690137b808dae613a8fcc629e2b9c9c390456ab5f4a54ed880e53f9ab45e5b4cdcffc8913b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766373315, "uuid": "65569e18-a494-4ef3-bd4c-461e6a713656", "value": "T11615D0BF7B5C4024D0E3DC3A8627FFD472F9676A9F40A87229A651C69920CE1F217643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766373315, "uuid": "85850de8-2f94-40b2-9660-e2e0916262c9", "value": "aa09230b6afaf1d2accd79107b27b959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766373315, "uuid": "30cc4f86-b99c-4788-a509-4fd63f39992c", "value": "12288:K7n+zxOxfX6RISKdHD8QGqmsmy8lzW3lOzUfTyjLZCBeeSyKUmUqrqVQJvBFV:K+zxWKISKdj8tfsh8kUzZLbyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766373315, "uuid": "a36aee00-e833-4f68-ada8-ba6936475321", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766373315, "uuid": "3295094d-ff7f-46c0-9c91-7bca807aa59e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766373315, "uuid": "f6fc6aae-e7f6-4fc1-b966-a0976c3d5cb5", "value": "644D361093C60F8D742866BC9CDFE1E6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd05d90a-df90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766447318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447318, "uuid": "9a20bb5b-9c26-434b-ad29-b7aecc57359c", "comment": "Malware payload", "value": "08965d036ef1166ad85e7cb7f6c1fff6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447318, "uuid": "2f57de7e-7599-4411-a35e-5accf995d939", "comment": "Malware payload", "value": "6ba0011edec5b6fcdcff36e64cf356924fcc439e966b602dfd4cb0ef7f3d0509", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447318, "uuid": "5582c68c-0315-40a4-887f-e4f92b4c4d71", "comment": "Malware payload", "value": "1e31eb93e5994b0e078b2cc18f3c5d6837d0b42a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447318, "uuid": "567ab7c0-8176-44df-878b-50b076b4629b", "comment": "Malware payload", "value": "5d55c77ae87af94b57fde7ae6c0d93361bdb32825e9ea1c4213c2a0cb0d7312d316c68a8ff2a615034e45557568f843b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447318, "uuid": "860ff931-e9bd-4455-ae70-c148efe3718a", "value": "T12CA37D46E643F4B0D80A0179264BA3798A35EA322421DD5FFBD47F71ECB1B11D91A32E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447318, "uuid": "278379d7-beca-44ec-a0c8-dc841d904f85", "value": "1536:l2zvX75lQfLX4sdHTh8bcUiLvqFHyUYAnKgb3LmgUA31URouongjNgwEIKxVS1Cr:QkL3dzh86vwHyUYAnK+9CRMnf146", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447318, "uuid": "49394f1e-eda7-46eb-a701-34936420b131", "value": 106116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447318, "uuid": "e97b7034-aab5-46b5-89dd-906e124b5fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447318, "uuid": "f9932102-d645-443b-a882-52c2ebaaceb6", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418369e6-df59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766423489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423489, "uuid": "8977d6b1-3ab9-4907-b717-81d108b5efda", "comment": "Malware payload", "value": "305a7f3761027a110033051aea789ed3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423489, "uuid": "2a1d40e3-7aa9-4473-9c2e-46161f9d70b6", "comment": "Malware payload", "value": "6c76e515ef8525fbf5081da6da361951866ccc08f9b4e7bf32693f35b5614660", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423489, "uuid": "c6abf7f9-3bfe-4ccc-84c5-19c39f41128d", "comment": "Malware payload", "value": "b92d580b5a14cd305cc44de967fdec37d7b62863", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423489, "uuid": "89c95c74-bb1c-4394-93c4-3cfbe043b62a", "comment": "Malware payload", "value": "68d9a971c1560495ff1de3b56030ee232cab9adc5c946c429b2eeeb27979729c2151c9345936789e975eada78604db00", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423489, "uuid": "c2aad613-7816-4d56-a252-a82f7004258d", "value": "T17E26D3823758B1D283BA0AB15E3A0135B6B208379D2D0849FDE645F4CB875B1F6B7E35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423489, "uuid": "5cc2134e-33dc-4328-8d75-9a1acaf01073", "value": "1536:pS8SYnDS+1VAqwKnXiR3FV/pLWalBgWgDJF0gFV/rWlNI/kBQ:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423489, "uuid": "e10c7c35-ce42-4481-87a3-5dc7b3665f76", "value": 4573879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423489, "uuid": "a9eb8bd4-26f9-4c6e-8065-b77e48e14383", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423489, "uuid": "df7a0c08-346f-467d-9d61-aca010f1f81c", "value": "INVOICE 302 303_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657605c3-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387471, "uuid": "d500160a-7f26-4706-b9ef-cc222bc6c97a", "comment": "Malware payload (Mirai)", "value": "e113828ca7916b4272bc4f1899cb18ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387471, "uuid": "6e65e16c-8a64-4746-8ac2-30d92436c60e", "comment": "Malware payload (Mirai)", "value": "6d6c9579ca57b1d3d5a3961be5ef90e7e145f071263042b23afa461e99e3713a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387471, "uuid": "a6340c76-20f8-4c9b-a770-f419d297a11c", "comment": "Malware payload (Mirai)", "value": "f9da01b627ed36c19d6dd497d5e282cb0f38e4ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387471, "uuid": "a5b67b25-8dd3-45c2-a231-132a8f8a38c2", "comment": "Malware payload (Mirai)", "value": "8addc2ed53ab34644dbb60b25b659155c8b49027ce0c3ee3d4397d2d3dde30938ab0c5aaed83939d5cf6033d9cd4666e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387471, "uuid": "5704fe5b-66dd-4f4a-b0fb-2105cac3e969", "value": "T1A5C3E185BB6369D1C1A342BDA4C00AC387916E318BE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387471, "uuid": "e6806778-3cc4-4be9-89b0-c2342b8b4942", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnb:0OCDjXG9qTWywxlxTnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387471, "uuid": "c1733632-5912-4cab-8eb7-ca5c6c1c2a2c", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387471, "uuid": "ea858403-5537-48fe-af13-8653f42b44a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387471, "uuid": "b5fa3435-a968-4fbc-ba4d-642656095b74", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964a4dca-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766397861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397861, "uuid": "54abff20-146c-47a2-b363-fc35a769e232", "comment": "Malware payload (Gafgyt)", "value": "b7f61dcadb3d690008af109cd10860b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397861, "uuid": "7ff13370-3ce3-4c47-a5c8-62ef56074ee2", "comment": "Malware payload (Gafgyt)", "value": "6d9db25fbd39b9da8d557586da16d941bdef1fa097d7c1027ad0754fd824edaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397861, "uuid": "b37502ef-d4a7-4067-a798-eaf1ae3863cf", "comment": "Malware payload (Gafgyt)", "value": "675994b539be154530884869eed34b98dd6ad3fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397861, "uuid": "f8fe55e7-aeda-4b61-b667-d822e4fe6147", "comment": "Malware payload (Gafgyt)", "value": "4d5665613cae79146c1f3eae4a45c6c2bcac27845801869da7de1cbc54fbaf104069e5f5d06494362198a0a5bf946e1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397861, "uuid": "29ef9d2a-7f03-469f-98ee-43da850c9c63", "value": "T1CF836D82DD62F8B1D421007A132BE7918A33F63134729D0BF7A62B75ED99740EB5236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397861, "uuid": "f969de50-605f-4b38-b095-509eeba904cb", "value": "1536:zQxzSNiach4EMy7t0LU1zI0kJcb7gI+8A2pFyEbcC8ZCwBb7BQ8:7N87tSwrwcIcFPbcC2Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397861, "uuid": "1e236cd2-b1bb-4e8e-8f66-ef5130d47587", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397861, "uuid": "d9ea4bd5-b9a3-4d56-b3df-0f67e2a34012", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397861, "uuid": "e8d3deb6-b5c0-4f92-b20e-bb5269b8eb4a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583a6bfb-df73-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766434694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434694, "uuid": "48a993c8-bb34-4782-9a13-7cd104dc668f", "comment": "Malware payload", "value": "a36ac6ef26758b7d2f464d4199ae7ada", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434694, "uuid": "9e78f2ba-7b39-454d-8abf-1961221369e7", "comment": "Malware payload", "value": "6dd97ea59e781c649f073645b4e2f1babfa49fd330f011a47975d770a8937203", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434694, "uuid": "e569721f-17bb-4f8c-a938-bfc16f54e7b1", "comment": "Malware payload", "value": "c2f45eaffde3666991f7fa617a15ac24a05d246c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434694, "uuid": "289189d0-2abb-45c7-b311-4795852cd4c7", "comment": "Malware payload", "value": "76d638a932069c95b5aaeeea212a9563b8ef33d5a2d5cd6ed7996780336ffc5e2a2d097146dfdd1b930eddbb62e875b2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434694, "uuid": "fbb55fd9-a566-40c0-9945-8c45fddd01f2", "value": "T1778733F4C870564ED43EC6778FD49569D2EAA0B285E38C6E9E448FD7B9E37E47088201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434694, "uuid": "c8931e78-54c2-4d54-9127-c9a40b3443ea", "value": "786432:kDnautUdc7T5knvgzRWNBiUaHLR0jieONYyZxYsg/Ti1+6qacYk:krauyq7VknYWNBLaNteO1Ysg756j0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766434694, "uuid": "93e3f8e5-f49d-4d8f-b836-240626be998a", "value": 37935204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766434694, "uuid": "b00013a0-9931-415b-9fa9-f89d2f995728", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434694, "uuid": "d96c87d6-2b6e-4988-9ca4-d7d2df38537f", "value": "New Version.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a42e99d-df77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766436496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436496, "uuid": "c6ed1bcc-57ca-4056-8e30-4cfdfa2d5f65", "comment": "Malware payload (Mirai)", "value": "9fb4f2985c8612cfb489345a0113c088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436496, "uuid": "75e4f616-0423-4bff-ba2c-fcfed0f6d38d", "comment": "Malware payload (Mirai)", "value": "6e4b17ca744d0b15af68bc8a80512dd995e8df3c29af0e9b635904b4eac1194b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436496, "uuid": "5ed00c61-24da-4b1f-8fdf-0cd2bf956dc3", "comment": "Malware payload (Mirai)", "value": "2163a3e5bc9655cf49e7af30daba0935ffa6744b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436496, "uuid": "973f0ac2-e646-4c6b-ae26-c90d20b3b15f", "comment": "Malware payload (Mirai)", "value": "a351fc44b48cace500142121deae19bb3fc6d696f0afe727022f70a67e6edf20d4f0215e23061cfb1852c22fb5537042", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436496, "uuid": "238d9f92-7d97-488d-99a3-5aa48ab0e4ed", "value": "T1ACB36C02A31C840BE5E71FF023FB53E1932B6A4166B5E2C6360997544575F72DA06FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436496, "uuid": "80037d76-1a43-4ba0-a5bc-b4efeb61a576", "value": "1536:Umu5OLxOfORUeRmUZ7gtLK88OjcDKNlkmOZS6+1FG+fmjjCg5UI5CPGjP9t:UVfef1WO8i2kZ+1ffmjT2PGjPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766436496, "uuid": "6f892f42-daab-4126-a270-3b60c85bd326", "value": 108040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766436496, "uuid": "05953698-b1b8-4c95-a913-df5186aea8ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436496, "uuid": "5a2d4dc0-501b-4ab1-b1f7-d8bb6cb94b94", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1292ec-df6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766431613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431613, "uuid": "b2962bf6-ad60-4f1c-a38a-833de25aa898", "comment": "Malware payload (Mirai)", "value": "8b250e60d380085110791b02fca9e2b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431613, "uuid": "c72ea075-1026-49d0-90a5-748bd538877d", "comment": "Malware payload (Mirai)", "value": "6e7b7cef1f7a1b7f264047cc4ae0e1d42a96222316119f679c00013fb47df23a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431613, "uuid": "2c1a798d-e7bf-4535-8814-1179be828e56", "comment": "Malware payload (Mirai)", "value": "519361a2762d0dfe98e523b9f7958601c5a0f8f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431613, "uuid": "fb4f69da-14c4-44c9-99cc-c504b534f988", "comment": "Malware payload (Mirai)", "value": "0322bf7b83919c99b08ffaf98a1788cbd99f513cbcf79a4e6773f25b596e9f0a2c7d613f1db207d0d8520925288f1fe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431613, "uuid": "92f79b2b-a8a4-4b91-981b-f79e774c3541", "value": "T18EB31A95B882AA12C6C25677FF4F428D7716579CE3EE3303CD185F70328B96B0E2A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431613, "uuid": "1ef3e053-e618-47d3-8b28-cf29be6069f1", "value": "3072:gvVP0V4FvMKS/IZlyeAluxXTYJl2MvnzR:gdP0Vyv1S/IZoeAluxXTYJXbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766431613, "uuid": "e6580718-c9c0-4351-9cd1-0e662f85f132", "value": 108536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766431613, "uuid": "a6bac7b0-6c5d-4571-8e52-44b18e80cf97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431613, "uuid": "dcc3b6c0-53f4-4e18-9197-fff875ed48ff", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec42600-df11-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766392802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392802, "uuid": "a100c63d-548a-4532-b98a-3ee5ed071184", "comment": "Malware payload (Mirai)", "value": "e9ae1b0e2e38de20f52e070eb4a0257a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392802, "uuid": "0d977e64-e7bd-448d-ad50-d7115af129b7", "comment": "Malware payload (Mirai)", "value": "6fe3c0e7ed52423fff9a39eabddc26a277e7a766f62d18c3e347d0df99368b2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392802, "uuid": "4ad9917d-ffd2-408f-875f-7f9176fd9d32", "comment": "Malware payload (Mirai)", "value": "de17641774ccb536cdd7b2f6923ad0bdf5b43856", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392802, "uuid": "eb0cb392-c0fc-4c9e-870a-21bbb69ace65", "comment": "Malware payload (Mirai)", "value": "607ef8bce6d93d11af757035b91e04c7ce63e28d91e52f669d0dbb552b3434150a2efead83e9604b5d5a7fa736326697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392802, "uuid": "de34afa4-832d-41a3-873a-c8942a8389d6", "value": "T1B6C30796B8829B20C6C2567BFE4F118A331367ACE3DE7313DD185F24278B55B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392802, "uuid": "beda3922-f386-4993-b38b-d762cbc7ad1a", "value": "3072:vn3R98tdf549mvKaxuZhsNrVJYrlTxI527MqaNknQ1dTLHpnz2:vnBitdf549mvbxuZSNPYrl652AqaNkQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766392802, "uuid": "ada1f53b-602f-4728-9870-2eda31b502a3", "value": 119932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766392802, "uuid": "830c59e5-e9e9-44f7-a8f0-3ed213039240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392802, "uuid": "200850cb-768d-4aad-8b60-11f552580645", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f7c55b-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387479, "uuid": "b26ef98a-5a8d-418b-a531-0ccaa43d42cc", "comment": "Malware payload (Mirai)", "value": "9690e1f743cb1cdcc93f322f54be361f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387479, "uuid": "77ef1237-2f16-4ffc-84a1-e9967669dde5", "comment": "Malware payload (Mirai)", "value": "70050c57be934b308494bdb2e975bfa9d0be7e8fef2ff6d03744574b180bfb52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387479, "uuid": "4a4443f9-1476-4c31-ab24-d2e163d45b18", "comment": "Malware payload (Mirai)", "value": "dd6cf497afea9fed7a183cfc596897b1da695794", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387479, "uuid": "ab793aa7-fe5a-46f3-8c7b-348e9ea8c444", "comment": "Malware payload (Mirai)", "value": "a03c074c7ee908e1799528eef2d5e8ee325cd76440b423ae8865915f736c4f04ca1c35f0da0935f6581e29fefd1f57e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387479, "uuid": "30c803ed-31f5-44a4-925f-01c3f8b87b56", "value": "T13DD3CF30E0146DE1DC2216B9387AD5B80750AFB103D65482FFFEEB6A9477D4838AD271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387479, "uuid": "d1aedb6b-8134-42ad-a02c-e8a04ff1c762", "value": "1536:+3OcGqX5lhZ5f25cPNJLC2uOcvqimk4xIfCp/Yl8evgEhs7BmEl3uZS+gt0r:+335lN+iDLCFvqimk4xcCI8VVFTNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387479, "uuid": "10f8e46d-374b-4171-a81c-b3a16e393046", "value": 131708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387479, "uuid": "26b44d9e-b0f3-4b74-9903-869a1c03ffbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387479, "uuid": "ea01ea99-04be-4990-bf48-6f0c66bb3d7d", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3342c2ff-df59-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766423465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423465, "uuid": "72f4e903-bcbe-4749-a457-c35085385db2", "comment": "Malware payload (AgentTesla)", "value": "c0f348dc7a69f3e025f329a844834e81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423465, "uuid": "d61518bd-61b5-4104-8add-12f4cd7adaa0", "comment": "Malware payload (AgentTesla)", "value": "7042cbe27c49d8a87dac4af3bcc5cdefc714e92d73b64b23de9093e1771c9208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423465, "uuid": "102d65e7-2046-414b-b9d1-e135198d90f6", "comment": "Malware payload (AgentTesla)", "value": "81e891314da07dc42bb17a2711bcf2d5dee488c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423465, "uuid": "254c251d-fe9b-4f73-a5a4-84b6029f5372", "comment": "Malware payload (AgentTesla)", "value": "55b5e83f82c4770f9fc37bdf5fbff3e4a57cbb3cbc4086a8532bc2ebfdaca81dd78bddf5e026f5043460be3b6dfbc125", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423465, "uuid": "305ec224-73ce-49f6-b6f6-8e3183e46720", "value": "T1BC45F1158DC42FA9CEA89D1850BE160EE3F0469F542A758ABB3BBD06AFF7744010F1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423465, "uuid": "2d7f6a7d-2807-43e0-8a84-417259e7f33d", "value": "24576:/6hJxu7tBFf+shojKuesnkNSuDgWd62MnvZ5/oiYAZ+rP7VxhHvcA:4DdhHes6Mg62MnR5QXpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423465, "uuid": "f2a6b61a-1f7d-4c5c-a600-63dfbfc4df10", "value": 1249568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423465, "uuid": "1ef25509-3427-47b6-9a1f-c3626deeba03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423465, "uuid": "10e02d09-be43-452b-b336-f3949ffad2c5", "value": "LOI for Telex Release Customized CN - SHGS03139847.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f2d197-df7a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766437584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437584, "uuid": "a007926c-2933-4d53-b5b3-a6f44e6f7574", "comment": "Malware payload", "value": "5e45c1b1a90a8ef8a4c83d303336243b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437584, "uuid": "eab0896a-7129-473d-b0f1-70ce89826b57", "comment": "Malware payload", "value": "71e8601241879b7ffd5fd4a5093918cd73e72e160a1ee935ca7d9b98cef9968e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437584, "uuid": "c02e1dfc-5e2b-41da-8f9c-521fca5af337", "comment": "Malware payload", "value": "504d7709f86a096846cc8d28fbc38749b53c56e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437584, "uuid": "5eafd36b-c5f0-4c9b-b5dc-3396e1c571e7", "comment": "Malware payload", "value": "10e5a68694645a85499f7e8a1d8158ec7ecf430e4ff176d30b3e2264a324e15c04184687746a390dbe63aaa834f323c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437584, "uuid": "438e3fbc-c78a-4cba-be83-cdc6b7c2c9cf", "value": "T10DE63345C8E97C74929805F4F0A1A1F5B438735F1E4796BADF93A2C1CE5306B4A3AB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437584, "uuid": "c0f1d9c8-936c-435a-83d6-6fc949312e37", "value": "393216:2AgTIlGsKhJprtkNYbl0hVRPRbW/mH6cI0gZAQXo:fglzpJeRRy26vAQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766437584, "uuid": "5aea07ef-4761-4fdc-ae8e-07a0ba844bbb", "value": 14421504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766437584, "uuid": "6d38ad46-70e7-43a5-976c-82cc5a2af28c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437584, "uuid": "e9af655d-ee8c-4676-aafe-9c63c19b8489", "value": "TerryHackExtra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572e0e9a-defc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766383582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383582, "uuid": "e4d8ecf9-4201-48a1-9e58-36ddd3fdc73d", "comment": "Malware payload", "value": "d4e79b2d388fac4ca1b07e04bcc4d624", "object_relation": "md5", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "hotdecjanniygga-blogspot-com", "colour": "#A2D002", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383582, "uuid": "3c285690-e82b-4f66-a3e1-b66e85457db9", "comment": "Malware payload", "value": "72b7eb9b31bc0b9109183dd2c26b0540f01ee28210909abaca830b6611329dd6", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "hotdecjanniygga-blogspot-com", "colour": "#A2D002", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383582, "uuid": "ede8e285-ab14-4d90-9d48-b85560b653f8", "comment": "Malware payload", "value": "d1cc44f067eeffe944512020af9dc8b86416e3bb", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "hotdecjanniygga-blogspot-com", "colour": "#A2D002", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383582, "uuid": "fc9ed9f8-8355-4cc7-ada4-6da90484f075", "comment": "Malware payload", "value": "ef30b79abbfaaa6e42edde38e8eadf6e623d0f35701479f230eeb37db0129a0dc0775ebbc41ca81d286d37dbd28dd15b", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "hotdecjanniygga-blogspot-com", "colour": "#A2D002", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383582, "uuid": "e244f0f5-31fa-41f9-8a79-8b286806e2f4", "value": "T1E82612E9DEC4D669F1C02A6DB316011373BE7999F2F56283E2332A7A369E043511C7C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383582, "uuid": "4561aed9-ae07-437d-8eda-bf3cb2072b3a", "value": "24576:rbXbXbXbXbuTjzurAVwAVwAVwAVwAVwAVwAVwAVwAVwAVwcQE+:rbXbXbXbXbuTjzurbE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766383582, "uuid": "9bf4c55c-1dcd-411a-96b4-fed74f2c2508", "value": 4483195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766383582, "uuid": "7ceab033-753f-44cb-aea2-297b551abad2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383582, "uuid": "63632f6a-db29-458d-9d41-de71d620f097", "value": "Kinder.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1fcf9a-defa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766382973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382973, "uuid": "12ca9cff-f1a1-4c69-8a57-52902dbf3d6d", "comment": "Malware payload", "value": "5a1cdd6bd7f6ac77a983b25ac5b42b39", "object_relation": "md5", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382973, "uuid": "93076917-c036-44b9-abdd-156516743c70", "comment": "Malware payload", "value": "72bda50013391b72a4d420a907811f506ce8927c692c3983b8e2739a3bcd2c97", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382973, "uuid": "68b37911-43de-4cc5-8590-bc740819124b", "comment": "Malware payload", "value": "3a71c1bb7cea879b3646c12dd9fe50a6e6b61bfe", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382973, "uuid": "b9a2b83b-c41c-41d3-b15a-3085558b0ec8", "comment": "Malware payload", "value": "ff402d147136cfeb7358015d8aaf7f012056a1e10cb1f7f7f68722fdb193abae943b6b711464520fb18d1054c0ee2d70", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382973, "uuid": "c52756f5-eab0-4d39-aae2-1cff2a2a7ace", "value": "T136631983F8DBEB34107F2822270551E36E99D89682775625413B2AEF4E712EB3F65348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382973, "uuid": "3b7e2c70-ac35-4f61-867e-fcd4bf48ad4d", "value": "1536:I9l/AoSSM8SuSZSgSCSNSXS4SjSrSYSoSxS/SuSUSdStSDSMSSS5SHS5SwSCSoSF:I9l/5M8TA9ZuuvuKflyOT1QYURRk6MNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382973, "uuid": "fc89551d-1712-4d6b-bd3b-686ed9396ffd", "value": 72487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382973, "uuid": "46f161d5-2b14-411d-9f4d-d123220ca5ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382973, "uuid": "7733d0bf-6b62-4b96-91d7-43ec5c72416f", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d22a8b-df02-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766386100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386100, "uuid": "332dac03-6240-416e-a5e3-fbaa2b6b068e", "comment": "Malware payload", "value": "aed12067dc95df084710a590ffe3a9af", "object_relation": "md5", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386100, "uuid": "193b16bd-3325-4b9f-88bf-b4bb08269710", "comment": "Malware payload", "value": "754e14f02feb4ee07af4cfae06cf9de37a0bbb3f2709302e9b5afdedad271daa", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386100, "uuid": "7dcc0e67-9338-41ff-a7d5-f7f70dd88507", "comment": "Malware payload", "value": "5068a5921dd3d721f57431f7b2661f33d4ff6117", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386100, "uuid": "af7e12b0-2545-4ee0-8eab-8a04bf4f40c1", "comment": "Malware payload", "value": "7649a222171ac8e951b43a1d6a2dbfa9b29259d1867a2d47f19e70559d0c67c7e5765312458d8e23f6b9d48613199bc6", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386100, "uuid": "73757013-bd2c-4a3b-8cc9-519e752880e7", "value": "T1A1441A197B49D710CFC88B35C0E7940451B196EB4AE2F6273DCA7A8A5F203DE8B4ADC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386100, "uuid": "8f5db0fc-c233-47c9-87a6-cbc32bc72962", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386100, "uuid": "b8415e4a-d8d4-4ec0-b9e5-0cfdbb46fb67", "value": "3072:+Ic5hsKbjJT4P622OQF+659t2M22U+iYoP0iL9tNypCoEdzIKIFzd9XxkMd9olIA:8IAt8Z2OQF1ztY7dxrDbBkd9XxJdVbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766386100, "uuid": "267c5ec6-9738-40bc-bfd0-90fee806ab2e", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766386100, "uuid": "43e96e4a-a9e9-4f4a-b2d8-9020a86a5c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386100, "uuid": "f5059bdc-6d6e-4435-b8ae-e4cfaf24fbc8", "value": "754e14f02feb4ee07af4cfae06cf9de37a0bbb3f2709302e9b5afdedad271daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1f6546-ded1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766365014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365014, "uuid": "7c120ad8-da2d-40f4-8aee-96fbc42a403e", "comment": "Malware payload (Mirai)", "value": "c5738c8de2672c8f1180eab1589f0a64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365014, "uuid": "4cce6b24-d6a8-4fc8-a909-ffb38119940b", "comment": "Malware payload (Mirai)", "value": "7697f8554b8d27ab76300a50c4f5a8b8f2c038db46a9309ce61d0997a4c753ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365014, "uuid": "3cc512fc-1b97-4610-8042-416746669b66", "comment": "Malware payload (Mirai)", "value": "6859a5ee9a2637a461714c492afe98bf8874ae62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766365014, "uuid": "29d672bd-fb4e-4deb-ad59-1a6b1e16faf0", "comment": "Malware payload (Mirai)", "value": "937d5cb151a1fa777648d696ab3ac52c56e8ba2753f4c3b5d5c4d058b78d823b2f8ce95a443d3c104b7a6d01538e9168", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365014, "uuid": "2c03746b-e24e-4f5a-b6c6-217dc062fc49", "value": "T1E1437B76CCAAAE94D65C55B4B8328F764B139000ABC62FBB5566D9709003D8CF58E3FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365014, "uuid": "7aa4be78-4f70-448f-9a52-04028e9ceead", "value": "1536:+B9w2iJ9REHpZUMM5RjooACMN/UJmAT2bVR:+3MYwMiRkoAtF61T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766365014, "uuid": "6c1a48b6-ba0e-4ef8-8832-7585425ba4f3", "value": 55484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766365014, "uuid": "dfdb822a-9b16-451b-b1df-ddf11e036025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766365014, "uuid": "aafa12e0-4962-4df8-9d2a-c196043c9370", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403a8ff2-df8b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766444961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444961, "uuid": "6ed5ee7a-ee4f-497a-84b9-01bed71d2ab0", "comment": "Malware payload (AsyncRAT)", "value": "f4e604b57747c2dedf1f1a1377b207c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444961, "uuid": "3e6624c9-7068-4c67-b6ac-b7b3bc798f5c", "comment": "Malware payload (AsyncRAT)", "value": "772261fd6cdefe311770295943766d31c39dd6f856a72aeee2d48a459c9e1fc7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444961, "uuid": "e41080e2-199c-475b-bf1b-c74f398e4e49", "comment": "Malware payload (AsyncRAT)", "value": "817d325c498e3d40e9c66bbf824c21612c105f7f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444961, "uuid": "2fae262b-0753-4bf4-87b3-73b84a9540ea", "comment": "Malware payload (AsyncRAT)", "value": "fde7167267655ece9ddde327abe58c5ca608a708ee8fd4dae7697303d4ee98fa897e7d8fd77ccb4ea406e35b02cdae5a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444961, "uuid": "2c601a57-d7ac-404a-b70d-24449f7c147a", "value": "T128C418CB701A5A6A2F0FA84B0AD4AB98EF8313F1407D53D7AA1475F0720961F5CD9B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444961, "uuid": "9f1ead59-bd30-4fe4-8247-819de882c298", "value": "6144:AnilR22KT8fPEEgd4zmJRw0B1v2DLwLTtYOxFcZtReOU00dG1yGDEbO2m9xwTPo:RlU9W0B1v2/Qn0P7lh2SYPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766444961, "uuid": "034855ee-5994-49ba-a875-bb24f2a9eb18", "value": 565954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766444961, "uuid": "c7fced40-4a30-42ae-a597-fa8b62d79237", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444961, "uuid": "30a0be62-4143-4ea5-aee5-03ba0a1ffbf1", "value": "SSADocuments.pdf586577082.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f37b48-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424864, "uuid": "571be0dc-5980-4474-9ada-7edfe7d26704", "comment": "Malware payload (Mirai)", "value": "7498e821ca02a7f8b55aae1fd92556a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424864, "uuid": "5e47c898-f5d0-478d-a67e-efd59cbbce0d", "comment": "Malware payload (Mirai)", "value": "778735e216100efb774a6605835fc48766921ba0bd8d67b6040b4e5d2eb9c23d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424864, "uuid": "765b4884-8407-4e2c-88dd-68fd81f8f795", "comment": "Malware payload (Mirai)", "value": "a63eed168875f37c0b25e3985e57a372eeeba9b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424864, "uuid": "671e1cff-2948-4b2c-98b8-900be3555cb6", "comment": "Malware payload (Mirai)", "value": "a44055892ed21385d43386297fcf5f48c5305eb2892f700a4350d056af2fa66a45153e6bcfb057f36825aad238bbb444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424864, "uuid": "4ef6f61d-614f-44d7-9f4e-92e6f0ac9ebb", "value": "T1A7A37E8AD283DCF2E81604B1513793779B72D43B603AEE86C329DD75E896900D63B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424864, "uuid": "f50f67ca-dea1-49e4-8285-b4e2529ab290", "value": "1536:zlp3ZUevQgEHBpmjyp7BjW9uW51jFX9TYIt50Sgfnve1iiX:zlp3ZUYQgETmjyp7FpW5tFtTXhRMiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424864, "uuid": "b4232c41-568e-4a53-bb77-6db9538e5cdf", "value": 104396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424864, "uuid": "1b8886e1-5d52-4681-8fe9-6cb833f673c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424864, "uuid": "7010a957-b34f-434c-ae2a-5a4347aac536", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8484ba96-defa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766382799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382799, "uuid": "628268db-de2a-4b59-b186-eefad3bbcf34", "comment": "Malware payload (Mirai)", "value": "26f89c88e6b611fe94e4d8d78e9e98ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382799, "uuid": "f4a8de5e-7f09-49a3-8b3a-229eda4c367c", "comment": "Malware payload (Mirai)", "value": "77b6c0aa534fa207865fd6167eed26bbc17562f27de5affec86c4ca4059cb8aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382799, "uuid": "3e31183e-a6d3-46c4-baae-1f6d2b7dce53", "comment": "Malware payload (Mirai)", "value": "2fd89a8c7b2180246f4d9b4a9cd0938f234d244b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382799, "uuid": "7ef44f86-78fb-45eb-b846-77c2912f2abd", "comment": "Malware payload (Mirai)", "value": "ba7ba13d6bb07c9de504642d6e6fbd3f98fe3fe616d2a7e3dc73a5db81aa5d8885be68b87e3baf1f376ee6dce65b4d1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382799, "uuid": "055dcfb9-5c07-469a-9976-12ade658749e", "value": "T18F630907B58281FDC14AC178266FBA3BDC2275FE0239B2A677D4FB262C46D211D1EE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382799, "uuid": "a39bee0a-edd2-4959-b9eb-5353548ee7e9", "value": "1536:j+74tE6dgkaTJD0xMI3Qh23NS0vnK66jlU:g4OogkuJxNMk0/6jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382799, "uuid": "d2d5862c-5db8-4b54-8840-0254bf2ae3af", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382799, "uuid": "26408def-f8d3-4fef-b9a3-78af56b839c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382799, "uuid": "d11f4d74-14d9-4654-ba9e-03dfbbdf3b52", "value": "frost.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe318df4-defb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766383433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383433, "uuid": "aa54f312-22a0-4506-9c5e-47ddd1bc0a47", "comment": "Malware payload", "value": "5fa0e99d392dc5806464610a0b3b62c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383433, "uuid": "aa16a560-186a-482d-8791-ea4cd8837010", "comment": "Malware payload", "value": "780541a6a7818e50c34998f2e490a693db092437b770d2162d644d5f6408d81a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383433, "uuid": "5acd0321-6a70-496d-b806-865e42568493", "comment": "Malware payload", "value": "13d179bca234f1ab37f26477359f5c1b352e2922", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383433, "uuid": "2b2da4bf-7292-4bb7-9b00-1627b862b19e", "comment": "Malware payload", "value": "a9e657fd4e5a37d82a1a6fc0051c920bebc898333ea246cb279824522724ca6d06c3a6c6920526923eecfc4295ea2c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383433, "uuid": "e10b18c3-37c4-4160-bc3f-0d4f8dcfd7b0", "value": "T1DCB3D70BBB60ADFFC80ACD3708AD861664CC950771983B777A74DA1DBB1754E4AD38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383433, "uuid": "bf44d410-ce54-4aac-9ee0-247ea05bbbcb", "value": "1536:hEOa3iM6NQ9Wa5RDiC7E1OtnnQR/NZ6V6t4Ll6agbIsYKF9GsPgw+iT9dx7hgN+Z:iOa3iM+QLRm6EstnnQALMZJdx7hxhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766383433, "uuid": "15adb4ab-95d1-4a7f-bf3d-8bf916fb054a", "value": 117450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766383433, "uuid": "990bc500-7935-4cb9-af92-cab57fafddc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383433, "uuid": "98d077aa-6513-4e5c-b3cd-16edf7d5b434", "value": "n3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f0c01e-ded0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766364714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364714, "uuid": "b45b32d8-f83a-497d-80cf-2e08742bf275", "comment": "Malware payload (Mirai)", "value": "6430ed6d099d201433eafc9dd7a21247", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364714, "uuid": "e1192416-a31c-432e-bb85-dcc86b197abb", "comment": "Malware payload (Mirai)", "value": "78a19baeb4e0c9928c753f9a7b3348e570a771ad927c518304ae25221e357de7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364714, "uuid": "31a74aa9-5d58-40f1-8127-e7f6f8d18683", "comment": "Malware payload (Mirai)", "value": "32980b93642a681d5330c5b04ff8ec9894829ac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364714, "uuid": "64fa1c3a-300c-4b00-8c69-434fd56aa1ed", "comment": "Malware payload (Mirai)", "value": "9efe2412a0a6e63e05a36151f76dcad68cfaa6d0c748251b7b9e5abfc856acd1e8f88d1921fb4c7350a0349ff6ad0df7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364714, "uuid": "3e3724b5-d593-4ba7-af4d-9f399926b70d", "value": "T12AB35B57B9919B11D5C216BBFE1E118E331307B8D3EF72125E246B21238B96B0F7E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364714, "uuid": "1155ea25-46b7-42f0-b748-7443b0c2548e", "value": "1536:AJnK8S8PWrKjM4+gDip1+9jxj5dE5hWKazPDzIuodSi3NwHRPS+G7De2YlmemI9:MSEWruYg412/ELWKaziNwHRK+Gfe26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766364714, "uuid": "aa48998a-10f0-4c53-b9c6-516026032e54", "value": 111828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766364714, "uuid": "2141bea9-dcc7-450a-9a7c-822bc1bb11c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364714, "uuid": "2c23aba4-77e0-4815-b6d8-30d87a879ad7", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a9a979-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397855, "uuid": "67611ce1-39e0-45ce-8de5-d95490744624", "comment": "Malware payload (Mirai)", "value": "ed9e0f36aa2492f23ea713de67b1f123", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397855, "uuid": "0bdec9ae-d439-4ebf-999c-1979bd0100af", "comment": "Malware payload (Mirai)", "value": "7a976f036541ae43766409bd72cc62447c02f6d211129d55a5f5bb86878079ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397855, "uuid": "f2287c63-2b21-41cf-a26d-53cf39f457e1", "comment": "Malware payload (Mirai)", "value": "5abcd6fef72cec5031112e4cccc9880ca08ac572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397855, "uuid": "2ad41f96-5db2-4d39-a6e8-cd45ad1d081c", "comment": "Malware payload (Mirai)", "value": "cd03c817a35d21229b6f1bb923e45cd9f8887a308fda14c4acda4003212127184af81f8b64dfbd7a471f6fe704506a71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397855, "uuid": "7a406099-eab1-4ec7-aecd-8d3c59f2f305", "value": "T1CDA36B46E653F4B0D8160035125BE37A8A35AE322425DD9FFBE47B32ECA5B019A4633D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397855, "uuid": "210826fa-f207-441f-bb2b-d2a25ef9049d", "value": "1536:fmnfytFYwkuUExJGPml1w1dWX8YvqFHyUY+vKpqfTqZUo3EjjUn31sod3csIcV8o:6yn61d+vwHyUY+vKpUyNiEm48wZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397855, "uuid": "fc36ad45-fd98-4f2f-8810-4dc04591a230", "value": 107244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397855, "uuid": "b7eaf23f-e6d2-454e-a29d-a23375a91f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397855, "uuid": "bc5b3fdd-139a-4842-9078-566807acf958", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b362a4-ded8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766368305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368305, "uuid": "73602027-6985-4c7f-bff5-5547c0e69d8e", "comment": "Malware payload (Mirai)", "value": "aa9ea4db935b30813456e6d200587eca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368305, "uuid": "27b658c2-10ce-4818-8ae1-6afb64049cbc", "comment": "Malware payload (Mirai)", "value": "7b5ff1b6ff8b68dade223e6e52fd75e3e4330c53389b52494e9dfcbb53255e0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368305, "uuid": "ba0df328-09e8-40c9-8888-b3d7f2dbb797", "comment": "Malware payload (Mirai)", "value": "dbc2029f6ff7260dba1c2bf5fd387d8c77a872d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368305, "uuid": "4609a4e5-1e36-4ffb-9ba6-b245b1c7c4fb", "comment": "Malware payload (Mirai)", "value": "083a3eb7dd1c06336dc32b48ac7ccebe2acfa38323255fd26dd63cdc20179f159b8acc36ccad9e0770b9a1eda08362e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368305, "uuid": "4c8f084d-c216-42cd-93ec-0ebcf319b192", "value": "T198C31A6AEC819A51C9D716BBFA1E958D332313BCD3DF32178E285F24278992B0D7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368305, "uuid": "a0669324-b875-4aac-b816-cfb0c2697e7f", "value": "3072:m3zeWplL7sZd0gvDKNpF2aFj9QrRT2GD3N:qzeWplL7e+yDKrQanOT2q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766368305, "uuid": "f6b0f1fa-782f-4731-8450-85c130bcfa9b", "value": 125352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766368305, "uuid": "dc85a084-924f-4f1f-8aff-7b5db5547083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368305, "uuid": "66347976-d8ad-4b7a-b848-d5f4c1c3d590", "value": "rondo.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf9df40-df56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766422381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766422381, "uuid": "bc516bb8-425e-428d-bd23-4e949590760c", "comment": "Malware payload (Mirai)", "value": "7b50f86be30153b3397b4818c054ddc4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766422381, "uuid": "8e6fd778-8730-4bb9-ae46-4cc9377b03c9", "comment": "Malware payload (Mirai)", "value": "7bf6ce55eae813ebcd86cfaecf9afbacfb0de98ba28d1949d835eccbb10b28c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766422381, "uuid": "70c317eb-9542-4f20-86b7-a31cc0e75b93", "comment": "Malware payload (Mirai)", "value": "366b61d4e69be79c176936296dc70a8b55563bec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766422381, "uuid": "a57c7b21-d9f2-4f63-98a3-bf6af4a1bc14", "comment": "Malware payload (Mirai)", "value": "87e6b3fcadf9cfe72f63c6d74c3e27fdbc60f5688b9a7e1db0de71f286d718ede433957b401c9ae5667a7093089231bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766422381, "uuid": "2e2685ed-b573-4f24-8fed-2f71a261ad2e", "value": "T16A5129FD39B236336596CE84F4625ABCB00FA1D473500EDCE47E28F585A6915B820B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766422381, "uuid": "24df8970-cb1c-453f-a99d-fee07fa28e61", "value": "48:z56JjHUTiA3nxNUyHfHsiu64tiylQOHiOeuM:F69Hm3xNqTPeuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766422381, "uuid": "727f7034-612c-4c0c-84fc-b519eda38930", "value": 2721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766422381, "uuid": "ad6b26b3-8519-4bf8-9420-fccf0a8f055f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766422381, "uuid": "2ade2b77-54cf-4e87-b988-26ebd8648135", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76527b05-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387500, "uuid": "25b473cc-f2e5-439f-8a37-f7750bdafd52", "comment": "Malware payload (Mirai)", "value": "21db76309e1e21f97edc3a83ebc1ad03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387500, "uuid": "f7ac58d2-99aa-4d83-8e33-a166e3a35c32", "comment": "Malware payload (Mirai)", "value": "7c0dff3ac2fde6be80e5d7b290ca88c78a684c3a94c41f2e8f1de50913ed70c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387500, "uuid": "58931960-d4ea-4034-9d20-c3ca85063e17", "comment": "Malware payload (Mirai)", "value": "efde423aaee92895b9f9e1780aae5ee15a5a3018", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387500, "uuid": "4b926eb6-92a6-4c2e-98b4-ea7b53f451c2", "comment": "Malware payload (Mirai)", "value": "ec6d244ebb24bf8a58c56a1cf117b9c8891d2fed39264217f46059ac5014fc159fe44498f3304dad5969d735e3de4c1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387500, "uuid": "efe1bb3e-c62b-42d0-9c36-3d50a763aeba", "value": "T161C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387500, "uuid": "eebd718c-3676-4e29-a8e5-4a6e0c093d6a", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyBw:VoRNjmj1VGFVrRiyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387500, "uuid": "b7e8e903-37e1-42a1-87fc-48bdc869be06", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387500, "uuid": "642f71ef-a19e-4068-a7b6-99eddbbef36d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387500, "uuid": "191cc939-1092-40cb-bea7-8c0c86020ad4", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aeab38d-df72-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766434161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434161, "uuid": "d1d5071c-4796-42e9-bf19-7366fc4481b5", "comment": "Malware payload", "value": "955f024946cc5b9dae8c9379efd0e57a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434161, "uuid": "3b5e2854-8796-4667-8352-e037924a0096", "comment": "Malware payload", "value": "7d154be788ef448407fecccf30f8f3dbba82b1cec1045110998dc3d4f7bd0590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434161, "uuid": "92ed02ae-6c74-416d-adc3-69111fc14cee", "comment": "Malware payload", "value": "4c7fcc66e003362ac1d1a712c129e5f372fcbdb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434161, "uuid": "8b2fe9dc-e8df-44d2-b410-14f8140025a7", "comment": "Malware payload", "value": "2454ab1d478d78c01af087ad88e41c1212d58ef917e8fad4ac952c31c07b3e9e807d43663afbd9ab21e0310ce9003486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434161, "uuid": "010ece25-87a2-4c83-9f2c-96545454641f", "value": "T1E0765A63FE944666C09FD239D8B2510572707C44033426D77BA22B795EBBBC4263BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434161, "uuid": "21b5b5a8-0daa-490f-89e7-d7a3ebf3bd5e", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434161, "uuid": "9369b2b1-8ce5-4330-a4fb-d3d7f3db23bb", "value": "49152:Ky7j/xh5BuA8e/5wsDCv0KATpLFIALz20w3Papr8UdmnAIOCT8Fmn3dmtT90:KKeA1hDCjATpZIALz29290", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766434161, "uuid": "4e36a63c-72bf-47ed-9d09-70dbc63ff5e0", "value": 7388296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766434161, "uuid": "b435ae53-1cc9-44ac-8919-7fccbbc19470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434161, "uuid": "fc5e7504-7dcf-499a-8c31-162af0c6b44b", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31066df4-df48-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766416160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416160, "uuid": "b776bfed-4002-4c35-a586-3533973cf155", "comment": "Malware payload", "value": "acb2bf75f0012f8a3c195aec7c129d1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416160, "uuid": "a5746e56-e0ff-428f-a1b0-be82341e72d0", "comment": "Malware payload", "value": "7df71ba2f45922cbda57170cd8d4c59ef95b3f0c74c796bf232343db5c7f86d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416160, "uuid": "fd121f2f-fc3b-47bf-aae7-7fb84b34336a", "comment": "Malware payload", "value": "0ae1eb475ba4af11cbbfd40684664949e59ebbe5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416160, "uuid": "d059a254-77c0-41b8-8f78-03f9cfc3579e", "comment": "Malware payload", "value": "2ec6bb810a94bfeb56edf22f2d7d8a9bd30421f83beed8f60461bed5d6ebd3104a873185f5fa0caedddbec286a2675ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416160, "uuid": "53146be9-e684-401b-bd4c-e8882acba02c", "value": "T1E1865A87B8918A47C5E43677ADBE81C433634EBA8BC653566D14FA3C7ABE1D80E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416160, "uuid": "334bd6f1-b2fb-4101-ad01-068a136b2d37", "value": "98304:RFdPptI4FIBjNc7zEvEUo9jqrNZaZ4hQbUdooMS5IG:RFftMjNc7gsUbrNZaZ4hQbUxIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766416160, "uuid": "859989ce-972b-41bd-9652-9505b11fc0e3", "value": 8251623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766416160, "uuid": "0fd5c24f-09a6-4751-afc1-410b477ca43a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416160, "uuid": "7f135936-e72b-4ac2-9b88-d0a82ba127ba", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61aef0cc-df7a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766437716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437716, "uuid": "b80af487-98b1-4ca5-bc08-19ec1955ee71", "comment": "Malware payload", "value": "8a6a834ebcac554ebe990b6170d38e8d", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437716, "uuid": "be4c87a0-0e5d-426c-9c7f-ecc9f2fa725c", "comment": "Malware payload", "value": "7fdc46f19fbd482ac62087ef172c443ddeec9bae76e850d0c2ae2abc18e0fee7", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437716, "uuid": "f8d19678-64e6-457a-8b58-316f44a97753", "comment": "Malware payload", "value": "4a12e5b499c875e29a604ac2bd2e8d7ecdce17c7", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437716, "uuid": "c13a0181-c5d0-4194-9d46-8bf90e021726", "comment": "Malware payload", "value": "7f37febd3976d89c6478cd523121fc7373089992923416a0c99dfdcdbdc5a6df1e5e5f87dd86ea64f68f19f7f2e76e1d", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437716, "uuid": "f5c0d8cc-6e12-488d-aff2-003dcc2134b7", "value": "T1EF97337BA26C5481FB47C6F2F57B870C50E2691112A398FBBF3425158D5F2E0AB32786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437716, "uuid": "5d23ea65-467e-49cb-83d1-0d96365de6f3", "value": "786432:MtP6bPhrYjHSgOkjgLRsewqxcxDWCVGXPWwXhQOsYseq7xov8FLibNsLjDTvcv:XbPhEm9xYqxcsY6Q7Y6ukMhsfD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766437716, "uuid": "b7b6ce39-3e70-427a-b838-b1596e741660", "value": 41303640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766437716, "uuid": "ec6425ff-f343-4757-8949-e948da854cd6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437716, "uuid": "b6e31916-36fd-400d-b022-dc3436dd288a", "value": "(1) Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64e2765-df3a-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1766410370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410370, "uuid": "8086c777-764a-4cf7-bf76-bc0c2c5faef0", "comment": "Malware payload (njrat)", "value": "53bc310a70a38af0488355c26e915166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410370, "uuid": "094e6afd-1559-40f3-bb84-791da0414d10", "comment": "Malware payload (njrat)", "value": "808c37c38f197a1b4647341fdc81de7ae806722ec0d4ed9b0556e92446ae1799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410370, "uuid": "ccf85ae2-9db3-49f3-96c7-cc29294aea30", "comment": "Malware payload (njrat)", "value": "b16f6efa78e0cd2bf3636901209708ce88dddc05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410370, "uuid": "21187583-4d2f-4eac-a234-c43cf2cb965f", "comment": "Malware payload (njrat)", "value": "088e93d90c6054e32ce7f07e5548dce9a325858d7aff9a2c7db5b09d7c807a6fe3b45c52d5c12b8dcb3ff1a27a7ed496", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410370, "uuid": "b63baf54-7ea8-438d-805c-ad8aa5509048", "value": "T175E22BADFBE64466D2BC0AB50571950013B4D103E523F77E4ECA28E62B2B7D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410370, "uuid": "2106dd2e-8cbb-47c2-a3ae-9416b8e1f47d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410370, "uuid": "d2f56d1e-9b39-404a-9bb2-973df689c678", "value": "768:6wrhO5b13hdwzxLy3os0O/dMRvCnQmIDUu0tibSj:BcZ6eh6gQVk/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410370, "uuid": "3de83453-41c3-480b-b193-57da26734c5f", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410370, "uuid": "e41b567e-2074-41f1-9c53-0ad7e1bf6118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410370, "uuid": "59ab55cc-2fef-4ba9-abd8-3a769d77ae1e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdc9029-df48-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766416158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416158, "uuid": "39f158b0-645a-44f0-bb9e-341df0ceea2f", "comment": "Malware payload", "value": "6af456d282e74450f3823e11a076ceb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416158, "uuid": "984f5997-b79c-4e17-9f14-41453e8328d9", "comment": "Malware payload", "value": "80e5526bc8a2689c463161986f65d1d0219ce94052a020bd6480ba02e71f4b89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416158, "uuid": "544fa3f5-4e83-4ed0-ba1d-c8cd00dd6b8b", "comment": "Malware payload", "value": "4c0ffd66a796eb72b4d121befb72d60f659a6155", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416158, "uuid": "7a81679b-e815-4ef0-bb42-d1a4aab9f35e", "comment": "Malware payload", "value": "5d17c96357703b79bdf709228f947bd3571f2b3a1810de7bd5ee8687e3258b619122b9508dc9dfc7f1ff8b33485900eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416158, "uuid": "51f8e416-d788-4f14-b64c-f311e424c5d0", "value": "T1FC9659136F68EB0EC22822305CB1CA9467695C8506D7A517B395F31CF9F21EC9A6EDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416158, "uuid": "bf8e19bc-ecdf-463c-aee6-2e95bcfab2aa", "value": "98304:43E2P4jQpKRnEjEoIQtAHz2fehipukpTD+zYym:43E2tKRnfitg2IipukpTlym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766416158, "uuid": "aa08bb75-d1b0-4228-af6b-f1535a17e74c", "value": 9102299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766416158, "uuid": "1696996b-c404-4768-96f3-2c5a683cb356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416158, "uuid": "5278eba2-0be3-4783-8b3d-e2368cb276e7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aba9a81-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387507, "uuid": "7646c36f-b021-4632-8954-85c83627d814", "comment": "Malware payload (Mirai)", "value": "2c702869dfe72b1176452f9f9a400e74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387507, "uuid": "c2a03d51-d641-4784-8953-bc0db50f6fdc", "comment": "Malware payload (Mirai)", "value": "8353952cf377a8e8f6486491a0832d6f390048ec2fbd6554547fd9c80118fde6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387507, "uuid": "ddf4b871-65a4-4661-9c67-2ce7fb146763", "comment": "Malware payload (Mirai)", "value": "27fea48f24db0d2e4666d4723a3bfff785a8111e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387507, "uuid": "1c38ec07-1351-4117-b9f5-4dd377600570", "comment": "Malware payload (Mirai)", "value": "7e37f62617e8359270183d4839b485d470b10adee1e2145aa7919c07d8e7cce31cbe181bca5de214711a94a55f1e089c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387507, "uuid": "a7f374e4-f26e-4503-9b32-8d156213b528", "value": "T13EC34B0A79D230FCC387D131536E9F21A936B49C42183DBBA386BE711D36EE12E15E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387507, "uuid": "b69c9832-c5e9-456b-b475-7a3cea3b8a75", "value": "3072:9juZlg5h/Ra23iEOIdwU1FB9/x1PV0Z7Q:92+hpqU1FB9/Tt0ZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387507, "uuid": "d88a18d3-4e66-4637-9cde-cdfef409b6b0", "value": 127968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387507, "uuid": "47649bbb-3eeb-4c19-b654-cb0ad315247e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387507, "uuid": "fceee765-19e3-4a9e-88bc-9fe5c22ca158", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f633dcde-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446555, "uuid": "0aaabcf0-ffd5-4df9-a733-121cf94375d1", "comment": "Malware payload (Mirai)", "value": "87524ce245cf1843ef8a74c37ddd9c1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446555, "uuid": "07542e6a-4a3d-4ddf-9aa5-792eb8beb89c", "comment": "Malware payload (Mirai)", "value": "8367aaa19b2045d9bdc5f0c3d241006cb776af1640ec630b6e8ffbafc44ef864", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446555, "uuid": "a3cf8935-56bf-41b6-a4bf-374299813381", "comment": "Malware payload (Mirai)", "value": "55030e62d46c5d27e032ddaf2f52f9e14ef4699e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446555, "uuid": "ea84eea3-befb-421f-bbde-6ef632a95a27", "comment": "Malware payload (Mirai)", "value": "eb0e3b4d236b84ad20edfe3312e299008fdd118849bd35ffe5286e07e65a63818f9a960ec7ec6d313cc503be6e8f8b09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446555, "uuid": "ee1d0818-8961-4c05-ad56-eb521a0785bf", "value": "T140733B85B8819622C6D5627BFA2F42DC332613B8D2EF7207DD156F247B8682F0D3B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446555, "uuid": "b00bea5e-b855-43df-8196-407c3910b7b5", "value": "1536:kCTSHCJHKKybVEfn20j59OyxKMSlCZkjZ5v2TAbVR:kCuib59OMKMSlCZgJ2TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446555, "uuid": "42219af0-4000-4e4e-b4b8-70e3fb723048", "value": 79040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446555, "uuid": "14681da1-54b9-4d27-abeb-486a39005d44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446555, "uuid": "416e149b-c1a0-476e-993a-8ae069cc530b", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37024c31-df8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766445375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445375, "uuid": "68227d9f-cff5-4c1d-82c0-eb0c1e549f3a", "comment": "Malware payload (Mirai)", "value": "1fa2adc208d3f3b0c41750cb483af33f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445375, "uuid": "189aba27-a07d-4c7d-a6b5-135b0aeb349a", "comment": "Malware payload (Mirai)", "value": "83c01118d8284ad15d850d6ae0f1dbb8bae57b75dddb02be0fc1fa1f9cb85576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445375, "uuid": "7dc985ae-9c8d-4d21-acc3-599e4bdc1280", "comment": "Malware payload (Mirai)", "value": "c37aa517e7c03064374a42a581aac28bb2c7c1d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445375, "uuid": "e37d5da6-3d35-4254-9887-8b535251c6d8", "comment": "Malware payload (Mirai)", "value": "16571388df2295699fc21e0578a89c16379587717bfaf7b1ea29b6c149b3fdf7255457477951c485294b0a3762f948ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445375, "uuid": "90c3d1a8-7c7b-4362-b2b2-fe6eab2d0fc1", "value": "T15D83E549BBA14EFBD85FCD3705BD4B45359C924322A83B7A3A70D418F24A14F4AD38B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445375, "uuid": "6f1b19e4-9432-4095-b18a-b619d11a8256", "value": "1536:EAvOXLnB8ipoDwdsd5YzRPJ+DZo79Dj3erB/T2bVRw:E9XlHvVerlT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766445375, "uuid": "63e5c31b-98b6-4dff-8998-4c44c6afb1bc", "value": 80740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766445375, "uuid": "53a84e6e-0f30-4603-9cee-d09b6312a643", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445375, "uuid": "af7453c5-4c32-4f9f-a301-96af98ce090f", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a78b1a-df59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766423492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423492, "uuid": "f462b3c8-051b-4973-9b95-196425aad7c5", "comment": "Malware payload", "value": "9c4177877f0ce5414123907b2e53e9ec", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423492, "uuid": "3568d581-1bd1-43b7-bf0e-afe4f89c45ed", "comment": "Malware payload", "value": "83f3b1df51a065e193a94faefd032521a60f4a902fa4166c972b03fad33b1ca1", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423492, "uuid": "686bfbbc-186e-460d-b102-13cff7019109", "comment": "Malware payload", "value": "a6c7f66920b8cc5d69d3bb84ee08a69099119231", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423492, "uuid": "16038605-ca8c-4c68-a933-96fda5657a81", "comment": "Malware payload", "value": "0f5cb03e1bad79b004a5190d6ee598489c78b0899097e39ad08c8ed0b4028477847431d6c9d59366d7117c4866f45807", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423492, "uuid": "9a9d1a06-677c-41e4-a939-4140ba7c9ce9", "value": "T16E01BD426800E36C78B89F526328E984C6E5925B2A14DF67B6C0A6984E361300F785EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423492, "uuid": "c2e61d0e-9875-4b17-ac90-3fa0a6f44182", "value": "12:5VWUAEqrRHRHN4dOpr9s+2629FWWstTM2eEkDtbfgtTXA3NmYMeq:CUA3RHr6Op5Bz29FW13ngtbozYMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423492, "uuid": "38e7e9a8-c7be-4652-9f64-ac1ddbc16bfa", "value": 792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423492, "uuid": "239dfaa2-3093-4b52-821a-1c99f864e20f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423492, "uuid": "4895d9e5-9b5b-46f9-ba61-bbe4c04c6eb8", "value": "ta.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6030cfa9-df2d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766404642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404642, "uuid": "430d8652-11a2-4bce-ad35-b765042db0a2", "comment": "Malware payload (Vidar)", "value": "fe704fce0fb391fd63f229e91c065f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404642, "uuid": "8c4f3a4d-ad6a-4141-8aeb-0bbf92da383e", "comment": "Malware payload (Vidar)", "value": "8447f0ad3256ddd461384e0abb3a1cff66e6c59b4bcce684216d6a1169624755", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404642, "uuid": "606cb5eb-e450-4653-a0ad-b4e602df0085", "comment": "Malware payload (Vidar)", "value": "b51586a0e2c3d0ef92e1b61f9710cb87a05bc46a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404642, "uuid": "567f77ba-1bc9-4ca1-8813-aba57280a565", "comment": "Malware payload (Vidar)", "value": "a3f4dc41a8b3e1a4bacb6a472b52852238ae6af43790d0051f0aa874f3bfc8f88b6639f3959cfc3064955ca1fc8a89e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404642, "uuid": "d5a7bf0d-5845-4f73-b81e-e2f4935636b0", "value": "T1C2465B53FD918666C09FD17999B24185BA703C48073026D72BA16B351EBFBC42A7BF2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404642, "uuid": "2e64b6be-b265-4877-a632-5086edc1360a", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404642, "uuid": "cb1681b2-6ef9-445f-b61c-a26a39455d81", "value": "49152:HAI/HvZeeEW0Qr61leBOLM4hGHnLv7Sn+XKpidm+Q:HFTEiEQrv7SKBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766404642, "uuid": "d17252bd-00ce-4d23-8c9c-01d4a96fd0f6", "value": 5744776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766404642, "uuid": "6cee963d-b19f-4897-a8e9-89b2e7aaf923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404642, "uuid": "7a7b29e8-91c2-4a8f-8317-c61a8b29b336", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf77115-ded5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766367110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766367110, "uuid": "8e173744-577c-422e-8d47-108580ec7e4b", "comment": "Malware payload (Mirai)", "value": "48e94d34e8585c70647bdf63ec396d38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766367110, "uuid": "f1c206cb-0181-46f4-ad4e-a620b679fb7b", "comment": "Malware payload (Mirai)", "value": "8533ccd2ce86793b22f72c5cb8049c5847124c15b402c500539861139eedc541", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766367110, "uuid": "44b11362-0f3e-47db-8d24-96bdc1c0997a", "comment": "Malware payload (Mirai)", "value": "1b195deff72f3a90562a87bbcd0722e62cc82817", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766367110, "uuid": "faa82f6f-13d0-4a40-babc-1173e949d414", "comment": "Malware payload (Mirai)", "value": "e1ad57317e94130428f2796dee3a7401dc699d919aa2e97bb7659a3de8b385cde6aeb75656ceb31d24607b89a30899e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766367110, "uuid": "3318105e-ad29-444d-9f29-da105c37cf7c", "value": "T182B3D74A7B650EF7D85FCD374AB91B05259C920722E83B3A3A74D818F24B24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766367110, "uuid": "10f255ac-2439-42ec-a2d9-54c372d14f28", "value": "1536:Bt+wzhpYhVKRB9NMc9tn1bgqD/A6gYLEaMIYFtl9PRhkUVRFRT2bVR:BlYhARBYsLbNjANVDRDT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766367110, "uuid": "ff1b8e5d-1a70-45ff-8b74-5326ab13b63c", "value": 109420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766367110, "uuid": "4c61eb90-2394-40ea-81b6-e39e0e0cbafa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766367110, "uuid": "0b8c4f5b-c72f-4de6-840c-ad206bc3d5ca", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2f5adf-df31-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766406273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406273, "uuid": "6891c982-0a63-4144-ae19-c723094f6e21", "comment": "Malware payload", "value": "d3f74bfed5ad77636f81db1a44d56054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406273, "uuid": "f0020468-309c-452d-956a-fbadceba4bd9", "comment": "Malware payload", "value": "8598cdeb536cdfc0150a5bbeb54afa1b33406bfefea784b381ccea08551d11fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406273, "uuid": "5af6edab-bb3a-4a03-bff2-900183162fde", "comment": "Malware payload", "value": "5974bbada0f079e2cf114b235addb63e722a16b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406273, "uuid": "7b1dd1ee-bb66-40f9-8e44-4cf54019935a", "comment": "Malware payload", "value": "a10e279e9c2db117e5c4ff1e63d05e724aec84871c41475df49d65f84d51f33718e472034d1464a7db524eabc1488c71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406273, "uuid": "81ff1e19-1a2b-404d-b023-4c5a80dabed7", "value": "T10F087B4267EA04C5F9FBAA3489E65213D677BC067F3085CB324C172A1F736E09976722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406273, "uuid": "9da04d7b-e655-4c67-b568-9fd0741040c9", "value": "04397e0bcb7648e70cf6570253f46feb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406273, "uuid": "b2bff87a-fcde-496e-a8d8-c11751c156f3", "value": "393216:s5/8EqLOkrVu7FvRrEiiY8izEHh68I8Tq8rIanQu58EASEhoIaE2lShYo8VSbYE1:sCOAP7nQJh8KZbOhELhvxOOxU3Kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766406273, "uuid": "4f677ac6-3905-49ef-8cb2-a077fe6abae9", "value": 77411068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766406273, "uuid": "6f0992e5-61c5-4cc2-944f-166eb14c318f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406273, "uuid": "fa4ff8c3-ff6b-421d-86a1-7939eb960157", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418c7d9c-deec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766376674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766376674, "uuid": "5cf14355-1656-469c-bc11-2d6aeebf9799", "comment": "Malware payload (Mirai)", "value": "9ec3576b531a514888ea903fc5761268", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766376674, "uuid": "1f656d25-2903-4ac1-9f16-47f260383b98", "comment": "Malware payload (Mirai)", "value": "85d24859f9da4218bc6cd4c98243c62530c4a7a7b71407a3628eebe85dd06e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766376674, "uuid": "f8e38920-5f98-4ecb-849a-a7ebcadf26fb", "comment": "Malware payload (Mirai)", "value": "b5ea38dafbfd9d3f1a752ad11367477814e0901f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766376674, "uuid": "3ae67d65-e9cd-4360-905b-27d51f963760", "comment": "Malware payload (Mirai)", "value": "e995df5f56a1678dd40ccd2bc69f5199acbfe62ad35f31d4b152385cadf41042ffbdb689ad82fbf057b8637efff1f376", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766376674, "uuid": "0892ab22-2214-4d98-aa13-66b12a1fc589", "value": "T159634925B97A2F17C0D1A47A21FB4B54B2F25ACE22E4C64A7DB20E5EFF116006503DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766376674, "uuid": "ae11ac6a-3d4a-4007-90d7-a1d7216140cf", "value": "1536:7FhvePu5YiwQD3HIixg+AkzW+kyCV+cTiZGQO6fL6N:5th5W+W5mZM6Dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766376674, "uuid": "39006eba-5456-443d-9cc7-3cc8c682f5c6", "value": 67232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766376674, "uuid": "bea9472e-650d-4d18-8557-af20a0c1e5a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766376674, "uuid": "1ea249dd-ceae-47ab-adb8-bf8ffb67aa0c", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1f8031-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388848, "uuid": "0c323fcc-f443-41a2-aa7d-83d6f2b40b23", "comment": "Malware payload (Mirai)", "value": "d61b2dd5e2e1493c52560dcaa34a10b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388848, "uuid": "b7215160-079a-481d-a4c1-ce36bf75c513", "comment": "Malware payload (Mirai)", "value": "86164d17a25cdb9d503449e3d445e6ad58a88c7752f9d0d830a199d41b4089b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388848, "uuid": "f5d683cf-bbe6-4bf5-9922-c4c6d7165cff", "comment": "Malware payload (Mirai)", "value": "8b50d1cde7ee8779095f9ff7ab0a0c92337412b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388848, "uuid": "bc40cb29-fd23-420c-aa52-e191ffc3d11d", "comment": "Malware payload (Mirai)", "value": "ea32703da900a61a27931f06b90f1155414cab047a1a31326559a37d49dae98f7b6459697ba5e80e60d02b61767edc16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388848, "uuid": "4b1f9700-98fc-4c6c-8081-8236428f23c5", "value": "T120B2D0CC64943084C98D7C7C2B8D4A664F6CA190BAED8B26E350CDD8B3BEA4F345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388848, "uuid": "0bd64da0-a8c1-4281-80eb-c3f0e8e42e89", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBp6Zq8WvX:BQlS07FUXqIYSXQKquOqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388848, "uuid": "056affad-7f0f-4ecd-944f-782383ecd13a", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388848, "uuid": "677c51a2-7377-4c85-b466-c4466c9bc055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388848, "uuid": "61ae2df5-8653-4901-b6ea-3a62f0b840b2", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4137aa5-df23-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766400461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400461, "uuid": "fd6f1de4-c41f-4036-b43d-4bab2d044efe", "comment": "Malware payload", "value": "effa7cabcf48c31289a64489e9e5d21f", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400461, "uuid": "971f3f2f-a8b0-484e-a124-c0321bc45e23", "comment": "Malware payload", "value": "8729b51f6f00609f6c6cf1b6244786589aeb5c60ba1adc6d77d3d82c65ef13ec", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400461, "uuid": "d26ae6b7-1a3b-495c-a138-8feb9ee0c10e", "comment": "Malware payload", "value": "16780d9021bc96557730f9b2791e2049f48d9c7c", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766400461, "uuid": "a7ee7501-f414-421a-b4e2-9447249af76f", "comment": "Malware payload", "value": "78279b925bee4b8f5516111bbc2279e7cc83d15ff25d8cec7f0d15616f68337eabf87118bf63a430a3a71e390d478078", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400461, "uuid": "6115e286-85b8-48e6-bc58-3f8b4dca5788", "value": "T1FE65229893EA5745F2FF6EB43929505196B0BA16DC13D75EA2C020CD0EB3B05E636E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400461, "uuid": "c40a362f-7161-4d46-bbda-96b82b07a821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400461, "uuid": "dcda1400-74b0-4f0c-9519-50de1e5f62da", "value": "24576:J+JEfJhZ8j53sY1jCeqm6qv80MaooQajSMpHYWOkEfW5EQJZrUVvsgMYHQgdUU2g:J+a5csqCeq08moPajSQY5HYryHACWRXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766400461, "uuid": "b00dd176-73c4-4eb7-841e-b97557ca2e10", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766400461, "uuid": "04f998dd-5ded-4aa9-a092-459a309c4ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766400461, "uuid": "565bc88b-54b7-4f9f-8448-2ac4f0824204", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2453a75c-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370182, "uuid": "e984c849-7dd0-4a92-84d5-946c1529e4c4", "comment": "Malware payload (Mirai)", "value": "3d164386538e509d5abd7c053f87180a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370182, "uuid": "af2bce45-b896-4a58-83bb-9320520c6c03", "comment": "Malware payload (Mirai)", "value": "87424b91d72a036d7fca2e587eac65c9ab67b137be68053c21267260086c5959", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370182, "uuid": "b08f3a01-f388-4f17-97d7-5b75660a2baa", "comment": "Malware payload (Mirai)", "value": "3db0b70fc3a92863f4cca90fbcd3271b998f705e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370182, "uuid": "424597f7-a009-4671-8496-a559807734c5", "comment": "Malware payload (Mirai)", "value": "2a019ba4bd19042ac008e372350afcb154ba5a1152a19779875f8f82b6cebeaed83760c43e71954a27e5f1c46df08584", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370182, "uuid": "b8f55bce-180a-43d5-b22b-d4482db05d18", "value": "T1C2336A76E46E5E84C086417075249F351F23B1C893932EBB16EAC2B55483EACF509FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370182, "uuid": "52a598e4-b7bb-4504-b315-3c30d4bceb6f", "value": "1536:8aWjW/cXGETFWaZqKAlSW4UBOCVQV5n5:8pjWuGEZZtAuUBOV5n5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370182, "uuid": "790c30b1-f25a-4665-a812-e178c16a9c24", "value": 50584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370182, "uuid": "edecbeb5-7d16-43fd-a933-b5bdc4cdfdab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370182, "uuid": "db69fe29-ee61-4c24-9861-51da3f5a3bc5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d615547-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387458, "uuid": "56cb3567-4a1d-49a1-a8bf-88ae0e2965f2", "comment": "Malware payload (Mirai)", "value": "78a9f2c685a192c5d944c665f478df90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387458, "uuid": "8be22d46-9750-477a-8db3-2fa677f7d02f", "comment": "Malware payload (Mirai)", "value": "876f9daefe6d989351fd34a94c8370b3da90fd16195802da6baa3bbb2690151b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387458, "uuid": "c9e45ec9-03cb-4eb7-abcb-f350afcf2a8a", "comment": "Malware payload (Mirai)", "value": "f7f935f06b9b4029fd606096b265cc3bed203552", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387458, "uuid": "68115531-d2dc-429f-9be6-252fbff67250", "comment": "Malware payload (Mirai)", "value": "4296bbbb64dbbd7a295b7e8f8b8f752093752f0ea1dca0b3f539c64fc83acd48b903207eceeab2c7eee4c03cbee5c63f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387458, "uuid": "8896cc50-2a28-4c17-acc5-f4d5bf6d39b2", "value": "T1FCD3BE31F0256CA1CC1106B934B6967C1704EFB00AE91242EFBEE5AE54B7E19BDED670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387458, "uuid": "89451505-a349-40fe-97b3-bc809a8c8e49", "value": "3072:WRY3ibeAj8d9NTiHh4Je6TPGx71ZmwqdSZIq:WRYSbek8dTkh4juxfmwi4Iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387458, "uuid": "47c39252-56da-4fdc-aaf9-f6c470503853", "value": 131700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387458, "uuid": "c83b6207-9c6a-45d5-9710-614d95461201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387458, "uuid": "bb312cfb-1740-4a04-8ba0-515f8a6da9b4", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973f8407-df16-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766394856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766394856, "uuid": "85569e43-693e-4a95-8ebc-d2d7feaaaec8", "comment": "Malware payload", "value": "b7591f24e8e8b7765e527608f66777d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766394856, "uuid": "7d849991-134e-4274-aeb9-56a5a11c6bca", "comment": "Malware payload", "value": "8781aa68e140527d55cfbcfe370a60eff04bebb67df4a8637e1b127668c77ee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766394856, "uuid": "47dea788-5d37-4893-976c-a4a3a44bc20a", "comment": "Malware payload", "value": "26fd040fcc8c724c4c5a7a96426800eb79b3e815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766394856, "uuid": "d8deb3cb-9cf4-4658-92c3-4c37008cc08a", "comment": "Malware payload", "value": "5311396f6af69ea5d13e4669089c9a07de7c091923d6a765beefbbaad97753b4b7aec8498f337b0d0d32a8bab847e54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766394856, "uuid": "e440ab28-4146-436b-b0bb-7b80ab8f0e1e", "value": "T145087B4267EA04C5F9FBAA3489E65213D677BC067F3085CB324C172A1F736E09976722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766394856, "uuid": "b733862b-1a77-4b92-b5d5-7a98db422475", "value": "04397e0bcb7648e70cf6570253f46feb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766394856, "uuid": "98818195-c078-40d5-9a2b-fb524c089468", "value": "393216:65/8EqLOkrVu7FvRrEiiY8izEHh68I8Tq8rIanQu58EASEhoIaE2lShYo8VSbYEA:6COAP7nQJh8KZbOhELhvxOOxU3Ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766394856, "uuid": "a83f5b3a-cafb-4afb-8ae3-9cd796f72588", "value": 77350203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766394856, "uuid": "d746b5a9-8c6d-4df2-9f17-c575f15e7ba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766394856, "uuid": "4128ae47-33b2-4615-a86e-9c33490d4231", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e3e610-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397859, "uuid": "9a91c34c-ad95-4614-8563-614a04bac7ae", "comment": "Malware payload (Mirai)", "value": "94103f466f7128a23e006153ad25b322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397859, "uuid": "4d635622-6134-4aaf-b5d1-4f9c12115779", "comment": "Malware payload (Mirai)", "value": "88107351b5c7015bd6d46d4f01d4d2dac0733d5eb157801bdbe672a848f10221", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397859, "uuid": "7eb373d0-b282-432b-92d0-ae56a4132329", "comment": "Malware payload (Mirai)", "value": "449a1293dcf66ce8cf2f47f4c81d3e8b8000068d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397859, "uuid": "02330882-b0a6-4f9a-899c-a38fb80e109d", "comment": "Malware payload (Mirai)", "value": "f01e09f0c2caa415cf49c275ce7db57e746c9209cda778331786985d1841460ebf2f36a53e81687d4d8bc53693795096", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397859, "uuid": "09900ea4-c5d5-4bc5-ab20-3e89a6e85d9b", "value": "T1A6B31995B882AA12C7C25677FF4F428D7716579CE3EE3303CD185F64328B96B0E2A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397859, "uuid": "7825e366-1d8d-4b84-a153-07c40f4657a7", "value": "3072:0v7Png4VvkiS/sVBy7AludX/VNVCg4nzR:0DPngiv1S/sVk7AludX/VNvsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397859, "uuid": "1f7ecb9b-fbee-4370-87ec-4a7dd1d13240", "value": 108540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397859, "uuid": "cbd46630-11b2-4a5d-9e83-5768ff67419b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397859, "uuid": "d2e10a46-e956-4b10-91c9-45726568619e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c184955f-df0c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766390632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390632, "uuid": "e2ea3619-a81c-4abd-a8b3-fb8c01bd1af4", "comment": "Malware payload (Mirai)", "value": "91fe521f0cc23f1cc3be5a82ea35a705", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390632, "uuid": "cf7266b6-21ba-4cdb-ab10-c001b24ee3ef", "comment": "Malware payload (Mirai)", "value": "881c736b0ef28f73fd09a7ed06dc6b4935f0a9e95bcd8ad05ed9bd022e3a4a7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390632, "uuid": "e1a41c17-fb4d-4bcc-a6ce-93a5498ac662", "comment": "Malware payload (Mirai)", "value": "34817df89d5000a56f922d301c0d75f158d92b30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390632, "uuid": "601f55b3-e780-4df5-9984-3b434d08bcf2", "comment": "Malware payload (Mirai)", "value": "afcc894892978a7e278a3cf8c98d20cd56ba9e9f03a778fd32a185aee2c89f3309d7c46bb9a097e72a7b68fdd6a320ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390632, "uuid": "1b644cc5-8aaa-49d3-a5d5-ce6247926805", "value": "T191D2D02FE6C47D47C83E4C76A42D16A62E87798103DF1E4D1742854ACCAD58FBCC61A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390632, "uuid": "8d84a07c-9f6a-4210-95fb-dd8786fe9214", "value": "384:d8flNaywiuFfd2AeGMXm4fRtVYyKvFzv3Eu/lEcdh8c0o+ofWxfcn3FawCRWGVCv:CfTduF12AlMh/OyK9zv3E4K2EfGajWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766390632, "uuid": "00bce078-1f0c-4ac5-806e-181ec2a4faf6", "value": 30688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766390632, "uuid": "f3024927-13b0-4fd9-85cb-bf0e521ef612", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390632, "uuid": "e75dc879-1ba7-4429-9c90-34f5695d9b78", "value": "frost.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e7aa26-df02-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766386420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386420, "uuid": "24f3bb9e-1868-4198-8e67-6082d9600f2c", "comment": "Malware payload", "value": "91a54775329fa1c34da2029a74408327", "object_relation": "md5", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386420, "uuid": "cf782227-bccc-42bf-84d3-226eee3779cf", "comment": "Malware payload", "value": "883cdd8a4f00147d87c84e57d6aa143b22a68e09015c92478de0b302dd998e82", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386420, "uuid": "ceb29581-cc1e-402c-bce5-6bfb2bd4e574", "comment": "Malware payload", "value": "4d71a107d312cfef3d4e16e1943437a813b171e1", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386420, "uuid": "178bb09f-51e6-4c8f-968d-3ea66f3d584b", "comment": "Malware payload", "value": "07fa548c0ae405dae1bde96e60fa58176c68fe327854da0e898552ba9a4a2b2d7b83fce0546d0033fc6f39f7cac0a687", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386420, "uuid": "e14ebf14-df77-4dda-87c2-fcb949e587b9", "value": "T1FB428E0DA288D1893AA661BFEEF67BCFDC3053BBA161409230FA55C6C3E43FB5554246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386420, "uuid": "28d00229-06a4-4c11-855c-ce764ac45f57", "value": "384:a2cSIc1WpbtYDVqHCEzD+lvn/f+jH8/meaalF+l7SW4b0Z0u0tIfvWyv6n+BhOV:TcSIc1WpbtYDVqHCEzD+lvn/f+jH8/mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766386420, "uuid": "c555f816-d1e3-4291-b814-89b9f7a75f55", "value": 12365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766386420, "uuid": "4cc0a849-ff73-4586-a898-8c021ac63851", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386420, "uuid": "6fc6340b-3889-44bf-a56b-b45c1ec4e53d", "value": "yssqpn.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e29200-df73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766434799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434799, "uuid": "720d945f-3b54-4e13-aa5f-e9b68c392d7f", "comment": "Malware payload (Mirai)", "value": "5e0eca8f867602d04f64578cbfe8bf29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434799, "uuid": "970ca9f6-87eb-436e-85f8-1f7997232b74", "comment": "Malware payload (Mirai)", "value": "8871ea9fbec761f7c3f8d036664d65e7acfb7156e88ca25497f39f71d704635c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434799, "uuid": "a06ae92b-9570-4023-af4d-cc28320f9676", "comment": "Malware payload (Mirai)", "value": "8d885598395ef8f2eb48e351e88c3105946683fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434799, "uuid": "29b47edc-db48-4ced-a341-5197c7c42746", "comment": "Malware payload (Mirai)", "value": "a7cf150009868cd92481c1eff581e5a4ae575c25561989ed355736a2bd5e1306d3fd8deebdc3a0c7750672bd0e72e9a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434799, "uuid": "5fec3c68-224c-4945-95e5-eedd500e69d3", "value": "T121D3AED7734B1910C46202F01BD78B9E3F6362158E4BD8FB2D0EA67E28755CB194A7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434799, "uuid": "06e9f58c-1bdc-4a59-8bc4-b5e62073da05", "value": "1536:pPaCA+qvlMId10KXzQuO9j+W3QjNpvFApliktQixmMjgv4Sny/LWt:xA+qGGbXzQ5962ANpvuJtQGgvnyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766434799, "uuid": "133024d1-a45e-49a9-8baa-9f196d294acd", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766434799, "uuid": "5eb8d21d-b2b0-4950-8632-c39b71f69054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434799, "uuid": "6f3b82d7-5479-4fb3-916f-4a45a085fde6", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6340c653-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387468, "uuid": "d88311cb-b832-4221-8387-6a7c4e65d9ad", "comment": "Malware payload (Mirai)", "value": "d325ba747c736e891e1a9a852d4d2535", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387468, "uuid": "c2691f34-dc5a-4c5f-99c6-7a846eeae61d", "comment": "Malware payload (Mirai)", "value": "888ed48db5837610a78077720a2ac0ec8ab0777d3b42e07182332ddb21eb8d91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387468, "uuid": "271c8476-b047-4e11-b948-d6c4e63b6659", "comment": "Malware payload (Mirai)", "value": "8b1090dcdabbeab20678d43955e4e04a1d47c0ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387468, "uuid": "43015f8f-b5f3-4647-98d5-6c4320622eac", "comment": "Malware payload (Mirai)", "value": "224a642f62fa66aac84415620a907045ff85b735e8fc245b3d140ced442346d0a6dde8151ff1eda1528daa4e9a519cab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387468, "uuid": "bb6bd840-4250-4423-83a9-7c442095fee5", "value": "T1A0D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387468, "uuid": "264b84fc-a483-4f5d-8117-f78cf16ed4dc", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Zd6:xOFgpOEoVv3MXL5NhGOd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387468, "uuid": "cdd4518f-7058-4768-99f9-486f81cbfd0e", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387468, "uuid": "5db6bacb-593d-483f-a4a8-6958d4d476f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387468, "uuid": "62f1ac2c-0f68-4bcd-b225-42004e02895c", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5d9ec9-df1e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766398219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766398219, "uuid": "8a4d6321-fdba-42cc-9d36-7dd3968c8e69", "comment": "Malware payload", "value": "7b3f6f291e7fd86b52db1b9911e0572a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766398219, "uuid": "bfc85b60-706f-4144-aadc-21b9ca5c37ef", "comment": "Malware payload", "value": "88954524b8e24acad13d00e1bb66f6cd437df1039087945ff1b010f9c217c1fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766398219, "uuid": "33d51083-4ab5-4e8f-b777-5e38ed0fb0be", "comment": "Malware payload", "value": "e1827ff6c49e636f3383da19758d53a3c40ece7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766398219, "uuid": "973b664a-7374-4fd6-9c41-de1c4095252b", "comment": "Malware payload", "value": "bb4883f603781550cf4fbfb7984c77e3e7da1f8cc07011c663093c98872c7c805429f890c939211447db49577a65500b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766398219, "uuid": "5ac7b8f5-6b31-470b-a7f1-793cd7c2bda1", "value": "T1ECF4A6DF2BD14C66CD0F0038CF7663168A3EADF89A572A410BA2710695F2EF47C6C995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766398219, "uuid": "cf2fe492-8734-4336-bf51-b764a82b620b", "value": "6eaa3c07b0844e16ff22350d113e38f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766398219, "uuid": "5caeca8e-bbd2-4484-9027-7e77737fd0c0", "value": "6144:rdmbZ8BnIqNx650I4Rt48wtB0uKiyYju4vAf6TDIo0avdG43BBjqka51uKVZwXQY:w+5Iyx6r4mti/YjZAyYoJ4LuMqXQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766398219, "uuid": "317be13e-bcd8-4039-b46d-f3c9242d94bf", "value": 765544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766398219, "uuid": "c60f5e29-8860-4dc7-9ed1-ff3fdb771b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766398219, "uuid": "bd31d4e4-90f2-4699-af24-8ed908454fe3", "value": "Invoice_23503_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179efcba-df2d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766404521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404521, "uuid": "b01fb186-99b9-4e48-9b8f-f958904144d2", "comment": "Malware payload (Vidar)", "value": "79250bc54860fbd33dd96225ff9bd729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404521, "uuid": "107e4b9f-fbfc-4026-b349-0dd1a128b134", "comment": "Malware payload (Vidar)", "value": "894d83b3f010d6315908c0e29a119154c4863074d2ddb556885e479f7c798ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404521, "uuid": "8ecc03e3-d697-4497-93e3-9a7b211c13d9", "comment": "Malware payload (Vidar)", "value": "27a2b0e585d353dac5d594b6845f5a03c32c6d4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404521, "uuid": "42ad0b5b-b389-41a8-97c0-6b84c3be5581", "comment": "Malware payload (Vidar)", "value": "71d8e094fb7a24a2bd32ddd1b47da548616d0fff0a36f86166bed7b139dcb1afc7065198c6b8cb076a1f0b996ca2f25b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404521, "uuid": "c114b436-ee3b-4584-9bde-710790e1b22c", "value": "T175956C276CE108A5D06A82718CB77192BB31BD550F3223D72A93F2792FFA7D49439B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404521, "uuid": "a37c5148-6c6d-4d72-8a37-8d778bbcddc5", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404521, "uuid": "597e8109-68d2-42cc-8f4b-fccbc75887c8", "value": "24576:2+rtDFUKyzOIZMrWAEAqYBIhpi06axGMUjeleN4j42Wc2y2o20:2+ZDFRyzHZ42AXB2pNnUxO2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766404521, "uuid": "e4d94ac8-dd77-4249-b550-e81f6fd9d6de", "value": 1956352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766404521, "uuid": "a1df3fef-da6d-4a4d-9001-1168f5cd4941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404521, "uuid": "39c47451-de5a-44cf-a481-8a32ea5f588e", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9622aa-df6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766431294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431294, "uuid": "455418e3-d91d-48bd-9a0c-088b70797396", "comment": "Malware payload (Mirai)", "value": "5c3273ddef6ecd5821bc3da977eee607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431294, "uuid": "cd92a62a-23d2-4c6d-ab90-15f3bad88f3a", "comment": "Malware payload (Mirai)", "value": "8977246c2eec422c5afb958b7431376b315d6fe4676c7a85edeb6e04e66515db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431294, "uuid": "5fe36b9d-d1d8-44f9-b453-69e9db8ebc56", "comment": "Malware payload (Mirai)", "value": "3d03218cb05773a887da9bbe11e93b458ee2a9a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431294, "uuid": "878ed24d-0efe-40e0-b221-c8b8c6ca26ae", "comment": "Malware payload (Mirai)", "value": "14309d9150cdcf97bfc9c8d7cf8a497017c2de44352585cdb68eae35a027712cf19b1cadf66d84a42397cd6e81ca58bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431294, "uuid": "b79c97ad-1742-46be-a47f-a1366b8f6415", "value": "T1BF73F13E06C410EFD86085F92A9243C1AAE1CB53F545D89B1C42D2914CF9EB899A7FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431294, "uuid": "0dc2d717-d7bd-433c-8a4b-04f0bd2da9be", "value": "1536:rK6SBxWPypQRlk2Yir4RHiFUNNETCupPbo+5KVJuk:O6kI6OlkdirUCmNNETnpk+YVQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766431294, "uuid": "9907470a-ad2a-466f-a767-969a09555935", "value": 74100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766431294, "uuid": "afd1a000-9395-43bf-b1aa-8fb4cb584cd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431294, "uuid": "21aad5e1-dae4-46ff-aa7e-537796395c3a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83601d11-df55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421881, "uuid": "0c0527a9-187e-4629-aa01-be42b38cb302", "comment": "Malware payload", "value": "3c28bcaf72e41f41edc6e19d8e39a3da", "object_relation": "md5", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421881, "uuid": "6ce95b8c-c368-4244-8fa3-a89e910a9422", "comment": "Malware payload", "value": "897b5ed78e91053fa292f8a459a061250863d70427e97c3eff164a299cc1f702", "object_relation": "sha256", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421881, "uuid": "0be24017-c33f-46c7-87fc-22b1004422a8", "comment": "Malware payload", "value": "73ad12b56ff32f8c0efbef092a7e33e1ddcfe935", "object_relation": "sha1", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421881, "uuid": "a1847595-9b60-41e9-8af4-c5e0ecbc215d", "comment": "Malware payload", "value": "ffd004586ffa03a68d5b1457d27106932a72e2125b5dc888eeb94edd574df51251c0c2108f5d504dc64d34581ae2c092", "object_relation": "sha3-384", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421881, "uuid": "4048d59e-314c-4a0a-ac43-329b980cd5e1", "value": "T1813633D81CF566E16A218F0267845C4198917F0E7AB63FC5B25281C0EE063B2F7F699F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421881, "uuid": "c4c749c8-cd8f-427b-963f-e39270db5b50", "value": "98304:VxtzeTNlopy6DnS1mmREibOWRYlbNZtin61x42kBuEvpKe2GKLcq40ZKfzBp8fS1:VxteTkpyQnS1mmOiiiz2kj2Gw1RZuzBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421881, "uuid": "119b49b1-bcce-464c-8fd5-fd34e5bbf3df", "value": 5348366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421881, "uuid": "9e5384d2-25cb-4aa5-8185-53ba82612d8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421881, "uuid": "7ff83925-4ba6-49a2-9829-bce226a243df", "value": "clepoy-cotool.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5599368a-df2c-11f0-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1766404195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404195, "uuid": "26c6d634-1ec8-4e19-ba7f-8670800e8563", "comment": "Malware payload (UmbralStealer)", "value": "6b22c514740aaa31421739fc2bab78d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404195, "uuid": "16b4b78b-b690-44fb-8fc2-a7813a84018e", "comment": "Malware payload (UmbralStealer)", "value": "8a4d6797aedf92a17d8303d7364e1ffa476ddcae06c1e5b62008e2573b5abc10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404195, "uuid": "c22a7312-2f22-4df1-843f-aa77bc1b34ad", "comment": "Malware payload (UmbralStealer)", "value": "8fa45d98f296a0b412ed759a1db8f979330d0883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404195, "uuid": "266368ef-5401-4ae5-a5b0-b9cfbf10b53d", "comment": "Malware payload (UmbralStealer)", "value": "f1ce15d90f3c45ea8f39587a3b7d07641a83a9d707ffbd1319ca516a53ddfdf134f99a5cb544ba71682e41fec79a1dcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404195, "uuid": "80076d1d-35b0-41b7-b527-93f894ff7d2b", "value": "T1F5346B5833B8CB17E25F8BBED5B1158F87B1F143E90AF7CE0C8895E82411B42E949A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404195, "uuid": "0147b7c4-04a7-4118-a44c-21aae3ce5b95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404195, "uuid": "5ae2e634-6bfa-44e3-a6bc-f7062d3ab06e", "value": "6144:dloZM+rIkd8g+EtXHkv/iD4QF9X/1+mpCsl3ySX0aUb8e1mHi:/oZtL+EP8QF9X/1+mpCsl3ySXm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766404195, "uuid": "cdb17938-4d4a-439a-8c7a-96e3abdf20d9", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766404195, "uuid": "dffc353e-272e-4b09-a363-6f47e24e8740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404195, "uuid": "860d573e-64a6-4ea2-b5bc-51f2889a1df1", "value": "Nitro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfec5237-dedf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766371356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371356, "uuid": "21d75884-12a6-4eff-baf9-71ef2557f342", "comment": "Malware payload (AsyncRAT)", "value": "fa3f2c56bd7f39be85932764b40ecbc1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371356, "uuid": "33e95bea-40e0-4f8c-bdbd-5c639a6a943a", "comment": "Malware payload (AsyncRAT)", "value": "8b8cd275f6dcd877a779e0df954f8fa3b04d7cae9894526db273d9e30458a12a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371356, "uuid": "8bdcb70d-f795-4f7a-90d0-8d7de6c1d29d", "comment": "Malware payload (AsyncRAT)", "value": "b06fec721a152adf1ca8363f8add9022fa8c3b80", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371356, "uuid": "4078e995-db2f-499c-ae35-7b3ac5af943a", "comment": "Malware payload (AsyncRAT)", "value": "6a1fd6ed38e253ae9f4383b8d14a400505f1a5c2e726c34f732714d0a6b612ae6c692df32d26c1e36c5464661052a75b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371356, "uuid": "a13bc227-fbcb-48c3-831b-a7b794cce93d", "value": "T122C633439982616FC99837BBDD7D0415C2B0B60493AE32F21C9EFE9B935C7D011F626A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371356, "uuid": "fedfa2f4-03e8-4860-8f6d-53d7c9a2c0b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371356, "uuid": "8a6f5f94-3bc3-4252-9c14-411bdebf8b12", "value": "196608:vxi8/Djfe4KcBWZVGeTGCT9DIb0klczJHL5Z+KU2kXPgbmH3WT3aGu6cQF2uM2b:E8PeWBW7GOklQHLC2Tb8bfQF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766371356, "uuid": "1c7065f5-6c53-424d-83d9-004d970a9d8e", "value": 12203520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766371356, "uuid": "e7a8f95c-feb8-4c47-8d47-24b29180c0b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371356, "uuid": "71521a6e-6841-4be5-bef1-076a4b634298", "value": "DeltaLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc233389-df54-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421547, "uuid": "42800aa7-6fcc-481d-9ab5-b93949c24a36", "comment": "Malware payload", "value": "98e0842c2c726e85093bdf9211edff58", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421547, "uuid": "680d672b-8abd-4460-8bef-ea200c3b93a6", "comment": "Malware payload", "value": "8bbc251d2ac9f059e23e593e77a2394bf81da09b468ff00946a1b82f0ccb9370", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421547, "uuid": "e5d18f79-15bc-4a7e-99af-a032657f4341", "comment": "Malware payload", "value": "6c22d02ac4ce345c3e323231ed8a1eca0087f555", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421547, "uuid": "69d192ce-f2b4-4d17-9ea0-615a95d57a6d", "comment": "Malware payload", "value": "d6f81d6d599732c38de424488f58a76e239b79afdf31485b89e0b80f57d60cdf82de802af48c2bd5fcdbbf4408906690", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421547, "uuid": "c296d184-0586-4a84-993d-6ea929a0087c", "value": "T13C863331D1945036DBF105F3E94592207E7CA229BB10CA6AE3E4DC2E2DBD895A7F3643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421547, "uuid": "223882f4-9f86-44b2-8a93-3e55648bc073", "value": "67715e556e3a78ea78c756db800102a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421547, "uuid": "52cf3e2e-8902-4f4b-ad59-349b95f282a7", "value": "196608:asoI9NbClf8BU5SuZhOWWmX0rGyC7htsol9K1cIXj6x2jG2jS:azAxC58C5vOPmErYRyDPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421547, "uuid": "7221574e-fd77-4302-ad98-462a724a9710", "value": 8216439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421547, "uuid": "5b40041e-fff5-445a-a39a-586a062f1a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421547, "uuid": "3853f249-8b21-410b-98d4-2bf0b79dac2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad91452-df86-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766443127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766443127, "uuid": "ca6824db-db89-411d-9c8f-4c95c56f70ca", "comment": "Malware payload (Mirai)", "value": "689192e030cf19dc30f0ba754f375a02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766443127, "uuid": "85ab0b01-c2c2-42f7-8d95-6aa700c17711", "comment": "Malware payload (Mirai)", "value": "8c0b4b7c3011179f29c3cbbe0e11f1e550a5fb9805b78af809c0b77c6052869e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766443127, "uuid": "6bcefed5-def4-4114-8f6c-2db075bca590", "comment": "Malware payload (Mirai)", "value": "a89ac094c53e94f8b94e515f85d50d8ccb74bc67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766443127, "uuid": "f8992ed6-60ae-41a0-88e0-d223e830a6a6", "comment": "Malware payload (Mirai)", "value": "a1ff7eebfafe2bee5256ad35166f6375fb3305b722cc8732099576da0372840bc504b4be572dc96bb85717ef44af4014", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766443127, "uuid": "fe51f6b3-85df-486a-9766-6b94a24998df", "value": "T182739F36C8696DA0EC584671A8B1DB751703A500A6462FF76E89C9F18003DACF68D7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766443127, "uuid": "202020f5-ec63-4b49-b10b-598864f026fa", "value": "1536:xPSJ4aeA5fSooN0JqPW4XsMUpn5nSclCG8m3pGiT2bVR:xha95dT7mqp5nScl+6ciT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766443127, "uuid": "24fde4f8-0886-436c-83cd-94cd176e0fa4", "value": 74940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766443127, "uuid": "0036ea2f-6818-4a10-b00e-ae789b28bd97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766443127, "uuid": "b1ac337e-8b06-4006-ba30-f77b1b48092a", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3689fbf1-df79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766437214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437214, "uuid": "8d492a5e-0c75-4ef3-a7f6-b337f9d9ceb0", "comment": "Malware payload (Mirai)", "value": "04d729f9896cc7caa55dc6181636ee6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437214, "uuid": "023022eb-a801-49bc-a182-7e077161f410", "comment": "Malware payload (Mirai)", "value": "8dab13ee12f66dbbc6a2dca5b63d6b15a32591cb01467cafe11e362bc575ac96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437214, "uuid": "d45f5e02-71b4-434c-81f2-93ed21eb855d", "comment": "Malware payload (Mirai)", "value": "cc9c0129c573b6d22325a04d9b4e6f44614590d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437214, "uuid": "0ba2e962-d2e6-4645-87f0-28fb99e39e08", "comment": "Malware payload (Mirai)", "value": "5e70b42c05764cb790bba9f22e7a804291b018048c53371911771cdb9cdeff3100d4c6b49247b629144b350a9474da53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437214, "uuid": "b77e8a19-2bd8-4c9d-9f6f-f2bba4c108c4", "value": "T1AAD31885B881AF10C6D625BBFE4F118A331397ACE3EE7203DD145B6423CB95B0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437214, "uuid": "292c7c59-1e5e-4495-9925-f3c3e93b727e", "value": "3072:m6DHtZlQROKUTGAsumhT4rV/VIyIwTauaqD5eLh2mKwrGdMjmfpnzE0:7DHtZlQROKwPsxN4BVIyTTauaqD5eLEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766437214, "uuid": "08b5e211-024e-4a25-a783-cde71424af38", "value": 132832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766437214, "uuid": "e657897a-a803-48b8-8771-06afc045b478", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437214, "uuid": "3f25a546-2491-4f3d-865d-bb8f29591f7f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb1db09-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384693, "uuid": "760a2fac-3f2f-46be-95de-923ebd5ba929", "comment": "Malware payload (Mirai)", "value": "25732cd8a8aa468497e1c1f8a5485538", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384693, "uuid": "7a0c1935-2331-4be7-8488-efdab5f530d5", "comment": "Malware payload (Mirai)", "value": "8e7797880d3a7b1f239518aaa6622ac17e979fac9e070abd78dd2ede038fb5cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384693, "uuid": "03a4aa79-c918-460b-99ac-12a0fba34408", "comment": "Malware payload (Mirai)", "value": "698ea3a666f0b9f3ef92dac22a68a9f9a57fa816", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384693, "uuid": "b92a6165-de91-4f16-8206-81681d58973a", "comment": "Malware payload (Mirai)", "value": "34ee3315dbaa3bddae2a921f2ad95dbeaad73e6e87cfb16bdd2d1aca0b59f6a1db5b0909b3a5a9082a4a71f8e6fbf163", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384693, "uuid": "6eb78d57-b6d7-4269-aef7-8813f5d54183", "value": "T1A2331885B8C19A17C6D013B7FA2E41CC332667B8E2DF32079D256F14778A82F0E67695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384693, "uuid": "7b85c411-8ebb-47fc-971d-444ccae046ed", "value": "768:aNeCKSZ59OKgYMArusd7DdlOTI14c2Wy/+ob6kTcSP+t5V/NPABMkkbzP:7CLZKzsd3P14cU/wkTca+t5VOB6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384693, "uuid": "3c4b9ba4-dcb1-424b-9e2e-463086fb2b43", "value": 52884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384693, "uuid": "2ed2be66-6f9a-4b13-9192-86068beeee85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384693, "uuid": "13448d08-b3c5-4138-947c-bc8e1c3ced22", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8fd7ec-df7f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766440075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440075, "uuid": "ef908c11-55f5-4d42-ac79-cb72852e438d", "comment": "Malware payload", "value": "d20c5538c277950b93e7d61aa4280caa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440075, "uuid": "fafa4d63-420f-4caf-8c8b-c703df41b554", "comment": "Malware payload", "value": "8f4cd390af0fac9037f87d949df86802e509273188f5cf196021be36ad231eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440075, "uuid": "c93b3178-4490-4b07-a063-baaed668336b", "comment": "Malware payload", "value": "7bebfb9eb5bf4ac723098533b7c4178099184597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440075, "uuid": "59f6450d-0308-48fb-a47d-630802a85edc", "comment": "Malware payload", "value": "c3a9c26f626f91a62a6560cd5079afe49bae2734e33cff7b02cff93ae9a784ff8df4d06ee68ae2012fce14ba37dfc05e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440075, "uuid": "d16d8c76-abc7-4d0a-a836-a779045b6403", "value": "T169E633527C88DBBFD4212770C6419B77529BBA74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440075, "uuid": "bcf32a4c-68b8-4a94-bea8-e94c2af4cd1a", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440075, "uuid": "44b73a13-2991-4784-aaf3-ceeb5a006d16", "value": "393216:SxF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1l:6rRxvoC/7a0jUxX7h1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766440075, "uuid": "da9428a1-afb9-4cf0-80b4-007e58cfdac3", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766440075, "uuid": "47e794d9-374e-41f9-838c-f63b30fde743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440075, "uuid": "96351f01-c5e4-4ef8-8e7d-7237395bc524", "value": "PedidoOrcamentopdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2762a460-df42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766413567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413567, "uuid": "3c71720a-c8ec-469e-8432-4d4087fcb84a", "comment": "Malware payload (Mirai)", "value": "5901c5335b2a147b6798a89b16d3dd31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413567, "uuid": "1be1dd29-e4cd-4c41-b9e3-6855afdba760", "comment": "Malware payload (Mirai)", "value": "8f70070ab373bee7c5ea698f980fd12a4a3f5d1579520fe61022aebb6b2fd792", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413567, "uuid": "43aa171b-0780-45a7-b626-7edfa560d9b4", "comment": "Malware payload (Mirai)", "value": "4c1cf673ff5c9052cc3542b8274876cefdfa3b24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413567, "uuid": "736dde5d-5c06-48ea-89b0-56bea7ea0423", "comment": "Malware payload (Mirai)", "value": "d7191c546c9dc74971ac76fdca43fa0f54701bf2d9e3c9f9d300fb2c21d0a5da537c2eba9cee14c9b4ba75891fd35e6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413567, "uuid": "1fb815e6-f2a5-4b90-a81c-f8f37dbd1898", "value": "T1AC731981B8815623C6D422BBFB6F418D372653A8E2EF3207CD266F21378785B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413567, "uuid": "cf4c6967-1415-4755-8b66-09993eedf697", "value": "1536:jvJLsjSyMZSwsE/6It7tjoZpLnNeN8/OKg8qnB3cS36vLo:jvJLAOSqunNUsw4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766413567, "uuid": "11373cd8-46b7-4e46-8901-2510985377f2", "value": 79336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766413567, "uuid": "e21ce0c3-bb12-4242-a934-363671acf940", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413567, "uuid": "ba59108c-1a89-4ee2-abc6-bbb55f98cc6f", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e4b597-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424860, "uuid": "9e46bbc6-2df6-40e3-90dc-d9f66c2406b3", "comment": "Malware payload (Mirai)", "value": "6927439b39d6d88796a74aa14e360f85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424860, "uuid": "d8b7fe21-9b63-404d-b8d5-1fb039b0030b", "comment": "Malware payload (Mirai)", "value": "8fbf85a6d0df83c34cae15c77fea7ae4afb7c14da9530f8e30c4fdb39db0d581", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424860, "uuid": "c0fbb102-bd74-4373-81c4-e32cef955037", "comment": "Malware payload (Mirai)", "value": "7dfd5ca0026ad985381781490c176e46e920681b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424860, "uuid": "b2c79d30-df3f-4a67-b67d-fb1ddda5b4a3", "comment": "Malware payload (Mirai)", "value": "2fa02c44b93311dc2120a316a2f3e77c18466a56cd280b0e313737832e35232faccfa5774d494b9e50fb71f4d6e50faa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424860, "uuid": "d689d89f-fec1-47e9-a861-ea17e4f3828c", "value": "T1A6D32A06B30C0D47D2632EF43B3B27E1D3EF9A8121E4F640655FAA899271E325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424860, "uuid": "b6c92726-06f2-4441-8306-39ec7b10f00e", "value": "1536:D+pbqUem5ZHtxBVvZzppC5ucR2I66fDLojo8vA8vhEVYxLXsZqyqFswL:DQZHtxDRFswcV6uD9h8MwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424860, "uuid": "1f8afd42-b00c-4760-9330-70bdb3321b65", "value": 133636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424860, "uuid": "41c4812e-0bc7-493a-b504-e5892d619bff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424860, "uuid": "27d5192d-73b6-4dde-862a-cab5858ac3a6", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b28973-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370179, "uuid": "3c59cc80-17ab-444b-80e0-bdbe16c8ea0a", "comment": "Malware payload (Mirai)", "value": "781cebdddee47d72b90c0fd84f891ef3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370179, "uuid": "d12d34fb-7ff5-48c4-9690-79cc2a801cd7", "comment": "Malware payload (Mirai)", "value": "8ff5ce7021d411dcbda0b12e82b68ce23d48dc07e999c62c23aa1f6a54a1e2e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370179, "uuid": "920a9dfb-d547-41b1-be8c-29ed99645021", "comment": "Malware payload (Mirai)", "value": "3760a3f483527ed1d7b0282b021449ffa1b9315a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370179, "uuid": "1fcf9ca1-19c2-4fb3-bcab-293c2ff54e6a", "comment": "Malware payload (Mirai)", "value": "7d77998100214834bac9c27051d5cdc07b332822c76950d9012436c5f765c171dfed5c1f6aeaca73688bb022eb37f038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370179, "uuid": "d05e0de0-de18-4558-bfb7-34b768771200", "value": "T137330907F681C0FDC49AC174476BBA3AD93771ED0238F2A67BE4EA223D96E611D19C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370179, "uuid": "1f51b04b-86fb-4166-9507-bbefe987bb22", "value": "1536:Ru31CxXVpHlCrxsNnVfvj56+H32r4DaEXzd0OCUjCYn:Y1sXV5lCKNVfvj51X0GaEDOVUjCYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370179, "uuid": "ee1148ea-2db5-40ef-bf7e-0e8d32d83391", "value": 55104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370179, "uuid": "f511b7cb-f0f3-412e-af24-95bc876ce04d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370179, "uuid": "ccd7c824-6999-4884-b10f-61475bd24ce2", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee532d64-dedf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766371380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371380, "uuid": "aacd1112-e6e3-4173-b6ab-be7f7a1ca6e1", "comment": "Malware payload (AsyncRAT)", "value": "33a5e6b2e2a7a3129adc6b809e268629", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371380, "uuid": "ed3c507e-73e3-4ad2-8398-be24ec1db872", "comment": "Malware payload (AsyncRAT)", "value": "901d326caa17760192305b876a9e34eeb6685f89caec413c9ade472b7b1c6a8f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371380, "uuid": "83c2ce12-42d1-47cc-8d93-d0b09b15e715", "comment": "Malware payload (AsyncRAT)", "value": "7eef6578f880334364fe5c96110175c3ff5e6c26", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371380, "uuid": "eaf1259d-7569-4148-8cac-a06e75c18204", "comment": "Malware payload (AsyncRAT)", "value": "dbca7d57e5cc113ff7d914394641c27650ecb9687b2cbfedee5ee7afbe5ec5a8cef3501d7e8d01b78dabb0f9b30556df", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371380, "uuid": "8f8b9bba-2c94-4d4e-a962-166d0f073428", "value": "T1F1232A143BED522AE2FE9F7959F11645C67AFA132502D74E1CC002CE4A23BC6DA127F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371380, "uuid": "7cedbc39-6ba5-42e1-8c7a-a37d15020278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371380, "uuid": "ecd4b9d8-bb6e-4e70-a942-22306756bbe9", "value": "768:aseY+fVg1ucvegh2f+Wenm51a5vXglAAeb1igUptwVrAK8Rcc1rWBN1K:eiucv2fana1N+xb7U3grvYcK21K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766371380, "uuid": "80dcdc45-0cc0-4f71-b722-dc06c370df8d", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766371380, "uuid": "a5fb107f-ab94-400e-87ee-4d6386e448da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371380, "uuid": "8fb9dbec-f5bb-4ad2-812e-6e00b4c6f96d", "value": "lot317vkc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce094c6f-df8b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766445199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445199, "uuid": "702c45d8-eb24-4971-bb93-2f295223f147", "comment": "Malware payload (Mirai)", "value": "2d087a3e596b4723fb3bca63054c4cbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445199, "uuid": "c3314140-c106-4c2a-8f12-7785b4a447e5", "comment": "Malware payload (Mirai)", "value": "910f6bfb0867cfb055461a0ed63bdf5aab0459574bb3ec65bdca70fd666dce1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445199, "uuid": "158d8627-d442-4b7a-99d8-cfb0248cd2f1", "comment": "Malware payload (Mirai)", "value": "8906b3921fe5ebea92f41777ce2c0b46707c3b68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766445199, "uuid": "1ca76190-688b-4129-9f46-5e000b7ff2e8", "comment": "Malware payload (Mirai)", "value": "6c46a78c0768fcf77f0f69e100812ceb7b7811f0b78c0a69ce730d6338265e9885c616de561233d602f869fd6865a4f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445199, "uuid": "f8ad0cf6-a00d-420d-b35d-f619fa07a611", "value": "T16BF33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445199, "uuid": "f3f0f7b8-8c0b-4cae-823c-7355c237a633", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHGfam:9FJMgWPZr8IaCWReS1WpPef7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766445199, "uuid": "391d00dd-1b83-4d2c-9f4d-3d29ccbe13da", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766445199, "uuid": "f389794f-14c9-4a19-9217-47142e8571ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766445199, "uuid": "2f04caec-8dc0-45c6-9b4a-22e638dbd5ac", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca68dde-df3a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766410435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410435, "uuid": "df8badec-bd53-4778-9a22-cb9aac3062a3", "comment": "Malware payload", "value": "f2ace5b65c49114295a5c7a60dfda759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410435, "uuid": "fd2de59b-9a5a-4afd-bd77-5356fabe20da", "comment": "Malware payload", "value": "9455f2cce6a03ee26bb74e7435426366c906efddc1e96f460aad936b57431d33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410435, "uuid": "2d70984f-060d-4331-a302-1a6d5f480544", "comment": "Malware payload", "value": "bd0fbbb17502048ffea42ec4feae5a50253cf037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410435, "uuid": "46581b4e-aa2e-4a37-b5b3-9b8b8c9f781a", "comment": "Malware payload", "value": "4b449406d71d1c50021eff21358671e34d566e7d3ea7cbbb400ac46ab3d0c1d7be68521e160d0b42ae3e258ec6f8b3a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410435, "uuid": "00cbf701-74d0-4bab-a943-bda7f9a4fc34", "value": "T17B1623C1668224FED057C3F082D668ADB1783BFA4F714CA26B8939174DB3D242D79789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410435, "uuid": "6c1d4b99-2af4-4d03-89a1-da58dfde6335", "value": "25fda2001e585d511e3be36a7b6d03b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410435, "uuid": "bd712a90-d55e-47de-9b95-47d94af0b496", "value": "98304:I+KGARODeC+QID+Ejg/bOVnsj5VYNUPvltp5SP5jJTV27:Eq4QIaSu54Qvlk5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410435, "uuid": "ae7c86cf-486d-4136-980f-4998b22c3473", "value": 4358656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410435, "uuid": "2d30edef-42a6-4262-9010-16a18f02acaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410435, "uuid": "af736983-2b8a-4ad6-bff6-cf37a1834170", "value": "SteamSetup_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadfec48-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384689, "uuid": "6f47a564-c6e4-4b84-8689-d422598f3b5c", "comment": "Malware payload (Mirai)", "value": "4812b0e80af8c827b8f924570a751ead", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384689, "uuid": "04177ced-3170-4035-89e2-9a63db4e60af", "comment": "Malware payload (Mirai)", "value": "955be113165799381154cacdd21f65ab51fd6e4da783350913f3443112413001", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384689, "uuid": "dcae670b-9b8b-44c9-a677-c0913d10d4c7", "comment": "Malware payload (Mirai)", "value": "7da177fcf77adcb50904b173ac9486a48d4e0985", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384689, "uuid": "735e3361-8460-4827-8a6b-0cd188c2c10b", "comment": "Malware payload (Mirai)", "value": "0b0505df3e9f9780a9cb36ed01b28d575b76a451a8ba8b2cf6b5760079256642b577a91b7b8495768d56f03067638575", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384689, "uuid": "1f4f9bcd-f702-4d7e-9aaf-efccc0975d47", "value": "T198C33B46EA818B13C4D517B6BAEF424533339764D3DB330699286FB43F86BAE4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384689, "uuid": "1ccc8e42-e376-40df-94c5-50fac36360c6", "value": "3072:k2C80J2CX0KxaavBvvYH1ORolcwzHQHM/9KWU7:k2CSCEkaavBvQVOOhzH0M/9KWU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384689, "uuid": "605cc894-c768-4985-8066-d24267198101", "value": 126735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384689, "uuid": "6cbef2ae-00df-4bdd-a536-27174e15b035", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384689, "uuid": "0c58a182-6385-4134-aafb-83a00809390d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7329584d-df42-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766413694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413694, "uuid": "904acb6e-4e1a-4c4a-bb10-02ba0310551d", "comment": "Malware payload (SalatStealer)", "value": "4e48a6ce8642bcc55ed1ba7ca2c0c453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413694, "uuid": "cff5a6ef-d18b-4ddf-8f3b-92be017e4c15", "comment": "Malware payload (SalatStealer)", "value": "960c2a4ae7faf7beea2e8fe80d514f24f116b73075b6b568ff653db074a62df9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413694, "uuid": "391d4b47-5e31-49ea-8a40-8fbe71a5ad39", "comment": "Malware payload (SalatStealer)", "value": "9db326f32b9cfaf40ebab787531a7299d6a27ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413694, "uuid": "0c119967-c392-431c-8f93-de4271867a53", "comment": "Malware payload (SalatStealer)", "value": "54791e1025076d908857e6da73f8c4949a9e0292eff64c99e5f26952acce270ccf437a1631018bd0f877d91a952b9afe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413694, "uuid": "15dc05f2-06a2-4617-8cf2-02482a61bc39", "value": "T179E5334DC6A848DECA8B8D3AE6729B1CE7345B5A12F0F7756C2284E1D78C34857C907E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413694, "uuid": "45d659c7-ce7c-4124-a7cc-4e43b6263d0c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413694, "uuid": "1d15a1e9-7a8b-4331-9956-f43dde8d3476", "value": "49152:D6qKFHK4MarcClBzIT5SpMA0+o5nfcjI0PyotkXsVeSdQvTwUWZQ/C1s9PG8Wb:D6vc4BzIT5fvF10EGsO+wrZL1s9PG8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766413694, "uuid": "30b6bbcf-9bbe-47ff-b88e-94cdb04c3e60", "value": 3289088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766413694, "uuid": "6015c8fa-7d5a-44a1-9a87-5cce72feb402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413694, "uuid": "5944b71f-bd68-4d91-a8fc-29e9f2bb1dcb", "value": "DMAcheatforfaceit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7c260b-df1c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766397607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397607, "uuid": "4e3724a3-031c-4e3e-885b-9fba645264a9", "comment": "Malware payload", "value": "9d6673d927b651f40ac80d11182df5d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397607, "uuid": "45559f31-b38d-43eb-a68e-46faec92230a", "comment": "Malware payload", "value": "962615e17eca365d80c31dd02f2a6c757c073cb24d31d60a1c7818284bd6ca00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397607, "uuid": "bd735a09-763e-4a9a-a003-36b6292d066f", "comment": "Malware payload", "value": "910772ede4e7ac975e2bc01fdbf94e81939e8347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397607, "uuid": "127418b3-9b12-4c38-97b3-de27a722ad13", "comment": "Malware payload", "value": "19eda9af23bdcdc9e3565473b76a483268c99f3fa90414e28e368edbadf1ec3ffc2905f396aa650e62547b60ed520774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397607, "uuid": "b37e5fed-72e1-4da5-975b-3ed8a5476cf2", "value": "T104337D866E2C5A33DE8D5DBC68E253134BF0A3377952E7876CAC85949D833E416042EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397607, "uuid": "a20cc410-24cb-4c62-825e-d3eb4bd9796f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397607, "uuid": "fac9f1b3-dbd0-4016-837b-ce6210c92fee", "value": "768:ylKCr94/aKXpxsQL6ma0IzjzjaYRbarVgs1yiAmbLWVwfZMAmbLP+:ylVLKZW0Izjzja8barVgniV+VyZMVX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397607, "uuid": "b57f9ec7-b94b-4896-9394-2a069fe3dfab", "value": 54808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397607, "uuid": "070189e1-a3c1-413b-826a-fb36d0e8193c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397607, "uuid": "f50d2691-dadd-4405-b03f-01d5ad5b2cd4", "value": "Screenshot20251221686898m.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ccc80a-df44-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1766414550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766414550, "uuid": "88de857e-b8dd-4215-91e3-f05b924c5041", "comment": "Malware payload (OffLoader)", "value": "2e6115c505b2f9e8bd34e97d0587a271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766414550, "uuid": "f38f0363-2515-4b01-bd96-43c3e332cd65", "comment": "Malware payload (OffLoader)", "value": "96d36b91d5dc1a6257bbdad1b2b762e59a88d8d73cbaa317e2568dd7fb153b5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766414550, "uuid": "78827d91-0354-4e91-8443-14453503f25b", "comment": "Malware payload (OffLoader)", "value": "402dd3f6cb26325f8a8ca190ff3a97b388a105b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766414550, "uuid": "3f53e3df-ba95-4bfc-83c4-78bb2ec425a0", "comment": "Malware payload (OffLoader)", "value": "ef6b1f98620722a529754dc6c074df0ba9f90a8beb3ad21f6d2236645a4a691748f3c068c6df5065295764f622d16ddd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766414550, "uuid": "cdc54763-32ff-4e09-a791-0688fb42be0a", "value": "T15395CF33F28A673EE06E5A3759B2D2105D3B7A21A41E8C4296EC3C4CCF7A1601D7E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766414550, "uuid": "6482d2dd-5ad3-4c67-872c-9920fe4a38a7", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766414550, "uuid": "891340c5-6111-408e-9e28-788683d16741", "value": "49152:nN61T1m0NXCip+JRj42qipgbhFv0atAJQzdiSs:nN6609p+Jpfq1kIyQzdBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766414550, "uuid": "5ca81e37-71d1-4858-a27a-8497eedc82c0", "value": 1956184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766414550, "uuid": "22ffa829-a99c-4b92-803a-7c427ee6c7d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766414550, "uuid": "f140cc37-a998-4424-a11b-b9dfbab9d27c", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63ce029-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388869, "uuid": "d430370b-29f3-47e6-adc4-89ecdabe3e26", "comment": "Malware payload (Mirai)", "value": "4a6c84d8fef7818a8c68e6064c859039", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388869, "uuid": "daa21d9f-1fed-42ef-b280-d070f32e1fbb", "comment": "Malware payload (Mirai)", "value": "96fc72c9cee8e1cea10f07441f5fb168a1fa467ed811bf7538aa7af5950394f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388869, "uuid": "8b587f32-e3cc-4b45-8870-6f6351f2e4c0", "comment": "Malware payload (Mirai)", "value": "4fd6c9dc65af44965461cf5ccfad4170990aa8ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388869, "uuid": "b018bab8-4bdd-412a-8dc2-2f2e0b181af6", "comment": "Malware payload (Mirai)", "value": "295fcccf45d44faa23e8e1a81022fbab79bbd06ca4e2eb0c6d654e5e6ebb2c11a262174e1713a88117556ccb83438cc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388869, "uuid": "aaffdd68-0bed-403b-bf24-a0eeee169f42", "value": "T194C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388869, "uuid": "6c6a1cbd-66b3-48bc-a943-258cb282f5cf", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoGrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIGrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388869, "uuid": "217a0e6d-67f1-4b23-8b0b-8ad27f6b658b", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388869, "uuid": "9da3a7b2-bfd6-42ae-9578-7b0ec6f49d36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388869, "uuid": "9cec6633-9cc4-4cb1-8de1-2b2d887dc681", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca09422-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387457, "uuid": "1a58f290-65b5-4911-ad3b-ba29dfb61ab7", "comment": "Malware payload (Mirai)", "value": "8b2b8f52a47d57dd0d5be873a9119fed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387457, "uuid": "aefc63be-cd77-49cb-a67b-067c71fd6a08", "comment": "Malware payload (Mirai)", "value": "9726543059a9ce755f9ad2edd8a28acefbf31a09d8420468aa5fa445c8f595c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387457, "uuid": "4dade274-006e-4c7c-9eee-ebc94416d2a8", "comment": "Malware payload (Mirai)", "value": "64c45b177dde511b46416c1b21170a49e64e379e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387457, "uuid": "49590a8c-82d4-40ab-8013-283b2f975e1f", "comment": "Malware payload (Mirai)", "value": "2f2e95293b945b70c50db60c046363c03fb0f4a6f99a7b0d1b5015c8ddfa7777eea20d40b635d298329f306bef48d423", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387457, "uuid": "54db96be-7ba7-496d-905f-39f14bb3f11a", "value": "T17104392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387457, "uuid": "604ae8bc-508b-4531-8e5b-6bc7138d3f6e", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wWUXS:7eJpJUVD1A8n0YNgEJi5aji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387457, "uuid": "a5cd505f-25f4-43e4-873b-7914109284cd", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387457, "uuid": "07be19c2-314d-4bbf-b32e-ceaadc94e4b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387457, "uuid": "0f5fb1ff-1365-4a86-87b6-a1b92fd0f9db", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384a579b-decc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766362914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362914, "uuid": "1914cd09-30ca-43d0-9ec6-767fbe87f6d3", "comment": "Malware payload (Mirai)", "value": "45f86477e5458841797e12c07150555e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362914, "uuid": "acbd27ad-dacb-4d92-b871-b71156bf8ffb", "comment": "Malware payload (Mirai)", "value": "98b63dc0f96f9fb490b1f4a58851efab0ad4a070c1150c967e182bab21e9b391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362914, "uuid": "d04678ba-3242-459a-9a70-4e5ef0a0a023", "comment": "Malware payload (Mirai)", "value": "76bcd6e02ce35020311bce890a9e26ee8df7601e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362914, "uuid": "12a901bd-578f-4a01-bd3e-44acb7dd41e8", "comment": "Malware payload (Mirai)", "value": "bf7a51570e3c8ec0dd01d908fdf9e0b6064a62762d6f7e6db9ca61ca5492fa756049fbfb10166c54d576049f4cd1993c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362914, "uuid": "399536c7-aa9a-445c-9e00-caa3566f5000", "value": "T133935B21BD7A2E1BC0C4747B51F30B35F2F6274A21ACCA1A7D720E8DBF156102557ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362914, "uuid": "8e2b280d-2a55-4754-b07e-57f0e0310f67", "value": "1536:I+X9xScBoZQfKekrtSZea2VWc7Hjgn/URC9UH1bNltP08zm7uhq:ZtI4ieNzE+/URkUhm8zm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766362914, "uuid": "45d70fed-d7e3-4963-a535-3fdd482f3578", "value": 91340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766362914, "uuid": "0e1e942e-6c47-405e-b9ab-edc329d65c18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362914, "uuid": "46f7d38a-0287-4aa9-9906-581c9bb595d4", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6861cc82-defa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766382752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382752, "uuid": "b1854ef7-bc6b-47c7-8803-d4adf7f06bee", "comment": "Malware payload (Mirai)", "value": "e538eb07a024e11e61fab1d298eabcc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382752, "uuid": "e1152ee3-2698-4ecf-825a-6aeef886f531", "comment": "Malware payload (Mirai)", "value": "98e2d7934b42ebce6ecbdbf56fb8bb1c0335bab4dc8b644404b8d8b41a496543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382752, "uuid": "7a48ab6d-5edf-4e30-bc99-160a872d9c07", "comment": "Malware payload (Mirai)", "value": "39a0dd89400c4dbc6735ab7b7c643aeac780372a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382752, "uuid": "cdb54b01-6048-48d4-baa6-28360fc045eb", "comment": "Malware payload (Mirai)", "value": "79c6ffde79de0b4283c5a23276deeed4111ab2de9c3b57dc73fe45fbd587d06145d0aa165972ea7bc8a8bab3b4e7e09a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382752, "uuid": "1c34f256-9524-44a8-b8c8-be32c20e381f", "value": "T1D4C2E16877917CA0E9F168B6DD5C5982231D0B7D41DE31BB1244C8F4AE83407B63DF56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382752, "uuid": "1fa25009-fb86-4617-9db4-01451bde1735", "value": "768:aGrLUhtimO+XnrrxHesrph2hOGZ2EPs2fmZs3Uoz3U:lOvnwsrpQOW2gmkz3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382752, "uuid": "b7a6b507-48c0-429f-ac25-ebe8e647d64d", "value": 27260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382752, "uuid": "95558571-3d76-4d1b-9036-6fc421686489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382752, "uuid": "b94ef276-07d0-4e02-b337-21959baeb704", "value": "frost.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e113125-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387459, "uuid": "1aad1d25-bf50-443e-93ef-b1734ccde283", "comment": "Malware payload (Mirai)", "value": "a28929c42a9ec1d2f39b1e9ab0377a6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387459, "uuid": "f71adf06-6a7a-4d57-9636-c7e9816d0d7d", "comment": "Malware payload (Mirai)", "value": "991124c385ac015fb0d1d962473dedd65bb6040934a74e36b250256df513a451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387459, "uuid": "d53f6723-034a-4b91-aa05-948b8388a4c9", "comment": "Malware payload (Mirai)", "value": "726dcca42d092a0e04610c03bcf516a7c3696065", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387459, "uuid": "36bf51ab-ab65-443b-a1ff-e57702339763", "comment": "Malware payload (Mirai)", "value": "b9258e5cc46a78ae43161382f81d631ef44f1bad719ac62aaa111546e935e34e447d5c86caf07f53aab6614d104deb32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387459, "uuid": "e9aa518f-e888-434a-8b88-a91de5e261cb", "value": "T1676312B42E27EE74FFAB1C3F74D910A05F9DEA5E010A5BC73C7300A6316AD49094A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387459, "uuid": "b55e7c13-bdaa-422a-ae11-2ef29910411d", "value": "1536:GLQ3WbFyTcdFl4CIFuxTkevRiwaGS5CJK73Lt+KvurPx:PGpyTcd8CJTk2RE1gsRvurPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387459, "uuid": "7e6bb207-d957-4be1-b397-4cb46a27c8e5", "value": 68684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387459, "uuid": "6c276bf4-648f-472d-9959-84f97c2c34a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387459, "uuid": "37188762-3de7-430a-95a2-ccfddcc7018b", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5390f40b-df6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766432968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432968, "uuid": "08beae96-9df1-4a69-b488-a7c2bca4d75d", "comment": "Malware payload (Mirai)", "value": "89d50044a89d0044cdde3849a543835f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432968, "uuid": "da25818b-0e03-4214-b770-5f8658e9f1d3", "comment": "Malware payload (Mirai)", "value": "991c6e36ff3aae94347c64ccdcf66faf3f8daadcc0f5bce3c9db17fcdbfc27b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432968, "uuid": "3e691cc3-4092-4b40-a92a-0e8d85601e19", "comment": "Malware payload (Mirai)", "value": "2cccd8207d6e0094a1ed4126c39697929e24d9fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432968, "uuid": "88be15f9-74a5-4a49-af8d-ec923eb21659", "comment": "Malware payload (Mirai)", "value": "e9623a96febbb3c343f4266559cd7f8380255a76d3765ae4dad196800301c9bc52cf96db76cc765637deb67f15f8a55b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432968, "uuid": "22471094-354d-46a1-9c08-ef8bc1efade5", "value": "T141C306327A611D1BC8CC533A51F78321FA723769A1A8C71A7FA30E996E3C39471173A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432968, "uuid": "72858a86-9c01-4d57-a13a-b6ac3b9682a0", "value": "1536:g6jLoT2qckkoE/wTg3+GThqV94NtMRbxRpKLAhNE/cc0ULShKeIoKMuNLi:xuzO64fMRb9KLA/yc3YjMuJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766432968, "uuid": "d5ab1c84-88b6-4f5e-8eb0-9d6c4de32b90", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766432968, "uuid": "2df07b6f-02f4-40af-a928-e45607ed7a30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432968, "uuid": "07ed27ba-d9f6-45f3-89ce-fe6b4086d5b9", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228e4d03-df6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766432456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432456, "uuid": "efa7fed5-4552-47a8-bb9f-c4926abed50e", "comment": "Malware payload", "value": "019e760da4f551cf15ca1fcc6f14f141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432456, "uuid": "266af6fb-5360-489e-90d5-2b3cf3793c30", "comment": "Malware payload", "value": "9983529945e79e35180ec960f1bf76db225dd6e6b8a43816d43cb73d250877f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432456, "uuid": "a3d2a121-90d0-4540-8056-5ca9a4df51fd", "comment": "Malware payload", "value": "1312c9d686140861b39b1d8bb5b38963265c41ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432456, "uuid": "3e6aae3c-7060-411e-b002-6227c56fad8b", "comment": "Malware payload", "value": "6c2fd54f7a3cbbc2be773f9f45d0d536f320e60cd3b13fe3c1b25b7db95a3ab65641a065f2ed3464df6cf914a5f45fce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432456, "uuid": "6a283824-ea7b-49ed-97a1-2310b2f00598", "value": "T1E15423E546AC0D76EF43A63012543AEB8B4B6E17DBCC131A888F1865D716ED1F2C9F24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432456, "uuid": "cbac609d-339d-4f0a-9b2c-395458b9c14e", "value": "6144:b8bXOO04xXk4ILQsQ71KsjsydfKxxKTiacqT39uhAh+KNg1U:wjj04sGtwyN0Kea9L2vHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766432456, "uuid": "6480f76e-74fd-4dde-b3ff-f39b3454603c", "value": 287368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766432456, "uuid": "35dc0f3a-02b1-4d73-a16a-f4c3472d1e11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432456, "uuid": "2b9bda1e-f3f6-42c1-afd0-3f1db55bdb71", "value": "export", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c14b89b-df74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766435049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435049, "uuid": "3dafbec2-aa37-4ad3-9479-6a537ee5cbd9", "comment": "Malware payload (Mirai)", "value": "f43d5614dc36fa1cce8f2ea0a3774f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435049, "uuid": "16de8514-dace-4f1b-8a2a-98f3fb4a8546", "comment": "Malware payload (Mirai)", "value": "99841742b4e917c94736e360c4270c39e77bc43a5452fc58fa64d81394f46b3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435049, "uuid": "6db3dae8-73b0-4654-abfa-350910b5b3bb", "comment": "Malware payload (Mirai)", "value": "e353d7224ee05048c4d7ba7a43120e98d0fabc8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435049, "uuid": "e58ec76f-8b02-4a1b-8c5b-66f85c12b5ae", "comment": "Malware payload (Mirai)", "value": "2c44d5f7acbe46a8abc5f0aa67e634f53a9b94c8454d1cccdf4d8a94e24ae98a0e543fce97111887d5a78446226e887c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435049, "uuid": "e1ea068e-c3a6-4b1c-b13a-17ca1cd95c56", "value": "T117A36C02A58084FDD4C9C6B84EAFA216C933F56C2371B95E33D47F253E5DE202B6E265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435049, "uuid": "87b9f770-f4bb-4b05-9f73-2cdea0156d15", "value": "1536:JzfkVQS4QgVYmQbWSnPjd1ioMUHD1NhugYJ/rn4dbHCELF6SRu:JL/YmQpPjd1ioMED1SgUT4dbHCsFpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435049, "uuid": "a73dfbd7-8e23-4427-9a4e-29af9e4fcc80", "value": 100384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435049, "uuid": "74954981-9cea-4a45-b417-34bf079205b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435049, "uuid": "e5503a96-677e-4e09-a9fc-54376fffbf88", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16682591-ded8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766368011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368011, "uuid": "91141a7e-dc88-46cb-9b91-37626b56d714", "comment": "Malware payload (Mirai)", "value": "f08b3c1cdfd221736552d8bbc67df12f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368011, "uuid": "39dd66be-94a0-4fb7-a33a-281029beb6f9", "comment": "Malware payload (Mirai)", "value": "99c3e31628d4c1e5ffc94be945d4aaa0a4a0577565f6578dc7f4db8d10e9dfca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368011, "uuid": "8ba8b498-6db7-41f0-a9c1-56dc2714a664", "comment": "Malware payload (Mirai)", "value": "d4bd690740b070d9bbabb393dae346822590bd42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368011, "uuid": "bb3a2bdc-d556-42ab-b47b-ad439068fa5f", "comment": "Malware payload (Mirai)", "value": "50bf75f57bd32cd7155308844c6dfb755a1f16ebdd9a3e79858085b593fd6345c12c9cb4d04b5699855577f8df5cfb20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368011, "uuid": "4bfa318c-b7bf-4aef-8a05-118665162dc9", "value": "T1DB835BC1A743C4F5EC6612B9613BE3375672F6390128DB46CB64B8369825A02B72739E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368011, "uuid": "4d76d39e-4525-4dc1-b967-e12753b78587", "value": "1536:l03Xg9L4jNK4Yc2oknrDNNiVupKWnW69Aihv9KMvHLZiHFD03w5cUXejwuL:UX2L4jNK4YcqtNiVOnW63hv9dL6FQg52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766368011, "uuid": "8b37a499-074a-4971-aa70-d5e6e2c1aff3", "value": 87220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766368011, "uuid": "c2c4da6d-2ffc-40b0-8c77-a761cd1e0c16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368011, "uuid": "fca8801c-bd74-4fc1-ac59-9a967aaedcc4", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e0b519-df6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766432967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432967, "uuid": "d9563fef-c84b-42c9-97d8-79c2fb7449a7", "comment": "Malware payload (Mirai)", "value": "c4e3ee77eb78209e9f5cd9dcc62570a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432967, "uuid": "bffb6421-4c46-4740-a038-cd8143fc345a", "comment": "Malware payload (Mirai)", "value": "99d01abe3bf91d3cd971f524e96f80ebcde30886de5d3ee9c46bd32a9849de92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432967, "uuid": "28e9ddd3-fb6f-4e3e-832a-483015b3c415", "comment": "Malware payload (Mirai)", "value": "65e122de788fe2e3d843835f9305fe83e3492e63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432967, "uuid": "8a807e69-6765-4c81-809d-51cdde798a96", "comment": "Malware payload (Mirai)", "value": "8738c0e4e498d030575cff7f70de5d6938afe4b3e9f5af53a2ea4adfddad36aea0b247332a1196fa957eda5376bbf92e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432967, "uuid": "5edfdf05-c974-4df7-9e2f-89c93cf2f428", "value": "T16B938D72C87A3E18C66986B4F0B0DB79EB13E901C1871F9A856AD3799443DC8F44A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432967, "uuid": "6fd76c03-b463-41ff-a44a-c1a3e9aad25c", "value": "1536:4BmIhYoJYci34oRSIzz5T+vqJn49rKr+TWGbL6Oy1CnlozKiWxkFnzi:0bbJg33RBzBCqh44r4bL6Oy1swEKnzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766432967, "uuid": "f3cbe64e-789b-4d6c-b44c-d80591a99cbf", "value": 92500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766432967, "uuid": "5029f5ef-2bde-4420-a08c-1ba62309fc83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432967, "uuid": "d6444e03-a060-4905-b0d4-6b987613f24a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56564ae9-df46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766415363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415363, "uuid": "be920d7c-aebc-4507-92f3-cd60201d96f7", "comment": "Malware payload (Mirai)", "value": "2132948f79cc34e9b2cf4c85a1dbdc0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415363, "uuid": "15e1c85f-22d6-4f9c-bc72-29d968c3ce80", "comment": "Malware payload (Mirai)", "value": "9a07da839b86314643b1e3129f910d8e94c9b208c1a8fb9cf84f67e345b7cbb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415363, "uuid": "40d9e12e-ce3f-4b37-b6cf-ddd08d337dd7", "comment": "Malware payload (Mirai)", "value": "c8074590e87e9baa313b41535324a6553345c021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415363, "uuid": "86537cc4-aefe-431d-8102-ef8511c86e25", "comment": "Malware payload (Mirai)", "value": "9400863b964ca20c63c0c91842fd7270e69df08d54e9e30eecfec763a849d1baea148d2d2297c9983949afc33e1a90da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415363, "uuid": "2cc998b4-4d6d-40ad-87e2-273f77be40a7", "value": "T129830895B8814B12C5D412BEFE2D118E3313277CE3EE72229E106F24778B96B0E77956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415363, "uuid": "01a125ba-0b27-4179-844a-e41ff3b1a058", "value": "1536:gInb+3Mx197BS8sw3HY4Ue1atFxXcIIti/SUwqU47ra5EYCS:m38zlj44Ue1at5SUwqU4XaSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766415363, "uuid": "cb70ee47-abea-473d-b164-5d1810607e00", "value": 83476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766415363, "uuid": "174ffb30-13c5-4c82-b6dc-b76d24e0a5d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415363, "uuid": "f9fae7ce-b7a0-443e-9d09-068639dbd95c", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2d292b-df69-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766430434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430434, "uuid": "15d3fe4f-ff6a-4ad1-969a-716746dd1d0a", "comment": "Malware payload (Mirai)", "value": "5c8a73235b3495f8dece1923f2cf2698", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430434, "uuid": "b1d15638-3e95-4970-82e0-37cfeb69d009", "comment": "Malware payload (Mirai)", "value": "9b063f4f4a47e948035e61bfaa5874bd1e65284088cc18975ee78738481f7d74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430434, "uuid": "5a7bbd50-122d-4df9-93d4-131e9d88bca8", "comment": "Malware payload (Mirai)", "value": "6f48450e8bc89f5aab8652b52c48b081bfc5aba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430434, "uuid": "c57ce88f-2d43-4236-8888-0dd077d3bda3", "comment": "Malware payload (Mirai)", "value": "59f645f5d8eef74d38ff39a9b6e2e63f6af859c762245c2e4f1ad324befb32ae767b51fb9903ab6e33c349f4dc2a4667", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430434, "uuid": "3b329950-32bb-4038-acdd-14d2524d8ccf", "value": "T1E9D31945F881AB20D5C626BBFE4F518A33135BACE3EE7202DD145F2427CB95B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430434, "uuid": "8a461569-d363-4df1-82b3-3a9df5dc7a1a", "value": "3072:DQeM6t/4yK15ARfUFQahbQrV3GYnsJWYmE3VqSHcjaBRkLb/XS2nzr:DQWtAyK15AtUFQa9QxGYneWYmE3VqYc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766430434, "uuid": "d4119c37-8e01-40a3-a796-a813a2dcfa8e", "value": 132336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766430434, "uuid": "e98e5b0f-8f18-4ec3-872b-05f43811bea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430434, "uuid": "b579815e-1493-4e27-9676-a5a2ae6fe687", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ad89a3-df04-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387141, "uuid": "87ae8d14-48d9-44e4-b6fa-f6819f4f456e", "comment": "Malware payload (Mirai)", "value": "3a7873c9e293b3d0f1e93ecaa4f8739c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387141, "uuid": "dacae13b-50b0-4e43-b041-2fe2efcf8bfe", "comment": "Malware payload (Mirai)", "value": "9b6ae39c9402469c1d0cca9d6a300e622cbdd26ca73b74fa331b4ed6ecd4664e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387141, "uuid": "93797c36-a2b6-438d-b700-eb561c7d6453", "comment": "Malware payload (Mirai)", "value": "efb995f80adf83ac192f244f844729089a9f2e94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387141, "uuid": "7c672bfa-8c5a-4860-8139-838d3f1a81d2", "comment": "Malware payload (Mirai)", "value": "a7261c0f408910a0c61db02090b57c9b70e0f22aba55803534b96845cf5f9ab4862901302b2640af08be5d3d7ef88c5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387141, "uuid": "42e7f1e6-4db2-4593-9e07-09b6b1d13c90", "value": "T1B5534C0372280A57E4930AB0253F5BE097BEE9D021E4F389695FCB668A75E371446FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387141, "uuid": "6ef9932f-1679-489d-a8ca-f7fa4403f4f0", "value": "768:B6EyW4cvvPFRkh/hYklauOpvriDka4sxo2GR/HfTkFewhrf6pe5zLD/R4w6HS:Jy+96BkuGGDhRx+ZwkwhWAzLDJZ6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387141, "uuid": "91dd8709-2c1e-41d6-bb6c-a5b71054495e", "value": 64124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387141, "uuid": "80d4cbe2-10aa-42f4-8e17-c2ac8c402dba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387141, "uuid": "700d7669-d654-44c0-a9fb-8daeaf7ddf0e", "value": "frost.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bc4fd8-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446341, "uuid": "9025fcbd-e8b1-486a-bd4b-650533941e23", "comment": "Malware payload (Mirai)", "value": "4f95aab0732e22b4f122d6748aa49458", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446341, "uuid": "1252eaad-3ac4-47b8-bfca-a2bfdbe4e6cc", "comment": "Malware payload (Mirai)", "value": "9bac8f9209b487b949bfd7e609ba1cfb2564a97baf05360269a58fd0634b4737", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446341, "uuid": "f8d7d1d0-f78e-42d6-8ae0-cc4115eb700b", "comment": "Malware payload (Mirai)", "value": "b4e02b474ecbd4600c95d43a270062faba9c4be9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446341, "uuid": "4ad7fe55-c6f0-4c93-b156-b0c9e0a49a9d", "comment": "Malware payload (Mirai)", "value": "384723d1492b6c443b74bd0340bfd038a9d0277fb3136593b308f6da48c414a83ab1a1049b5064eea1854ccc7414f44a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446341, "uuid": "13efd61d-e1f9-4ec0-b33e-9151dd7339c8", "value": "T190B35C02A31C450BE6E70FF027BB53E1A37A675126B5E282360997454676F329A06FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446341, "uuid": "4c3eaccb-2c72-40cd-a009-df2dac745e3b", "value": "1536:6F+AH93W/GCK9wojS7QUuQUCEi45B1kiEXETGEVFhQJ73DmoxnWVFy/Sd:0rHMk7jS76hBVBP7QqVFyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446341, "uuid": "ea36d017-5270-497b-8905-6158ef0ea9fe", "value": 108040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446341, "uuid": "4e1c4e01-3eb3-408d-8645-55fa9901e1a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446341, "uuid": "fd188efd-9877-4523-b270-35eea2ecdce9", "value": "SecuriteInfo.com.ELF.Mirai-BYP.11264726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c375db-df72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766434279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434279, "uuid": "bc4143a5-435d-4dfc-b726-ab8808da449c", "comment": "Malware payload (Mirai)", "value": "8b372202a75146634c2a5e07e1eded6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434279, "uuid": "27a0b531-35f5-4ca8-a44e-17e4a646f103", "comment": "Malware payload (Mirai)", "value": "9bf36a4298c603bff2bf5c3264f29d21793241d202ad4cbe6c17a6fd25df06ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434279, "uuid": "37bae531-b95b-4671-a5e0-0c1b645c5646", "comment": "Malware payload (Mirai)", "value": "3815e04b3f0e4ee6778c1661fc9753afada750f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434279, "uuid": "f0634c00-1454-4d08-8c70-961f4223c4ad", "comment": "Malware payload (Mirai)", "value": "70e9aaf01e348aeb1ec8f42dfcb50f2ca6b5b3bfc3b1f544f22de10e4947b9ba7a785b54c87215f792608b2f4ffb3c74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434279, "uuid": "57041263-3a29-4b1b-91b8-eaa705283e33", "value": "T1C9A36B02A58084FDD5C9C2784EAFA216D932F56C3275B56E33D07F263E5EE103B2E261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434279, "uuid": "ae891cb1-f16c-4374-abd3-2b0561760317", "value": "3072:cXDYmBAbs9jh/1Ho6UG1+mdxt5aMkBYP:cIbsIqzl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766434279, "uuid": "04229ddd-3356-4cbf-a36e-dfef8b0dec9f", "value": 100384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766434279, "uuid": "6ab368b4-6b45-491e-8fb1-f23230b37ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434279, "uuid": "508ff6bf-05ad-47ac-ae30-d2ce90484a4b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b25b73-df3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766412352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412352, "uuid": "cd4fef3a-7dd7-4727-82bf-0cf9727c95d5", "comment": "Malware payload (Mirai)", "value": "9028d7fbfe37fb7578b2a5b90e18de77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412352, "uuid": "c62e75b4-2b56-4439-b47c-364f18a72d3f", "comment": "Malware payload (Mirai)", "value": "9c19fcd05cb743fe136adccf7b275cf49c3a7d025567d474372bdfef7f867d40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412352, "uuid": "ff5c549a-f9ad-4b32-8ff9-fdbdaf40069f", "comment": "Malware payload (Mirai)", "value": "b946e60c7135e4003cbc375362d4aac8dd390ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412352, "uuid": "340c96d6-9816-4a18-a2f8-849d608298df", "comment": "Malware payload (Mirai)", "value": "1b2cc03d3e190e7f243b9dbef8e5594ad31695a6b8146cbbe069d4b43fd34d93cf807d58033d3e177eea89353be1436b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412352, "uuid": "64ba2630-bf6b-46da-ab01-b4a6f9fcf823", "value": "T126831A96B8814B22C5D412BFFA1E118D3313177CE3DE72129D206F25778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412352, "uuid": "a000becb-096b-4688-b2d4-aaef08a58290", "value": "1536:4vnOWNLMMRbYJur9hG35nvLX6aSzgJEQDMqiimQghVft7wr59GYid:4L522KpnvLKaSMmQghVftkrHG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766412352, "uuid": "30138318-e1f0-4daf-a673-a7466365ba0b", "value": 84356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766412352, "uuid": "8adc0a05-9ae4-45e7-9960-ea1a6f239719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412352, "uuid": "1dee3a2f-187d-4d34-80ed-5763f0323617", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf725e28-df6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766431028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431028, "uuid": "9b007f7a-1fe1-4951-bae6-e0e7fe28476c", "comment": "Malware payload (Mirai)", "value": "e8b959d10873689fcbbeced47a50d9af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431028, "uuid": "b54e421e-63ff-4b0f-a97c-910ffb8e64c9", "comment": "Malware payload (Mirai)", "value": "9c9565822c14cb1bf2ecf5bd5e21ea0fc97732c4f0d206a2e9f7846f770e5476", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431028, "uuid": "9b1c9d69-5334-4322-aa86-9b45dc32c87a", "comment": "Malware payload (Mirai)", "value": "18bc80bd0b1e44a57f61bf4044eee6132a3737ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431028, "uuid": "2f9b675b-2a3c-4136-b8da-cca6a96e6f46", "comment": "Malware payload (Mirai)", "value": "65cb9e3f614f065351b069905cd3b476157db427aab90fbebdf17d3c29446cbe0efbd1292c18d57fb22169e1e7251837", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431028, "uuid": "0301d20c-9527-474a-90e2-7ed0cab8d70d", "value": "T132C30796B8829B20C6C2567BFE4F118A331367ACE3DE7313DD185F24278B55B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431028, "uuid": "f9652670-d785-4529-aa9a-ac2f69672617", "value": "3072:rnTRZthHJ49mXqaJOFh0TrVJYDhT5IF27YyalEDo5dTLHanz2:rntZthHJ49mX7JOFCTPYDhCF2EyalE0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766431028, "uuid": "820865d5-9b53-4718-bbdb-fa3458444b5c", "value": 119932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766431028, "uuid": "0bfba9c3-d2a4-49af-952d-a9a4a05e4a80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431028, "uuid": "e806f06f-e90d-48d5-aad0-18520438b746", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7ebc5f-df0d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766390998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390998, "uuid": "294b1b2b-db48-404d-89a7-b9467bb0c34f", "comment": "Malware payload (Mirai)", "value": "9535272cb7436b72ef911456871f6666", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390998, "uuid": "638a1edc-3b41-44a9-a16d-eee68f320d0e", "comment": "Malware payload (Mirai)", "value": "9e2ebe9f81e7b1fe0b3e25cdb4b43ab7bf8af4126e52ec9ccbb0333e24215ff7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390998, "uuid": "c3f3cad6-af22-40ef-bc35-2bbf3fc06cf9", "comment": "Malware payload (Mirai)", "value": "e4a6ce43460c3979255ff0014327838b790d6434", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390998, "uuid": "4aba57c2-ac5d-445f-adde-a397174dfde6", "comment": "Malware payload (Mirai)", "value": "8bc0892e95dcd025ae3ddb21bafe32ac5deb94e7b57c8e1c6c53c6835eb38e1fd6bedff331556ca9e4d6cd94b6dd3db7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390998, "uuid": "18347afa-75bb-4514-89f4-fd88db008a6b", "value": "T1B8A34C95BD92DA12C6C52277FB1E428C372713F8D3EB33038E256F21368A55A0E7B591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390998, "uuid": "6c8ac6de-5e67-4001-8a99-b73866a6b569", "value": "1536:0tx8u0Af8cxU1q4n59jD5zYf37c14ds2o9VS5/0OzpqlXAc9lvtoemS:6x8Vqfrg9jDw37o4iR9VUQZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766390998, "uuid": "df1c7ceb-c210-4fba-9041-b092e895a294", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766390998, "uuid": "422baadb-d0f7-43c3-a322-ea8c38a84298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390998, "uuid": "57fa069a-d24e-4e1e-8941-1530414d7a33", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cca5cbc-df6b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766431292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431292, "uuid": "84f4ca17-53d3-4692-890c-303dd5fc9898", "comment": "Malware payload", "value": "e4be2ebc069a05b8c2a8b084e2904065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431292, "uuid": "e1a5c15d-dcbc-4575-8344-84ff91fde0bd", "comment": "Malware payload", "value": "9f332ea2026d61a05ec01434176042d0d967b6a69b0e427a92c03dff6d010cf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431292, "uuid": "e25b8164-c64e-467b-80bb-c728ab91f22f", "comment": "Malware payload", "value": "b4f2b4f0d0893e8dd443f4352839a9b8a81a0181", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431292, "uuid": "c21c58f2-5c72-4a29-9393-91206bca376a", "comment": "Malware payload", "value": "16eefff12b2a6fd76508ebc9839c8e4d6bebb352c7637053b4746632ae5e1e5417609ec325e03de78149430112485cef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431292, "uuid": "9c7f6239-2714-4437-80e2-1d9cb1a1a166", "value": "T18AA36B46E653F5B4D8160035125FA37A8A75AE322025DD9FFBE47B32ECB1B019A0633D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431292, "uuid": "ba794060-7811-4115-91cd-1c4d3b383355", "value": "1536:fVofytFYwk03OxlSPm5B8x96/Z0KvqFHyUY+rjpqfT+9Uo/EjjU/31sod3csIcsV:EyG6x9QvwHyUY+rjpUy1iEmJMwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766431292, "uuid": "753c70bd-7d07-4c1a-bb15-ddd9aae94e43", "value": 107244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766431292, "uuid": "77b8a166-e4e7-45b4-a7c9-2a88aebd5b8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431292, "uuid": "e401b4d4-fd48-48a4-9c51-3d8604828452", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd87def-df3f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766412448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412448, "uuid": "64eaaf65-82ce-46a1-8181-10aa19d93c49", "comment": "Malware payload", "value": "c6f88619d0c9187d9752fe11ff8edce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412448, "uuid": "d6e99d11-37e4-4d82-aef2-c9186b7fbd79", "comment": "Malware payload", "value": "9f5e89cf17258c3d2c60fc3fb9f916beeba8a2169c2ff875bb0e49039f7e2783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412448, "uuid": "4f69ac4c-7f19-45ce-a778-42bf65eaae46", "comment": "Malware payload", "value": "a54f612cd396aab193627f4a1e9eb3918972abfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412448, "uuid": "4abc3f7a-79c1-4d99-aeeb-2ad8847b6bc0", "comment": "Malware payload", "value": "8df4455850a4e9e41f7b2b3b766d3245d2d5b2954e117fb29b8260ed2eb8193f659961d535fe4219382e70f2be09f8d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412448, "uuid": "762ed207-35e6-40ce-b90d-e03c99d6c204", "value": "T1A7C587F0AE01D4C1F57E5B7AF3ED7908A1343227EADD5A4A00A466591EF6A01FD0ECC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412448, "uuid": "33f1281a-2266-48a0-b14c-7c0ef0bbc81c", "value": "66506cf48bfc3b0d79a8e3790223e69e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412448, "uuid": "e920eed8-2c0d-4c3a-8c41-b1d320ac7ddf", "value": "24576:4NUrQQvkJdfOYiJzQH04YwXXQ0+DjPsbUU:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766412448, "uuid": "42fc636c-fcdf-41fc-8ca1-4dfe7d0a76ae", "value": 2574336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766412448, "uuid": "f9a2d66b-e69c-429d-afaf-a5a0406893a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412448, "uuid": "a0d227ae-966e-4183-a913-0731e186697c", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713b4c62-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387491, "uuid": "db754e15-cf32-48a3-b2cd-ca2d60e0ff61", "comment": "Malware payload (Mirai)", "value": "abb66c8145061ef20015ead0004e7882", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387491, "uuid": "1bdb40fd-9556-44b5-8a2b-af293626230c", "comment": "Malware payload (Mirai)", "value": "9fb79faee1ebd28425836fc7636680433796d04ac84360b509c815a7087d2feb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387491, "uuid": "141d10a7-b5a4-4975-859d-1c5a009537a8", "comment": "Malware payload (Mirai)", "value": "6027fbe6e3fe47d3eae8ff6a4647edde0f88379f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387491, "uuid": "174109ba-9f9b-4884-87eb-04bb946ee924", "comment": "Malware payload (Mirai)", "value": "18478080a6a37196a1394ac356418c804d4c70653735ccd19f6051d8919cc2db4811b41a5cb94a8fc2d1348611db3e7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387491, "uuid": "527059bb-aa06-4933-8078-7d1d6ccdba13", "value": "T1E4F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387491, "uuid": "5bb1223f-3d35-4fc9-b988-1bcd3dbd68d4", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHGfam:9FJMgWPZr8IaCWReS1WpPeT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387491, "uuid": "19fec84f-1cd3-47a6-a820-ea0ec40c8f6b", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387491, "uuid": "d438488f-ddce-4270-9d27-b37a4ae8f90f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387491, "uuid": "93b68503-25a7-47ca-8fe3-1cfd7d4ade4d", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9360e9f6-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397856, "uuid": "17b29354-dd20-469d-a590-0975f4c3c0fe", "comment": "Malware payload (Mirai)", "value": "4cf3397c4bcf43aef05db32c17425216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397856, "uuid": "61b3afc4-ddd0-41ff-8d77-fa36f0d58ac1", "comment": "Malware payload (Mirai)", "value": "a049451baec251f9ed5adaf5e85ccbe9d8f638b315ee062b5bf8ffbb11e5b26e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397856, "uuid": "4d6b2934-ebad-4672-8efc-12f8ef818381", "comment": "Malware payload (Mirai)", "value": "549e140932f365cf8dba0412a8e46c6b1da6a3a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397856, "uuid": "e1838f5e-3981-423a-bcbc-b559f4c6f5e5", "comment": "Malware payload (Mirai)", "value": "fc2e7eb13ba60ffd5e54b422a7cb998d84996110e19be478cf51d8ea8ba01f9514b5ae84956e2cd54b408f8507ca0faa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397856, "uuid": "18ba0f74-0cd3-4558-a49a-8350e5ffc646", "value": "T199E3E60AAF601EFBE86FDD3705E90B0925DC650722E83B753634D928B61A54F49E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397856, "uuid": "33044856-f161-413d-a03f-7863a4d53198", "value": "3072:HYXnh3PQ4wo2HMEnMUKoYzZ9kzVLXnzuw:HYXny4woVZUKtzZ2uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397856, "uuid": "c6c021ec-4d9a-49e6-9aa4-6df62023e123", "value": 145644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397856, "uuid": "27c9aa12-fec2-4e85-8656-bbf0d7ac1e3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397856, "uuid": "79097167-9f17-455f-8bb4-47d737f2fb72", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76907a1-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384683, "uuid": "c9c5171a-38ab-45cd-af4f-31373a8fc249", "comment": "Malware payload (Mirai)", "value": "34ef64cfcc5f402caf741dc95c88bcc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384683, "uuid": "86037c82-cfc1-4c5c-84d3-cbb2a4a62ec6", "comment": "Malware payload (Mirai)", "value": "a1665fe305b80368bd1336345e1082c1ee7c6e15316f5cf3fe2097d7e03f0bec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384683, "uuid": "507fb783-b97f-4eae-8ff6-198b601247ef", "comment": "Malware payload (Mirai)", "value": "6f0ca56be55be9fb2edd96b54dc131c9bdd443ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384683, "uuid": "4dfda57e-cb34-43cb-90a9-985d0fbcc93e", "comment": "Malware payload (Mirai)", "value": "a35873b9b7efaf5d297283db0954394de72b54df01ad46a399491ba06bf15e000d64f4e96dd1d47b698a0cd77b2a3133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384683, "uuid": "8faceec1-5a0c-41c8-8784-388ddcc473a0", "value": "T16E235BC49A43EAF5EC120A7420B7FB335B37F07A5159F987D3659932AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384683, "uuid": "c1d183fe-8c9e-4f5c-abf7-ef544b05c02d", "value": "768:c8/MjSNW4GBs82WELXamRfWzqNYeZj3hwFEwaKXg+ZdG:c8/MjSNW4GBz3ELFdNYeFhwRaKXhZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384683, "uuid": "1358fe4f-25cd-43b7-b7b5-3777c4c0df50", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384683, "uuid": "6f04e95c-3b14-43f2-947e-bf51e7de938b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384683, "uuid": "b7288e62-8a7a-46f7-86f0-f34f54758d2e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32e99a1-df0c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766390662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390662, "uuid": "f877488d-13aa-48fe-8f45-2e103f1e6bae", "comment": "Malware payload (Mirai)", "value": "c89555febc99f771cac72474f9006005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390662, "uuid": "55f2ab1d-001c-426f-9e81-e67adb1c2890", "comment": "Malware payload (Mirai)", "value": "a16cbc456dd7c85a21cb94fae315761f5e0022bbdace13fe52b799e9bf3a95a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390662, "uuid": "d6a21109-4960-473b-9db8-be35b051a395", "comment": "Malware payload (Mirai)", "value": "e46751ab7e6fe605507ba931023b80ac2c34de6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390662, "uuid": "55916bb3-7f65-4d5a-a9a8-5956cf009b70", "comment": "Malware payload (Mirai)", "value": "84abcdac423b9ff25d4dc45e9bf8d1b687d053f6f4c698b725bd09cd2fef463d47bff7c9ac6f013332b0cbdb2a538a7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390662, "uuid": "434d204a-8992-4d7b-9ca3-460ec5d214b6", "value": "T1BD93FA59BB210FF7EC9BCC3745E92B01288C655A22E96B36B970C418B54B34F2AD3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390662, "uuid": "0f89dc3f-cb4b-4eba-a446-193b01360ff7", "value": "1536:QYF1biR97vp0PIIN5TCGFlKjxHPMEZPYuzt6:QYF1biR9zpjINmPME3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766390662, "uuid": "672c40db-362a-4b5a-8dc9-06f48d37a916", "value": 88852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766390662, "uuid": "f8944fbb-e7be-414c-b528-ba89697c7333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390662, "uuid": "df1ff8db-36ef-42d2-8b6a-582920d2767d", "value": "frost.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3515ba7-dece-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766364007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364007, "uuid": "51e48b87-bd41-4ffd-adeb-ae4beefe3ea6", "comment": "Malware payload (AsyncRAT)", "value": "a44e4b2f7290a0c4e35a908f52493491", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364007, "uuid": "bf333a3a-6d02-47b9-9224-543f9a02667f", "comment": "Malware payload (AsyncRAT)", "value": "a28471c714a4e8b78403b7a53370353ff4ed742341418d051e72b09dd3a72fc8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364007, "uuid": "d37679b9-2918-496a-ba0f-0d02a989edaa", "comment": "Malware payload (AsyncRAT)", "value": "64a4d3afe150bd14420c1d115b6aa05a0b57d990", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364007, "uuid": "86733f5c-17e4-4771-9b5e-ae724556c2ac", "comment": "Malware payload (AsyncRAT)", "value": "d221ad8ae2726fcb8bd0f9d5c264bf71fec075de5b5f4acbd19e47923bf36a4d5e057f82a1dcfe1f670fed0e3bd738c3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364007, "uuid": "9cabe520-066d-4c98-b187-3f2388efedc6", "value": "T185C22B0473F48265D1ED47BE48329200D375E68B5D53DB9F2EC4A5AD2A33BCD8621BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364007, "uuid": "22dac17e-2d6c-4177-aa1b-b18328d8f4f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364007, "uuid": "a644ca98-32ec-4c95-b3b7-d51d7cf884bb", "value": "384:+4eMn+LbqY3zgetmQkLAMymrJhxUHqqbuUsJQxnCJf+BWfXWm/Wu+:+4nncb/3EtQk8MyCJhxaFbHBFB3u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766364007, "uuid": "6ed6342e-7bb3-4fa2-a21b-02e440b5a518", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766364007, "uuid": "952c64ac-2bcd-4e88-a154-9a37932d3ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364007, "uuid": "85430304-b0bb-423f-9ecb-618198d11804", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af461db5-dede-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766370845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370845, "uuid": "72988129-6ab3-4ad8-8e39-de54e0aa26a2", "comment": "Malware payload", "value": "45e047407b29455dbfdfd08f1396dde4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370845, "uuid": "97063c79-2870-42af-8737-99bcf143b2fb", "comment": "Malware payload", "value": "a3b4adc515ea2c84721f1d5529f76bb02b145b808dd3a4ca983a02369a62163d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370845, "uuid": "dd6c4bc3-bb7d-481d-878c-a80ea81f6046", "comment": "Malware payload", "value": "932883cef65d84f5535c8ac8e0d190afc6871bd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370845, "uuid": "a3d7600f-fee9-42d5-8948-06431f7cc3ce", "comment": "Malware payload", "value": "133258ee4d757660a4f952d44ceac43e5e2cbcae5db584baec0d62816fbeab612cffb9340c93a372375f59dbe2265abe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370845, "uuid": "03e697a5-e031-474a-896d-e736e0091053", "value": "T12494CF52F3103AA7E10A8535588143006784AE7563E2E303FB97B6BD752B5F5CF283AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370845, "uuid": "ac06cb5c-3cb0-4a59-ad53-c48956208014", "value": "12288:xEbgQyD4nHWktQS3zgn0uDaNI91enSyssdCzJR:uZnHNtHzgDkkskf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370845, "uuid": "3c0e30f9-a3b9-4a38-b781-cda6cb4b0ac6", "value": 432368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370845, "uuid": "db1138d9-0cd4-40b0-a317-7d5a9576c2b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370845, "uuid": "1535bd66-620f-4d76-bce2-f89c9e9f9459", "value": "rondo.armebhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bee66bc-df6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766431291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431291, "uuid": "37a309fb-6555-4f0d-abfc-dd900b622b1c", "comment": "Malware payload (Mirai)", "value": "dc61a0a25c9519865ca4a5fd1a270801", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431291, "uuid": "04bdb65d-c847-41b7-8f13-795d625c4eb0", "comment": "Malware payload (Mirai)", "value": "a4640961a7bc1c58d7e690a1563e08ea542504410e7b8c873b1f6e9e29eeb92c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431291, "uuid": "0cfe11aa-5d84-4844-8129-439f421242e0", "comment": "Malware payload (Mirai)", "value": "b7bccecfb2e65ba883ae7d5f68f8c09a69d2b213", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766431291, "uuid": "b2a80d5d-a498-4714-911c-b8312f49dd6d", "comment": "Malware payload (Mirai)", "value": "d2ea5c076daa58769ceeb0d6622841039140de6ca03e6f24469d054590c021af99ea4d463bc18e535ad4950eec9ebca1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431291, "uuid": "fad0191a-4c91-453c-95c2-91befe96c225", "value": "T18DE3D60AAF601EFBE86FDD3701E90B4925DC650722E83B753634D928B61A54F49E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431291, "uuid": "0e7dda36-887b-420f-960a-5984e8e019df", "value": "3072:XYXnh3PQ4wtGHMErMU+oYzZ9kzVLAnzuM:XYXny4wtFdU+tzZVuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766431291, "uuid": "6752adf9-e238-45e8-8733-6aa062e9a222", "value": 145644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766431291, "uuid": "51a08a0f-f3cd-4567-a34f-a61b4d4d56b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766431291, "uuid": "ddec3452-313d-48a8-b6ef-e4fe5faa70c5", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8750be0e-df20-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766399125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399125, "uuid": "83d991a8-8da7-4f49-9d64-2dfc31c54e79", "comment": "Malware payload", "value": "d1382161fccaff37145c8f26090def50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399125, "uuid": "c76096cf-603e-491d-82ea-f312143a39c1", "comment": "Malware payload", "value": "a4f34954f535cadba717ddd6b7eb75ca575bb40f60cb908155eead4ce8b4d7d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399125, "uuid": "e16eb68a-3ea9-4fed-b72f-e308c67a0313", "comment": "Malware payload", "value": "bb887442c97807fb41b54fe37d83ad2d9c485ad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766399125, "uuid": "4e5c70db-d2d0-47c1-9afd-803ee50e3df5", "comment": "Malware payload", "value": "3fb370d4afd2cfe225119f4143a916a906d0956f1138efa368291eba53ec7fdce0c3a0996a83f5169bddc32056be0c80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399125, "uuid": "6d0eeab2-fc0f-4f7e-8f4d-acb933e0f5fb", "value": "T15B0733D9F449FC2FE944E1B0FE9365BB2BA44F11B431D1937179086A327703F6AAA481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399125, "uuid": "72e0bc8a-05af-48f3-98db-5a51d8a7b574", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399125, "uuid": "a485633e-bf2b-4da9-a567-924b9c7031af", "value": "393216:rm7o0wP8DbG4x1dd/gpyflQbOvxDhsWbFSExKz335sU1XT:r4nw03Gy1dwymbQdhDFBIz5rXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766399125, "uuid": "c215bf93-b512-4453-bffe-3661ddcf47db", "value": 16802808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766399125, "uuid": "796b5099-e93f-4d4a-906a-5ca9ad97827e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766399125, "uuid": "c2e48b0a-f990-4481-99a0-50d36078d07c", "value": "bitwarden_installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e67627-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388843, "uuid": "c36edb2e-de28-4bb8-963a-ac7ddba23933", "comment": "Malware payload (Mirai)", "value": "aa381a4b4b031524e91bf8a7535b14e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388843, "uuid": "cf69e816-1b02-47a7-a6b1-a62728d9bce7", "comment": "Malware payload (Mirai)", "value": "a4f87881cea5b6de0eb3f5e0e54d0813027d2c3c0b62980eb9dc2e1f09602574", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388843, "uuid": "9be09a02-be2b-46f2-8dc5-946c7513e272", "comment": "Malware payload (Mirai)", "value": "774860ce4abac6c62d36fb52a86fed051a745527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388843, "uuid": "fbfea685-4e2f-43fb-998d-19c2221e580a", "comment": "Malware payload (Mirai)", "value": "736c7b37d6a626490133323a425c98761801a58b968266aa7eead04cce200db8eb15b8239fc2f021528dd0601d3e1765", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388843, "uuid": "b6ef867d-dd1a-4486-9a36-1186f58dca55", "value": "T1E7330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388843, "uuid": "c8316e01-8294-4a19-847e-d62c63c914af", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGQ:r/hqaJMcjeqK806MHdMfQXoHuCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388843, "uuid": "75b5d3f4-cede-4c03-a07d-4c0e2cc9e0b6", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388843, "uuid": "254fd5af-4d66-4846-88a5-cfd0577131e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388843, "uuid": "eadcfc37-e206-4725-b4c5-32b7788878ff", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99116c57-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387558, "uuid": "40e2c7e1-5d70-4c0d-a0a4-4d1490706f04", "comment": "Malware payload (Mirai)", "value": "96a1ae42bc606f0c7fe9fa041970a1e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387558, "uuid": "1861cef2-fb3b-4ce8-a7aa-64d83631e77b", "comment": "Malware payload (Mirai)", "value": "a5cf5c92832b76b2db3cf8200dcc6251019cf945a2965fb0192e7a929d4a1c54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387558, "uuid": "d06d6bbd-e278-4675-84c0-aebbabcbade0", "comment": "Malware payload (Mirai)", "value": "585d6d05f7282598b5b117c0d8b756caf10ee06c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387558, "uuid": "d3c8ae1e-1e7e-4809-9032-fc01ea6c98e7", "comment": "Malware payload (Mirai)", "value": "4a04869c2d4ec5cee7c1a3ab3a5589e980d761fba049b54bebe4e54e1b294f4ee052fa6f63922d548d11d842a3f0410d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387558, "uuid": "9fbad4ed-60e4-49f1-8cad-7e74f7372fbb", "value": "T101148D68FE4F68D2D2C7E37DAE4A0FA230277D749565C0B51A00929FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387558, "uuid": "3e07ac56-3dd4-48b1-b3db-37c4ff03a14d", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxm:bOVfbEdxm4iub8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387558, "uuid": "87f2efb9-7d41-4855-8597-be86e46cd07f", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387558, "uuid": "565aba6b-701c-4b3b-b198-a173c7cf8d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387558, "uuid": "1473f442-111f-474b-a72d-e52c9b0b0a6b", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2265d62-df70-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766433610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433610, "uuid": "37164ab1-f397-444d-92e3-2ba99d46f483", "comment": "Malware payload (AsyncRAT)", "value": "b455ab36147ec0629023c0d43f8f5c04", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433610, "uuid": "76251d3e-faca-41f8-993f-76139d663fab", "comment": "Malware payload (AsyncRAT)", "value": "a60110bcf8df4d64e2a2fa3c970b424a28517335defea3778d17f143e4905a74", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433610, "uuid": "0ea3613f-0a63-4463-98d8-e7de2aacfa88", "comment": "Malware payload (AsyncRAT)", "value": "216368eb9b7bfcced47f8557edef0918db984438", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433610, "uuid": "ba8e5bda-2ee3-4be5-87a9-c8d84a4f9cc4", "comment": "Malware payload (AsyncRAT)", "value": "1fd18283cadabbeac4a837808974a95557f252ae7ccbb69bb3b22f650e60b573b110f9a66a7d5827b94feec724217e7c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433610, "uuid": "c0f45b39-3e78-423c-900d-49f42f4103cd", "value": "T110233B043BE9C16FF2BE4F74ACF22145867AF1772603D65D2CC442975A13FC29A429EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433610, "uuid": "967f53a9-7627-446c-a7ac-f9b6c7e2367e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433610, "uuid": "dc273f4d-6615-432f-b4b2-8b8c47b305ab", "value": "768:4udZNTAoZjRWUJd9bmo2qLABNJsnql9Izvs+WUq++puk0b+QDTYoTm0YLEk/RYDQ:4udZNTAGL27BTnUq++puHb7DMzlLEpdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766433610, "uuid": "3ddcd649-c4b2-486e-9a67-d69f2b77f972", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766433610, "uuid": "35da6429-bfd6-4f1b-9542-50d02f561575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433610, "uuid": "89399651-714d-4087-97c5-a7e3cfdf956e", "value": "a60110bcf8df4d64e2a2fa3c970b424a28517335defea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b0ad62-dedf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766371367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371367, "uuid": "2e1d9a6a-aa75-4529-b22f-ce9e61e1fad9", "comment": "Malware payload (AsyncRAT)", "value": "54e2fcca80961757e59bd757d5de54a3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371367, "uuid": "b75851b7-a639-471f-beac-c67e243edf9d", "comment": "Malware payload (AsyncRAT)", "value": "a63a7a2b0ce0293c96c0c41bc5cdd31dd11fe9cd377915836c773c71eaf72007", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371367, "uuid": "96868ffc-50ba-4a35-8024-e8f00c85be20", "comment": "Malware payload (AsyncRAT)", "value": "de3e0ae92b71234243d43951b20a2043ad7bb038", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371367, "uuid": "86e92183-f582-4417-b79b-17ffc533073e", "comment": "Malware payload (AsyncRAT)", "value": "f3a9e35d9f3e63f8c4d0e52b2d492c2688314487b777327eff44207462383a38601b685d41cbb00159e1a4992ba35ea0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371367, "uuid": "0bce170a-f19c-4b8a-8e9f-c934399d0b67", "value": "T1B3232B043BE95226E2FE9F7959F11645CA7AF6132502D74E1CC002CE4A23BC6DE527F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371367, "uuid": "4c788ff4-3ca6-4ae3-b6e5-c701eb1fc59e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371367, "uuid": "9e443978-5ee6-420f-8361-7efd29da1830", "value": "768:1seY5qqfyAacveEK2fC+enm51a5vXglLAeb1igUptwcjWrAK8RccqrWBNOK:Sq6acM2f2na1NVxb7U3ZjWrvYcd2OK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766371367, "uuid": "89ea4bf1-96ce-4461-9e23-f3bb748eac04", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766371367, "uuid": "96357da0-7532-4a2d-b609-30490745510e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371367, "uuid": "1961194a-3a1c-4a6b-abbf-a19611b3214c", "value": "gv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee65ede-defe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766384346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384346, "uuid": "dc0d12d9-08ef-4106-8d2b-4843b4f33af9", "comment": "Malware payload", "value": "b735d602359b4af9645eb90e4b5aa798", "object_relation": "md5", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "hotdecjanniygga-blogspot-com", "colour": "#A2D002", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384346, "uuid": "ebe5810f-2a43-49dd-b502-13f1df9cedf1", "comment": "Malware payload", "value": "a68b95de634ac3931aeb710eb0788bff4dbec9745b240ed84914ac0e560d5f9c", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "hotdecjanniygga-blogspot-com", "colour": "#A2D002", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384346, "uuid": "ac19940c-72e0-45f2-bb0c-97771c765fec", "comment": "Malware payload", "value": "3f4626f83a9378ae91d389b0d5b59a8a1d59bccc", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "hotdecjanniygga-blogspot-com", "colour": "#A2D002", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384346, "uuid": "ec74dcdd-53fe-4c60-a55f-95a9abe58878", "comment": "Malware payload", "value": "9f3090275c6a60d513cfeb604f5586730beeb5ff4865fdf0252735e2e334aded2bc2347e9e6f64b553f79c769b50d1b2", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "decjan2026-blogspot-com", "colour": "#8E4EAE", "exportable": true, "hide_tag": false }, { "name": "hotdecjanniygga-blogspot-com", "colour": "#A2D002", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384346, "uuid": "801e2ebc-809e-4042-ab03-41a06d3c76af", "value": "T12D1645E99E84D769F1C02A6DB316001373BE79A9F6F66383E2332A7A355E043511C787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384346, "uuid": "460f919e-7c12-4fa4-b56d-a640b82e4e4a", "value": "24576:rbXbXbXbXbul4DB8DSVwAVwAVwAVwAVwAVwAVwAVwAVwAVwcQE+:rbXbXbXbXbul4DB8dE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384346, "uuid": "56cc44b0-cc34-4258-a5a1-468495b31ccd", "value": 4175141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384346, "uuid": "5bf1ff47-f471-41ff-bc1e-daebd65eb3a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384346, "uuid": "83d8ccff-45c1-497f-be44-17696d9fddbb", "value": "nimper.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3beaf419-df5d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766425197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425197, "uuid": "ed29bc52-6195-4959-8115-fc29140ad5f1", "comment": "Malware payload (Mirai)", "value": "a9105c648df7957bfca68a2937eac651", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425197, "uuid": "1f04e659-adf1-4e56-921b-3a8d18af55b3", "comment": "Malware payload (Mirai)", "value": "a803288d3fc2e95b1fab053a5b3366d2b18c9150e0d509cd2d040ff4e89c0f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425197, "uuid": "65503517-8774-4a70-a7f8-14bb0c305608", "comment": "Malware payload (Mirai)", "value": "476c1bfd9832674d86880e254ad91a5bdf3cce4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766425197, "uuid": "6a5abe6b-7982-434b-a9f6-0f5b6b8b8211", "comment": "Malware payload (Mirai)", "value": "2009499e660d33a9840c55b6f556d80e203a86df245cc1c9b3c2eb75c243112ee373b3461922bdd3393ba67e32cc0e7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766425197, "uuid": "a5c6bb7e-bcc2-4d4f-b2b8-0c3453ecf3db", "value": "T18AB35A43F782D1F6E46941B2213B9B3B8331D9764011CA42CBBD9E729D25942DB2BB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766425197, "uuid": "3d6af3ca-45cc-42cb-a41f-e3fe6dc7eea6", "value": "3072:7e9CXZAMwfrUNdRB+pFaDqIhEt283eCnEPIq:7e9CNBHWH3dmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766425197, "uuid": "d3743a00-a430-4ea9-884e-be333d3955aa", "value": 112868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766425197, "uuid": "19262dd0-dd0e-45e0-85ac-99c12b93008a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766425197, "uuid": "bd13342a-22f7-48bf-8b85-6490e00e63f8", "value": "rondo.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bdd2e1-df7a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766437938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437938, "uuid": "27820471-ba5a-4edc-9f7e-9c185c836cb3", "comment": "Malware payload", "value": "256ae0a62a34572144bea4a80952cf38", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "indeanapolice-cc", "colour": "#7A9486", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437938, "uuid": "438e9976-114e-48e6-ae5d-fa48457742e5", "comment": "Malware payload", "value": "a803ed591843a6c85c5f1207566eea2c7b345243a8613eb7a258a098a2473b61", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "indeanapolice-cc", "colour": "#7A9486", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437938, "uuid": "b56d2728-3143-420f-9f8a-4e1d65c5559a", "comment": "Malware payload", "value": "3d3ad5917aea88c25bde04c1778f653dd1de8b1a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "indeanapolice-cc", "colour": "#7A9486", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437938, "uuid": "d574ea27-9f27-424a-ac08-1d47aa626b87", "comment": "Malware payload", "value": "adb6bbc8bf9f1cde7203a4a775799c37e276a2acf418bbeaba0f4b614a54edda139357101108e32e48f98b30efa44bc7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "indeanapolice-cc", "colour": "#7A9486", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437938, "uuid": "32b5a9c8-d979-4966-9342-f9f3a69eb3b0", "value": "T1CC916216EDC71C9A8393EEA3C1E3D318BFA4445C9107DEC9B57C8281A662E691389F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437938, "uuid": "c53e212e-b362-40b2-bdaf-709f7959ddb8", "value": "96:aWIu83kALQuPLQLKIAoJIPjIX2N7mFsH/0zJ:xs3poERADWH/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766437938, "uuid": "53f6c8d3-bfc6-4afb-a2a1-16bf0ae70a2f", "value": 4253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766437938, "uuid": "afc7c993-2138-44a7-8838-ff88c13528a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437938, "uuid": "92c27f10-725f-451d-88df-f9c697c827a9", "value": "OST_Walker.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32846071-df3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766411438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766411438, "uuid": "26f571e6-97b9-4e16-bc47-66bf3b897150", "comment": "Malware payload (Mirai)", "value": "f55cada42c3e1b9773a553e70f57a19a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766411438, "uuid": "4124bd7a-f25e-4b0d-8867-78c94bcc9683", "comment": "Malware payload (Mirai)", "value": "a85bd5107e08ef28f77869f3e124b0bb38e56dd68898da7b2319acd3173472cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766411438, "uuid": "ac02abdd-8251-43aa-81a1-85680b10bcd0", "comment": "Malware payload (Mirai)", "value": "d273bcd39ad071752a39713b1c6f00f2a8212e10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766411438, "uuid": "70bdebf4-08f1-48e0-95f1-462b80726140", "comment": "Malware payload (Mirai)", "value": "5d453e352dffe5dc2c0bf0f02ad0c94191af91db83aff8123d952621830a94b887a705c56d2acf34048af8548fdc66d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766411438, "uuid": "f6eac46c-229e-40b4-82d3-ceb4e15f2087", "value": "T1DA332A03B982C0FDC55CC274566F7A36C833787E033AB9AA37D4FA266D46D615E2E904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766411438, "uuid": "869a9aa4-5eae-4a0e-bba4-223ff0780900", "value": "1536:LJCqjbwNRaPq5FllaxwOzvTFToaoNqEv:7jEraP4llaxwITFT3WqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766411438, "uuid": "f519186b-ecaa-4e90-84d2-c75185fbd20a", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766411438, "uuid": "4b3d55c3-c3de-4b20-a490-233cacd9839b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766411438, "uuid": "88d0cbf2-8df1-4e3b-ab08-39613d5bce5a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627c0fd7-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387466, "uuid": "0661fc84-d6e3-48c9-9b9d-a3c605072ee9", "comment": "Malware payload (Mirai)", "value": "a6fec90a6d8b4c8b00f72ed6a01a89e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387466, "uuid": "31cc195a-de95-485c-bc79-40a9c72290ea", "comment": "Malware payload (Mirai)", "value": "a89f7f5f58288a91a02bdd8c4224fcd917d77ea5149771fd67433aa4deb6a49f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387466, "uuid": "fd943106-41a5-4595-b88c-24bdf383b2fa", "comment": "Malware payload (Mirai)", "value": "05b176c494e4457e865ef7784dbab27739d7f2e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387466, "uuid": "eba7729f-7aee-48be-b6d6-2420ff873ab1", "comment": "Malware payload (Mirai)", "value": "8a8b3c57f9a622a0a053838b7d584e58d4fc3e0026ea224a1824553c81acf1c1224f08e3b70fcfa89f87af0ea7d91feb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387466, "uuid": "fbf102c8-137f-49cd-b1a2-14b6afd6809a", "value": "T1B65302E690E87ECCC29A9774060B4A433EC27379A09A553772C0E7654AF6314DFC8BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387466, "uuid": "5a0cf22a-aa1f-486e-9209-556a110a777c", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAT/Lkg4azHk:CM5az1Fy0oPgdZX6hTo8RALGazHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387466, "uuid": "cb9b88f2-33fc-4c0c-822c-4f013c2f4dda", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387466, "uuid": "1576b2b1-7632-44c2-ac70-37fd675cf471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387466, "uuid": "30f60a6e-9109-48a5-9877-967bca3e2b29", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf11be1-df6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766430702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430702, "uuid": "4e92def4-f287-4c2e-9a4a-48436ed32f3f", "comment": "Malware payload (Mirai)", "value": "a5887e8730e3e98f939e7d25753dbba1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430702, "uuid": "17671b4c-695e-4159-93f2-f4d2c4a7977c", "comment": "Malware payload (Mirai)", "value": "a8b4a4a8376113b1f6ef5831aaa12aec987f4a54c7b5adc53cbbe6e90c105236", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430702, "uuid": "d6a3b8ab-dc79-425b-94c4-910a13f46033", "comment": "Malware payload (Mirai)", "value": "caddc66845efb618d66c2e431a49b5488d1c05d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430702, "uuid": "980ac8a4-cc00-49b9-8d8f-0168fa0b5e25", "comment": "Malware payload (Mirai)", "value": "c50dfd08e81b3521f20d953573e6bdd4e2e334caadd0d76909540c58966c0c5ebdf4f5035b3c183e7e82e3bc828ef66e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430702, "uuid": "545ab393-17ea-4710-a9ec-f4572db732f1", "value": "T1BCE3530EAD219F3FF22CC33647F7C664A36527D723E3E24AD25CD5241E5838A581AB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430702, "uuid": "7712c5a5-3cd2-4f1b-b189-109e1718c153", "value": "3072:I5eeO2SVKcLbaqiF2RmKdYgH3837qCVS+2VFyD7:UeeO2SNnaqi6n07qgnD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766430702, "uuid": "c7c453dd-96d9-40b2-abd4-a5c939cbe063", "value": 143852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766430702, "uuid": "b088a016-22dd-4e46-884f-e7541339236e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430702, "uuid": "5b727309-46af-4a22-90e9-88ac7956ebdf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd72e092-df3a-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766410382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410382, "uuid": "1e13badf-7671-4984-9044-6947c86b28fe", "comment": "Malware payload (AsyncRAT)", "value": "4275ae9179b217e2e10181162f5079d6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410382, "uuid": "9c14ca50-ede4-460a-8e83-cb29f2d659ad", "comment": "Malware payload (AsyncRAT)", "value": "a93d4ce1ba4c5b23ec22c6e8e6f147766bc5e5b9753c9c38ca6096ab81276e37", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410382, "uuid": "523df793-a10b-4f39-a8ab-42666a0aa8b4", "comment": "Malware payload (AsyncRAT)", "value": "915d2415d23987bc04a2e617cd8fcffdda7ab058", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410382, "uuid": "8fb40f90-3f7f-417c-a5f5-196b4e1eb20c", "comment": "Malware payload (AsyncRAT)", "value": "5321b515dd27b21149b253a12e591ad74aad692854a3f4702f83f5dbda7dc1bdbb7728eb9ebc9948d5390693f3ae12a1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410382, "uuid": "78b5817a-c293-494b-8d90-d23c99f502c9", "value": "T1F8231A143BE95226E2FE9F7999F22645C67AF6132502D74E1CC002CE4A23BC6DE127F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410382, "uuid": "1ef88abd-41b6-4d67-b3a0-cb719b82b646", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410382, "uuid": "bdb27055-e5e5-4bff-830d-db409e8ed033", "value": "768:zseY+fVg1ucvegh2f+Wenm51a5vXglTAeb17gUptwE3hrAK8RccRrWBNsF:viucv2fana1NRxbCU353hrvYc62sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410382, "uuid": "99815b8d-c870-4195-a029-b0a3ded14d26", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410382, "uuid": "6fa4528a-cb61-4149-a904-aff4ddf66275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410382, "uuid": "ab8ab8b9-13f0-45ea-9791-b1a83b064e56", "value": "gv3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ac6c6f-df48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766416384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416384, "uuid": "739c4cd8-076d-432a-a875-9347144856c9", "comment": "Malware payload (Mirai)", "value": "cf31c5133098b45257e9c0958256dc12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416384, "uuid": "475f3fda-5390-4035-ae16-1fb997b56275", "comment": "Malware payload (Mirai)", "value": "a9d1dcab5311381057e464fcb08efad0cabd21fd7b9ef3e1f520935869f1328d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416384, "uuid": "db9f0e9f-57b9-487a-8885-043477107a5a", "comment": "Malware payload (Mirai)", "value": "fc8af29e56fe8c1c7e61f1aa80e96faa5a8ee0f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416384, "uuid": "f36d737b-7f03-4e0b-b08e-811b0b9cd5aa", "comment": "Malware payload (Mirai)", "value": "55e496363fe25370511c76dc9c830108b07ea5648a5b59ae59d8ed7a86a19c02908149a669cbec3544c2de464ded3230", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416384, "uuid": "72d5c5d6-2d56-411a-b735-edbfb6a99ac3", "value": "T1A3334A21AE7A2E17C0D1B97A12F74724B2F6174E25A8C71E7C720E4EFF146C061676B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416384, "uuid": "8fbc6191-ac54-4e1c-908d-7452b3e9a205", "value": "768:BMUojWq94NZF7DldF88qLhJQ283NNohPRQRWO+FIuT/Y:BMUcWS4NZFnldF88qLv83sVRQR05A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766416384, "uuid": "e7ff6a23-3e8d-4f27-8244-bc8acd2dac7f", "value": 54584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766416384, "uuid": "088d71d7-d085-4734-a83d-329785bb19a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416384, "uuid": "9e6887e9-1dfb-49ef-9232-867dcbdb341c", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c23025-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388871, "uuid": "fa796baf-d0e6-4dce-a30d-774adedb98ba", "comment": "Malware payload (Mirai)", "value": "64f5df272bddb08117a50a8724c952b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388871, "uuid": "d14c9620-b7e5-461b-9512-d6b54d552f95", "comment": "Malware payload (Mirai)", "value": "aa36ed2ea2e12e93207874653910f2e5ca07f7f81e83477884e3186d9b837dc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388871, "uuid": "fdf63b82-16c0-4688-99fa-cd50d7ebc425", "comment": "Malware payload (Mirai)", "value": "459c35d39fb7a28f2a68b72ec89925496175dc9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388871, "uuid": "ac843f80-f1d3-4511-abb0-2e13979a4ca6", "comment": "Malware payload (Mirai)", "value": "63c922d804b2901327a4627c0cc353910938b23adac15b18c74c6804699f0ff37896dd2825d407cfde440fc77fb3258d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388871, "uuid": "d42d3829-2b1d-44f3-a695-8170dc1088e2", "value": "T196630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388871, "uuid": "5790407a-87ba-4a45-a506-709e97680ec6", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388871, "uuid": "a8115296-8cbf-4df0-a3e0-27c2d8294c4b", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388871, "uuid": "9db86a74-e97e-4914-b162-4ab8c7c86b89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388871, "uuid": "99cd755b-7901-4cd9-8369-b55f4c993398", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60e0624-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384681, "uuid": "dc82162a-835f-4ab0-9c68-a1537a757d06", "comment": "Malware payload (Mirai)", "value": "c230607f2f5d7203e0fc13aae401a02d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384681, "uuid": "0403c7a9-91dd-4dc8-b29c-1f1f2c039848", "comment": "Malware payload (Mirai)", "value": "aad44c2a818921b82814f5a4efbf3be91145d6d30848e2987f15ba1f355a909d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384681, "uuid": "96640960-27c2-44d6-b28b-817e91309867", "comment": "Malware payload (Mirai)", "value": "b6ac170b7781477723685336406e477237ed7a2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384681, "uuid": "c28329c5-6088-4823-a977-dc3d03f3eb3c", "comment": "Malware payload (Mirai)", "value": "d945f4359837b3d15d3b0c770589c87aea30d21f58d01db3b5e030b59975d9f4c1401db084ba65e211eb6ed791af9b19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384681, "uuid": "93f9b7a1-53f4-4b97-9cd2-1c9733820f39", "value": "T125333B96F7019D3DF99BEA7F84130A0AF53077950093073A63B6FD935D322949D26E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384681, "uuid": "fcef64bd-e760-402b-a175-501226f8dd06", "value": "1536:7X4jpIrTGptg5RClIJI1WQq5jBeqfq8w79:7X4jSIg5J45keqy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384681, "uuid": "549cd57a-516f-47dc-a54b-4fd9dd384b15", "value": 53152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384681, "uuid": "a398ad18-612f-41ff-9ea3-7bf2556adca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384681, "uuid": "a337038c-fb3a-4e53-94e5-eb18ef5fc924", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4875b9cf-df59-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1766423500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423500, "uuid": "7fda7e8f-e745-43bd-b0de-3256750c14c0", "comment": "Malware payload (ConnectWise)", "value": "fb2d350b89cdb60a65867e6192135240", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423500, "uuid": "9ce6601b-2977-4713-aba5-fb75ccf4c02f", "comment": "Malware payload (ConnectWise)", "value": "aad5b101688fcfe699431ac56114aa688eab5975c8d1cfa168bb139daaf5612e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423500, "uuid": "ab08e128-dd16-4254-bf07-11908b62e341", "comment": "Malware payload (ConnectWise)", "value": "d03106f1bb4e26a92247639d7846b7b4007a1b1c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423500, "uuid": "244b7785-7fda-4df7-98fb-b44b39010fc0", "comment": "Malware payload (ConnectWise)", "value": "f7f1af5615bf6968232bebf4815df680dab707f815f7ddb5d20d87f7134cfeb4517f62457e542fd4c80c1ce7d4cf9320", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423500, "uuid": "efa9f63c-fa5c-4388-a5e8-fffb58210488", "value": "T1E8A6231126E89134F6B31735FE3A56F55A3ABC25DD23C12F1268B91A2A73D808D72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423500, "uuid": "a3e1e48b-de1e-40ba-a5ec-a0af47d3f01f", "value": "196608:2suCcGaDp2mcYMDrsuCcGaDpPsuCcGaDpYsuCcGaDp:puGchMDQuGpuGAuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423500, "uuid": "c0c02f3a-b775-4669-b400-fff3c385d718", "value": 10059776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423500, "uuid": "5512ba34-ec23-4e74-b74b-4a010d93253e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423500, "uuid": "2ceb4789-a975-464f-a1b2-04fadec2d652", "value": "Adb_Update_1225.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f4cbf5-df91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766447845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447845, "uuid": "b2030e01-9327-4497-8d21-cd6f823b1327", "comment": "Malware payload", "value": "a906e8a502812386ff89d0cd7681ef76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447845, "uuid": "c6579899-011b-4193-bd25-ef6268782abb", "comment": "Malware payload", "value": "ab2c81b73c7d432e5e762fdb6f851890608ab5ddfefcd71ac98bfa8251d3b934", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447845, "uuid": "64703fdb-da57-49f4-844a-9e1438c5d47f", "comment": "Malware payload", "value": "c59d89e1b5ca79300928793c138e5d6188be5964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447845, "uuid": "d1a9f2f8-9c51-41b5-b7af-7f3f2b2c662f", "comment": "Malware payload", "value": "d2613e6e811702036f8485dc9cd8b6f3eb82238ae2e5d247488ed19dcc4ee0b5cfe7431bd5caba714390eb6a61089080", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447845, "uuid": "956b8619-4a93-4355-8d43-8fd14c3aaca8", "value": "T195732A86B8819626CAD5627BFA2F42DC332613A8D2EF7207DD156F107B8682F0D3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447845, "uuid": "78b836bb-14c5-49d8-b768-eea1f3692694", "value": "1536:Ly46Je7nkiM46TreNqGE3XsEGAV4JOD/KCJPiTAbVR:Ly3YLy3XsRAVVD/KCFiTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447845, "uuid": "81b5bd82-7ae8-46db-bc0d-296ee4bfc931", "value": 75028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447845, "uuid": "8bf16dc4-bc1f-4428-b607-6f3f9561a211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447845, "uuid": "5bd0935f-ce69-4bbb-b822-97af089a3cfe", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f862eb-defa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766382754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382754, "uuid": "f2048a53-92d0-45b7-b964-12c2781558df", "comment": "Malware payload (Mirai)", "value": "ae9d59f279825ac72faa73cdedb67b35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382754, "uuid": "afb3e7b8-af5e-44dd-9d02-a6e38fe54543", "comment": "Malware payload (Mirai)", "value": "ab4454e6726ed09e3045755d53d4168e30b74fb5c3f2fb82d472789b65059075", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382754, "uuid": "3bd372f9-6424-4895-89da-2b8ceee58475", "comment": "Malware payload (Mirai)", "value": "eff52fe8230b3f36bdcaa88de85eb406bc5a31a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766382754, "uuid": "8fbf96d8-4797-4eed-adc5-b5aa24a5e199", "comment": "Malware payload (Mirai)", "value": "a411388f1243fc1db746819d78187476c3b613955265e8c90dfe9e949799aa5aab41c5717190b4f5fc8bf4a75ba1b088", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382754, "uuid": "4213a382-ae78-453e-ada2-ea33a1895360", "value": "T12E438E26E41A9EA4C4464234B4548EF41F23F1C583632EB75FE282B25053DACF919FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382754, "uuid": "d2a61cf2-e16f-4660-9372-0e7bf15bdb74", "value": "768:laDooe4KY0eEbe1tQLrqo+UcfdatyRpM1S1bVBrHFynfkYC4otnqWCvCdsw64:laJm/UKNcfoqp7BMkYkttCvCdt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766382754, "uuid": "720cf559-6862-47b0-8131-40e9af91eb0e", "value": 59724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766382754, "uuid": "10340595-377e-437a-b3c0-561b328dc312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766382754, "uuid": "65299954-843d-4c36-8c7b-d0e2402911d4", "value": "frost.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79abaf9a-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387505, "uuid": "e7278d39-eb6a-4a3c-a514-416359a18607", "comment": "Malware payload (Mirai)", "value": "a15d0f7a45c51a3be1fdcb6da3957535", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387505, "uuid": "1bc96751-e310-4739-9d23-dde2266bc247", "comment": "Malware payload (Mirai)", "value": "ab5fcbe1582904ec992f759739a27c891933899f2b2d473ad1b81b3e306a7d4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387505, "uuid": "1b24ddab-c2c5-4b8a-bd60-c0fdff1193e6", "comment": "Malware payload (Mirai)", "value": "3aeff7c117a1736902531b50c658bbb37af87eda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387505, "uuid": "eb012d21-84ea-4dfa-b668-60677d1cb99c", "comment": "Malware payload (Mirai)", "value": "654910db4d01e1504e49b76653e657e32230b49acaee71dbb90281738929ab73b19191779ef4ff16c5c1a6b60c658bf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387505, "uuid": "3339e95c-7bd4-42c8-bb55-60e5efd4e21d", "value": "T1F9D35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387505, "uuid": "11e19a39-a1ac-4ac9-a8db-341f50ae6ef8", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQG:yIRfe3xvvSrlvZZ7UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387505, "uuid": "6cd6f45d-e1f9-4534-b46c-c8c6bbd69301", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387505, "uuid": "b3ad376a-7c67-45ee-a213-4373b900a228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387505, "uuid": "f206e8c1-a818-4c91-b623-ca0239639d0a", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357b27f0-df61-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766426905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766426905, "uuid": "ff2e00ae-2e6f-4463-a55a-cf5670d01fb5", "comment": "Malware payload", "value": "ae5d6b606331cf0cc5fb54e991a5c1d8", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766426905, "uuid": "74a7e9a7-f0ba-4a08-bdc4-aaf9d233b857", "comment": "Malware payload", "value": "ab6319681e94ab31624c7ffbe9f8d5b4abea88b737e5fd97e290a69b992665ae", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766426905, "uuid": "5a017e11-792f-4a50-a9fa-3c20f7490538", "comment": "Malware payload", "value": "de9741a2c9144b905f0d18b777d6237bb1424fbb", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766426905, "uuid": "c4a96c68-b0a8-4009-a685-0c870c949a1d", "comment": "Malware payload", "value": "99c4baef4ab44dd2fefe03bcdf67fc1cf4bd83972827aa5ed2c15b207630d8c12cd8e1fe94edfab539c9c3574ca5655b", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766426905, "uuid": "6fec9665-d3a1-4792-afde-97660b4759e3", "value": "T14504DEB0EB88687BFD811932702401174C9A2DB7B561CC28A8E7796F27A7F307CB5D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766426905, "uuid": "9ab5604f-f4a8-4ea7-8903-8442a64a7057", "value": "3072:AZVq3hodWXXeJVpKy5nCYptfFt4D5Wq5Cap7NDfBArRB5yySdFESDnGT:A/q3hocXXeJVbPuJfoJSdrDGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766426905, "uuid": "c8b17aab-c661-4712-bc66-26b720dc1b90", "value": 179197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766426905, "uuid": "90891b03-77da-4b14-939b-46790da15f79", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766426905, "uuid": "83d4b1ef-5c65-4e5a-a207-52072d5c7162", "value": "WSJ.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2371aba5-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370181, "uuid": "d01186e5-5450-47e2-82a8-0773ddcc01cf", "comment": "Malware payload (Mirai)", "value": "2fbcb5539e6cd5072a634b2546becba6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370181, "uuid": "995af288-e1d9-4eb7-82ef-b2fa00fd8213", "comment": "Malware payload (Mirai)", "value": "abd725c3be55d77e956a9c3142b298efbea952d30408d41c33c29d3083feb796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370181, "uuid": "a15fb0af-cfaa-4518-af32-7011508366ef", "comment": "Malware payload (Mirai)", "value": "3bf49598373644688c56cf13e26400e727fa09dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370181, "uuid": "c7a5b0ec-d746-4742-9c1d-f0057a5e0f6f", "comment": "Malware payload (Mirai)", "value": "8bbc167485790f81e16179113ea118cc5ce3afa32b188fa7983aa6e7f0305bdd559149c8963d8bc0909556d30b3c4b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370181, "uuid": "7151f87d-7df4-498b-95ae-88377e160087", "value": "T1E673C61AFF620FF7DC6BCD3745A8170239CC554A12A47B3A7534D828B65B24B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370181, "uuid": "c29c70d6-a7d3-4734-9d59-34651a2dd3a4", "value": "768:K3sJmkq/lhWHgJvd8p6Es5Des4ReDB2wJ2iwgugBI2ZpMIXi5Ij7+eOcIoJhwnhS:KcJmkC1D5B4RcBvC8W2ZpMe7+pcI3nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370181, "uuid": "c01fc2b2-df14-4c20-9613-ca8d953f4d9a", "value": 73796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370181, "uuid": "d262f104-e4b4-4e6d-aff7-6258193a0251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370181, "uuid": "311b0327-21ea-44ea-b2ed-2a3743c39ea0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744b6089-df70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766433452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433452, "uuid": "2e29a502-d189-4899-a5c5-6a2f01c71f57", "comment": "Malware payload", "value": "7e75558f3b54d3c1afb9b733343804a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433452, "uuid": "94653c91-365c-4f11-ad78-8f20e4bf6964", "comment": "Malware payload", "value": "ac0e730c3eb8bf780dd03dc7213cca4ed7c7cc07b0d36e3cd56e658ad1fcbb65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433452, "uuid": "955e01b5-2d4a-4cb2-a1ba-8d3f78292e86", "comment": "Malware payload", "value": "cf507c8f592fea7970d069780c68486975f5269e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433452, "uuid": "709a4d5b-353a-4268-b1eb-af9ccfd043a3", "comment": "Malware payload", "value": "26203172d8d4901d07ed2a55daa1df0b4765a939f7bfcb6b72d0eb332f661ea07b3adf414c5a61cf4f5994c53f87d7e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433452, "uuid": "6a12c70b-e63a-41ef-9be4-195e8c2ccad1", "value": "T10DB64C93FE9046A9C59FE239F8E2524973707845073121D7BAA027654E37BC8173BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433452, "uuid": "c0202f5b-6653-4455-a415-7d15c258a056", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433452, "uuid": "d0dd64bd-d589-4380-af25-14f709f0d7d9", "value": "49152:wneg/n72ENlENnWDDfzlVdSD31HbQ9eeJ1/D8h91YAXSx8HwCzst+sd6x05Ek0aE:weNhCJ1D00F0aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766433452, "uuid": "952672bb-00e8-4431-a255-a13393ebf95c", "value": 10429576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766433452, "uuid": "85196efc-318f-4a7c-a2c9-cd021f7883d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433452, "uuid": "e16e1741-85f9-4b40-8650-ed9c01a40d6e", "value": "Roblox25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66414d63-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387473, "uuid": "5a14e6e5-3bdb-4ad4-a5df-975c7942468a", "comment": "Malware payload (Mirai)", "value": "b5579f74e7e51bbd7c4a0c8f908d5a66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387473, "uuid": "3340d1bb-9509-49b4-a664-8daa72ed06ff", "comment": "Malware payload (Mirai)", "value": "acd519a388fba0fd364ca61cd9f5e937b6d704d3477f78430610667298cbe856", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387473, "uuid": "3b7a3718-0b7b-47a8-9c68-bdb2e106e874", "comment": "Malware payload (Mirai)", "value": "c3161d5c763c1c150287896bf8785e2237ce4200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387473, "uuid": "58d35f91-ca91-4ecd-a98a-8019c85e627d", "comment": "Malware payload (Mirai)", "value": "b119d8a66d54d314050c99f99132d1d4679dd24c42ae5bff47511c108f361fbcf621b8a5a08b8599913f1dc3ac3d613d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387473, "uuid": "9a6f51b8-da1c-415b-adc8-f2fef81c857b", "value": "T12FC3F194FA2B6A82D09301FD98D015C283506D72CFA24249126DF7783D3E9FB5FA4EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387473, "uuid": "ca5d6809-c63a-4f46-9d82-90f00c8d39a5", "value": "3072:b5QwOamStnvrTd5N1ilRWXST32tUTY/d7mHMMTnV:e5MvF5OWXK32N7mxTnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387473, "uuid": "345958fd-8156-41c9-97c3-375fced1d84c", "value": 123768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387473, "uuid": "faa61631-adff-4179-bb5f-9b5e51f2fc3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387473, "uuid": "7ace5121-f0f2-43b7-93a4-6ad8436439a5", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ca1ca8-def7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766381541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381541, "uuid": "be9b3733-18c5-4e7d-8528-79395a0e1837", "comment": "Malware payload (Mirai)", "value": "fc7af10f3724c596bd6d52d7eca1919c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381541, "uuid": "9288becc-f41a-4976-994d-380f1d653165", "comment": "Malware payload (Mirai)", "value": "ad2c9c99d34a5d634847a3a8560e78ac4425942b6e237a0b38a789cda6c90f45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381541, "uuid": "26cf9645-a219-4f89-b6c0-3856b2ea6853", "comment": "Malware payload (Mirai)", "value": "96407378984036b814831c249e897c111c3cab6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381541, "uuid": "09acab15-b405-4bce-bd05-2e98a937a0f4", "comment": "Malware payload (Mirai)", "value": "6d8fe3fc510ee9363b673de7beac8525ce04187ce30858fd8de08177e6706e9878cda40c3b8c364c8d3184e94170d5f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381541, "uuid": "da8a606e-4479-4562-997a-e78385cf56bc", "value": "T12C73F845F8818B12C5D512BAF92E118E332667F8E3DFB2129D205F643BCA82B0E77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381541, "uuid": "94593829-fa11-46b7-af06-2dc9de59d677", "value": "1536:9WnRPGrFu8GwuC1YWApkLGFNiswBRrk5n1Qz/Ili/Fruvd7J6:gIF7Gg1HOW8dSRrk58luvd7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766381541, "uuid": "9c690f9d-c725-4534-a5fb-f84555846eb4", "value": 76480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766381541, "uuid": "9340d8d8-98fb-419a-a211-49ae38633ab5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381541, "uuid": "6104f3f3-ff22-4664-ad09-e5b61e624b07", "value": "frost.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad11334-df0d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766390997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390997, "uuid": "276c64c9-94ee-4c6d-a17f-fbf494b0f06d", "comment": "Malware payload (Mirai)", "value": "52ed53c824d6414e727ab6f3340c61c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390997, "uuid": "07e05872-5614-4664-9e0f-4694adaa24b3", "comment": "Malware payload (Mirai)", "value": "adbbe9fff1c2e36174fc27bc1f6e5dcdb8338fc59e86b75a85857e444600e8d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390997, "uuid": "a9784858-e15b-4d66-9588-c655dcdf1366", "comment": "Malware payload (Mirai)", "value": "bd4ae48a6be79b7436882ff87ba48c83a54ba10e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390997, "uuid": "6974ed37-5260-4130-81b6-94c72f3c8979", "comment": "Malware payload (Mirai)", "value": "117ab01f91b1b07269a92361d748205b6a28f2ae48d5556440393fb8a72c2e7c9919b740f0c157a429854fb6b03bd745", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390997, "uuid": "a0e657f2-d4f6-4412-9b96-a1ddba21798e", "value": "T14AD33A56B9919F01D4C335FAFA9E414933136FF8D3FA71019D20AF61238A99B0F7A612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390997, "uuid": "9431c232-8952-46ed-ac67-d3e0c2a5f2ac", "value": "3072:/v4QOkmbgWtnFaAPa0RlTQxHCN/9zYaIZVh+:/v4QO1VFaAPa0RlUxHcz9IZVh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766390997, "uuid": "7025a0a3-85cf-4d78-a9f6-a5e0cb955020", "value": 131880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766390997, "uuid": "8b3042a7-190d-4859-9250-48512df58448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390997, "uuid": "75e2f21d-2ea2-4ab8-916d-ff649a9baa86", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba53492-df0c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766390596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390596, "uuid": "9ce3bc65-f155-4955-a12e-55bd771e8266", "comment": "Malware payload", "value": "21730c9bda088606993edb402ad6f3c1", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390596, "uuid": "4e277c42-bc3d-4ab1-8478-bf4fbd2f3e77", "comment": "Malware payload", "value": "adf6e9d355260999f6d9f13f6f612be2af4f0a8bb938fcb059edd9390b5e038e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390596, "uuid": "ae83ff1e-bd73-4c38-b717-a6ee52b670cb", "comment": "Malware payload", "value": "b271e824e9320dfca695bc057ebfcee18ea2a833", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390596, "uuid": "32ffd004-5e95-4cc6-89ab-d44649cc0852", "comment": "Malware payload", "value": "b7184c7f83c72a434d8c367ab2cba0de1ef406125d2c88840327e3e88a6bb6abd6c74c50101bb9cba2a8385033756e23", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390596, "uuid": "624db20c-1269-4899-a162-d0324fdd646f", "value": "T1BD617C090D8023CFFE54BD1AC0E233BE045C8C222FCEDBA01070654B9767BEB522A4D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390596, "uuid": "a6c2c316-5ffe-409b-a2a6-74036a336289", "value": "96:ZSVD8ueLZ3xZuIYbQcCNT2L2R9NKRO6tG:S/u4iT2LkKfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766390596, "uuid": "3c809429-01d4-453b-90bf-a65907a8454a", "value": 3238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766390596, "uuid": "d12bc4f6-9764-40bd-8347-6434ff4100a0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390596, "uuid": "17a11454-e12f-4aee-be30-5bbf09cc54aa", "value": "4_15_1_1675_22.12.2025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e470d58-deca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766362012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362012, "uuid": "e82c0034-01d8-4d98-9367-dfb9931de8a0", "comment": "Malware payload (Mirai)", "value": "afb558fa64165e532674e3dbf5e64a26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362012, "uuid": "5538b1c7-c459-4d1d-9d38-c681fdd8d2b0", "comment": "Malware payload (Mirai)", "value": "ae2be05352200ff5d9993c54056951934e3c96b61284f56eac05fcd89e640a29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362012, "uuid": "d5e25415-e6a4-4f0e-89a5-ef465fb898fe", "comment": "Malware payload (Mirai)", "value": "8ece3956e95db12a1984bf38bafa6a3bbce00ec1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362012, "uuid": "d63a2270-e679-43d3-8d94-4c78d82a6b09", "comment": "Malware payload (Mirai)", "value": "cb760f1d7ebb7aebf24e4eecdd2defb43c70966cbe3ead8867ddcf7f531e8f0c285906cf587ff766f5e90d0ea63fcc9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362012, "uuid": "bef3ce18-c1b5-4c0b-a395-843804c3323b", "value": "T13083F69AF9819F51D5D562BAFF0F518C331347ACE3EE72039D246B24278A92B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362012, "uuid": "106bfc34-0d02-41c1-b588-9055648ce7d1", "value": "1536:GNnIraLq7qnQVLD1+s/AL2uFSyk7n3/lC13NMNlWsoirxf23j/7q4ZiYm4HT2bVi:RraO5VLD1+gAL2cBk7n3/lCdstxfO7qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766362012, "uuid": "ed390535-4ea5-4037-827e-764f79d4de86", "value": 84028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766362012, "uuid": "c9287ce1-f25b-43b5-a9b4-ef0062ea8609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362012, "uuid": "cbb588b3-2a2e-46f0-98dc-3ba55da38363", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340a887f-deda-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766368920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368920, "uuid": "4fc4b170-75cf-4961-a4a3-bb0e9d42ee69", "comment": "Malware payload (Mirai)", "value": "8e55e9f2de439571b159b28b63dba79f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368920, "uuid": "a2a8ab74-55da-49d6-bfeb-cb2c9138c5fc", "comment": "Malware payload (Mirai)", "value": "af5c75b11bdb46a35a412d9b5aa10c81cdbe758842bd6e272bf268bacd7c2343", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368920, "uuid": "54ecbff8-5f06-4e07-bda3-48b9da55d90a", "comment": "Malware payload (Mirai)", "value": "14131e98bb910d33c03e8b559855a4ef2c2fb207", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368920, "uuid": "700e323d-2e21-49c4-89f3-78aafef5e8f0", "comment": "Malware payload (Mirai)", "value": "a7e01e50ad97dba9f5a84d443be3a74597718b1bb9de8ad71eb065cbb84ac81cd444cefd6b1bd2740c524a8491117c8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368920, "uuid": "8135b7ff-dd6a-417f-bfb0-ab746dbba321", "value": "T1EED3E75E7E314F6EF2A8863447B38F35E75823C623E1D681E66CE5141E6038D581FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368920, "uuid": "70df1ee5-9d72-4f3c-87b9-b579b555cdb6", "value": "1536:epgcoDRUw/WgXzdeUUrQyF0ABXpYvOrH+ZMVIQBeb7Q5enumCULD4em64GN:3DRUoWgheUUtF0ABX26+yyQBS7QmLX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766368920, "uuid": "e99a6ba7-4846-401c-8e8f-af38afb8509a", "value": 131228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766368920, "uuid": "1b8d5c37-0615-4c74-a1d1-4b79dbdc23c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368920, "uuid": "21b7edfa-c155-4cc9-aac2-9a7c670c5aa9", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7759cf4d-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424868, "uuid": "c4bccf29-4518-429f-9f4d-971557d06aff", "comment": "Malware payload (Mirai)", "value": "7942713421c49556ac7ca61e341329d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424868, "uuid": "8eb15770-b756-4834-acd0-65837bef7adc", "comment": "Malware payload (Mirai)", "value": "af6a7982a9dee07ce221aa4af1978dc71ac3c20ed9baa18a40adafa13752b30e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424868, "uuid": "cb221f92-b062-47c9-9f39-0368d4a32b33", "comment": "Malware payload (Mirai)", "value": "b9786d5fa81b9a753732e49fa7a6284c9aa9c653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424868, "uuid": "250c7b0f-678e-4d1a-baf4-a3ce30bcf58e", "comment": "Malware payload (Mirai)", "value": "b71daa2513a866b4a0f384e72e8f7229885f9e240eebf7dbd65023508964683f9b4113c1d1a754b3b264f66672f3d429", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424868, "uuid": "f9bbdbc9-e537-4729-8cb7-d8fbb91d326a", "value": "T199E309C7F800DDFAF80AE73748530906B130B7A249925B373257756BED3A1990577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424868, "uuid": "4df301dd-5bd0-4799-a710-925351f8051e", "value": "3072:iIAyltT5ns9R1IWT7kn1P2OHO6jB1tLVEjbiULYTjQuylEfg:i6ksWfkn1P2QV1tkLYT7ylug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424868, "uuid": "d6ec0995-8f31-4440-b973-1e0d405a6d2a", "value": 150860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424868, "uuid": "008360ed-8f0e-4847-832f-7dc6ca8c543b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424868, "uuid": "b9fbbfef-21d5-43e3-bb33-5244a48853dd", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dc4d89-df0e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766391361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391361, "uuid": "f55b05bf-4578-47dc-bbb8-6278ee00b0d4", "comment": "Malware payload (Mirai)", "value": "36eb35df01314aa12d6684d559c5321d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391361, "uuid": "1d3a61ea-106e-4385-9b65-dda3cc079dc4", "comment": "Malware payload (Mirai)", "value": "af7d7cf72234fda83fef3034dfc823c35cc03a8a2d20f363ea4860c9ce1a08e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391361, "uuid": "2182dcb1-54f2-4e28-bb14-ae7eb1b5d884", "comment": "Malware payload (Mirai)", "value": "70fa6d461c2f078ca31921b69f26d721d0c4d6e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391361, "uuid": "6aad647c-bcda-4415-b126-01b64ea57299", "comment": "Malware payload (Mirai)", "value": "557ebaceffdaab4fd53c8f650fe3a2f72fd93d5e57cf6c3969bbfb1d9f2c9e743849e9e2c0c712a4f74dbaedc52aefd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391361, "uuid": "259f13c9-d0de-4b58-8e55-7d347650c0c2", "value": "T177E3530EAD219F3FF22CC33647F7C664A36527D723E3E24AD25CD5241E5838A581AB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391361, "uuid": "025eef15-6ae9-4ea6-b915-7e91ef011370", "value": "3072:I5KeImSFmcLbaqWZ2RmKdkAf383PqCVS+hVFyDv:UKeImSRnaqW2bMPqg8Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766391361, "uuid": "2655e7a0-1196-486a-989b-1c223dbb6bde", "value": 143852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766391361, "uuid": "910eadba-6448-4d8b-a8a4-3898115afc74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391361, "uuid": "46fbdc10-d68d-42fd-90c9-1c5922e95474", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac810e3-df0f-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766391829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391829, "uuid": "ed950a04-9895-4587-bce9-81dabe4886b6", "comment": "Malware payload (QuasarRAT)", "value": "fb4bc0f012774a861009689dc3ac709d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391829, "uuid": "453c6148-8883-4796-a4f7-2794ef14a42d", "comment": "Malware payload (QuasarRAT)", "value": "b0455309a1405bee110cf310c555a615dea5644c96812770c80afde298e9d066", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391829, "uuid": "a9b28c3e-1129-49df-abdc-d1c252d8736c", "comment": "Malware payload (QuasarRAT)", "value": "b21043185dfd8d23a995ffbd81ccfb5f2b10c083", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766391829, "uuid": "73bfc8d7-3fb0-4418-956e-03af47b37a3d", "comment": "Malware payload (QuasarRAT)", "value": "761f40bf8cbb7d060f2e00eb4f0f13ac79d9aa033fc3947475935a66dac9635593f9707fc3d94169b5c6592d1b0d8231", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391829, "uuid": "d3cf8478-7a97-4897-87a3-a359bde178b6", "value": "T11F9633269FAE4E6F4A7C619C346F0E4E31B84D804085ACE977D2BCDF648FF24152B169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391829, "uuid": "3d06c4c0-67f7-45e3-855c-6b35e3792361", "value": "49152:cq3aHsFQjvSp4U7mVbxLUX74SuLbXB/v6d3iuaIhhPF0hUpXuYFOnZWWCIZGHQgn:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766391829, "uuid": "978303bd-f3dd-437b-b8e6-3ce18218243a", "value": 8674610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766391829, "uuid": "88a429ca-e937-4136-9921-4f4218f61dae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766391829, "uuid": "77d5160c-8169-4117-8eb6-a9e754e8672f", "value": "Windows330.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b807111d-df25-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766401354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766401354, "uuid": "0376ec0d-ffe0-426d-ab61-e4efa454c215", "comment": "Malware payload", "value": "77e20c09d58da572e7d2ac213ca95f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766401354, "uuid": "38d77fae-7e32-4510-a996-cc88d76b29e2", "comment": "Malware payload", "value": "b0b92ed73b4e9254a4e0d353c09305f7f27def9d3a86d70001b17482f7317ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766401354, "uuid": "b15081c6-4bf9-4748-909f-6aa4e01ba486", "comment": "Malware payload", "value": "6d40af31dbbd925c3b3fb3f4a6d4f7f02401cef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766401354, "uuid": "3e6286c5-6be2-4561-88b2-2222062d0e92", "comment": "Malware payload", "value": "752a02075d5449134b9bc050d4c80a60b5fa1e26001844226e8da0b8cf41aa0bc82b9439523b753143ee68fb8447f4d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766401354, "uuid": "58076604-dc22-4c7b-85c7-e3b137b59fc7", "value": "T147173325AD824833C52E653C69A662D1583AFD203F1CBD8727D83B59067F680C7EA377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766401354, "uuid": "696c5219-5ded-485d-ad6c-4ba958bf306f", "value": "1418e44b536f42ef5db8fd35c961985c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766401354, "uuid": "5056efda-35db-46e1-a8e6-4365bbce5d20", "value": "393216:bKQ9OkYK95oSrcPoYfrips62fK6K8QsGAkT/p6xg/okINGg8S00HlKYXDa1mB0ZN:tO+oSAPoM2sJK6K91fLs57plKYz9eZYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766401354, "uuid": "45dd19aa-d173-4341-bf59-601b2a5beb91", "value": 18810145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766401354, "uuid": "f332596b-bce5-4b1e-be24-41f7a64080e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766401354, "uuid": "ebc3db03-2338-498f-91a4-3eb21bd76202", "value": "wechathelper1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60952551-dee7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766374578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766374578, "uuid": "e2ceb2bb-2d8a-4d30-bbe1-ca17fa2895c5", "comment": "Malware payload (SalatStealer)", "value": "66cb27467c1760c8ed03bae9458387fd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766374578, "uuid": "d8f5e961-650b-42a9-ac6c-bade372f1791", "comment": "Malware payload (SalatStealer)", "value": "b126954176fc1d67a1744f17999a628be85094787936f7a72489169156d6606d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766374578, "uuid": "1e941ffb-9363-4fe4-a7f3-ba4f86186ad7", "comment": "Malware payload (SalatStealer)", "value": "8f51addbae499a6fe38c363566e69736b994000d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766374578, "uuid": "22fe2798-a878-4ee8-9e65-f68e2ec29a7e", "comment": "Malware payload (SalatStealer)", "value": "4d3282d90d789b39429bd2abb45ae0da178f1f9e614f8ce7e44211729605b863ccc1c1091c9eff601cceeb37bd2a7863", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766374578, "uuid": "deb654a5-480c-4af4-aef0-a490885c1770", "value": "T1DAE5337C72410F5BD980AFB4B14DB682FFFA7466AE44E05DEDA2140265668C4E3E8FC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766374578, "uuid": "20c49620-4e5a-4408-b21d-2b5a13f37942", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766374578, "uuid": "67a74b1d-ab34-4756-ba08-d39b825f1aa5", "value": "98304:5zoKkMlP+r4nmIHHzU1+su68xGpACfWgv0AJH:5EtMlPU4nmGHz2+su6rpACOgv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766374578, "uuid": "0ab70ad7-ef1c-4e51-89ec-dc8647108046", "value": 3290112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766374578, "uuid": "1501c159-0f55-435d-8bc0-68979a9943ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766374578, "uuid": "47882f96-bc67-4872-94f7-3dd56955369c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb220335-deca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766362302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362302, "uuid": "de92e248-e390-49a9-9552-b77920e385b8", "comment": "Malware payload (Mirai)", "value": "842f349991b426d7e5bab8c107b93a5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362302, "uuid": "820b8f65-59f4-47c2-8e9f-4e897a11d167", "comment": "Malware payload (Mirai)", "value": "b1af0b244ddf47023ad34f14b6ccef5def7ca48d9e027e25db2067234334c7ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362302, "uuid": "0832af95-89ae-468d-85bc-0fadfd931625", "comment": "Malware payload (Mirai)", "value": "157a498a4f5dc45962a95d054525b29d44975e81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362302, "uuid": "115696c0-fb2e-4db0-a4aa-0c65b06fcf5f", "comment": "Malware payload (Mirai)", "value": "7083abb569ee04bd6ca7c4d5cf3d757d0e6ab72aa9ab8d83d5feb545cc62258750496de7cd737233e7caf832e049d79e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362302, "uuid": "8566e363-7a69-40d5-9fea-9008e49853d6", "value": "T1A5639D3AD86A9D94C85C52B5B8B1CB391713600087A22FF799DACA714043DACF69C7FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362302, "uuid": "0da6e1f6-9e3b-412e-ad08-b810851cd04e", "value": "1536:XrSJsob2DG2T1JWUwKjUE0mjCgI8mdMTAbVRy:XRoaikORE0mjR/QMTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766362302, "uuid": "265c34c7-3053-4609-b8fd-50ba77bddf34", "value": 67836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766362302, "uuid": "57c37995-a52f-430c-bd8f-52be37c4520b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362302, "uuid": "6fb501cd-8087-4e92-aab8-029a3d2c3a9a", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25e5384-dedf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766371387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371387, "uuid": "55085d7b-c9d5-4b8f-8428-129237c024cc", "comment": "Malware payload (AsyncRAT)", "value": "e424fe7df2b636eb2786734aa7f55b3b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371387, "uuid": "a8a6bca6-67ac-44c5-b31a-bebf04d7d5ea", "comment": "Malware payload (AsyncRAT)", "value": "b3459155ff51e85ae2f35ddeb028a0e3566eef06a80ee6e25c05d9864a62bb9f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371387, "uuid": "d98253a7-a03d-475a-a852-6c63aa864c60", "comment": "Malware payload (AsyncRAT)", "value": "b66c527f39517c33f00232766472851165c9ae50", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371387, "uuid": "daa54091-5a2c-43b5-893a-0d388cbc2381", "comment": "Malware payload (AsyncRAT)", "value": "9d0b45c384680357c147b9aa392535223c9c00585fbe2218668e6bf53b532bd5fc250598c5af97beb0556f03d18eb4c9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371387, "uuid": "f6e7cd77-9b23-4425-9cf0-4f6fe500b1d8", "value": "T14A034901BBE4C277E7AC0B789473430846B8D9976613FB8A5CC854FB2A17BC997017DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371387, "uuid": "66ae1b77-1318-4cbd-8817-e17d07d0486a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371387, "uuid": "421654fb-c1ed-43dc-8682-599f7db72b6a", "value": "768:/Xaug0LrCc4d7VtOjkR2e/XgNhRwauQdumXHUituoRnXUWu+:fafSuVtOyfgTRw3Q2Wu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766371387, "uuid": "3ba93771-c496-4f17-bf50-0ecc1e1c4ba9", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766371387, "uuid": "86a64284-8413-4611-b2bc-e246d1159d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371387, "uuid": "0bb8388a-13f8-453f-8f8b-0a6d4c23a20b", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2164e1-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387509, "uuid": "8fcc049c-d81e-4aed-9f8e-8ab46f77f83d", "comment": "Malware payload (Mirai)", "value": "d81736847b5ab49f70c77734b0ef6e9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387509, "uuid": "b6f7096f-4c9f-4560-8818-1a4d923a810b", "comment": "Malware payload (Mirai)", "value": "b4b836359fc366f812800c2b667b9871544ce0e57554164e9e6e0a5c8fc181d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387509, "uuid": "6a0c1103-09ae-488a-9624-4c290d318e84", "comment": "Malware payload (Mirai)", "value": "5fa6fa1322175be8772db64528e2e418212420ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387509, "uuid": "15236d3b-9838-4fc3-9c35-ed50cde46929", "comment": "Malware payload (Mirai)", "value": "8566bee818363bccd4dc7a6b8704a3b51de805270bfcb9e7952d4ddcbd751fe61e3b68d7e1838d8237a9eeabe4299b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387509, "uuid": "6524adbe-9cc3-4d8b-b945-d683320d8bcf", "value": "T121148CA8FE4FA8D1C2C7E37DED4A0FE275177874D655C0B21A00929FD5EAED88890613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387509, "uuid": "9dd6c5ba-db43-492a-9845-fe72250ef2a3", "value": "3072:y8/0ONHIiUTRpBydTBp+ogzPeOK3+N6tNIzPx2:LPNwpBydlpRwKCzb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387509, "uuid": "ef910abe-1711-4920-8590-f324aeec4adc", "value": 197584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387509, "uuid": "c71b1552-ef2d-40ed-a97e-d778d7875f0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387509, "uuid": "7f1fe134-207f-43bc-af1e-8e370726094e", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbf2780-df75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766435747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435747, "uuid": "537174e4-37da-4711-8c15-454712a0df9e", "comment": "Malware payload (Mirai)", "value": "c846cacc0f337c75d49743f36694031f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435747, "uuid": "721ae06d-6a5f-45e9-936a-cd3302e58c65", "comment": "Malware payload (Mirai)", "value": "b51e2b8cc37507cdc80228f3c70990cdc2df71a85cc232c30a493b46bd38de61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435747, "uuid": "c12ff654-894c-49a1-b767-1bbe9ead8a37", "comment": "Malware payload (Mirai)", "value": "ec7eba4c0396ab10fba2cb5eb20d26992d8a86f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435747, "uuid": "1c4d85ae-7e6a-4262-95f9-e6ceb1d589ec", "comment": "Malware payload (Mirai)", "value": "43a0f1ace8bb41343630e076082511b670c273f6aee8bfbb5c30082dbb93d274bc8fbe54b2f7201c9eb54a8f4b226b75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435747, "uuid": "7ff98ce4-9401-48c3-a601-7850e0658240", "value": "T157936C87A952E4F2F8121036573BD3619A33F2342062DD4BEBA91B75ECA1710DF0A79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435747, "uuid": "7903653b-ee45-4a44-9595-fc3b9e92eda1", "value": "1536:aBHCEs3JCIqK7D1ILP0WwkpClTWoa6pe8fBfEYCB/4IEGkk6D5D8x88QaRP9SDg:PAITGL8nkp0KcP5ybkXD5s83g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435747, "uuid": "df472da4-b8bd-4edc-b5b1-aa640081e2ce", "value": 91504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435747, "uuid": "b06ea23b-e1bc-4f84-a188-6b636ff920e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435747, "uuid": "520e16aa-dd60-47c8-a517-0c8bddd665a8", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d24936-df48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766416382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416382, "uuid": "453a43f2-df53-49c2-b67e-62675cee9547", "comment": "Malware payload (Mirai)", "value": "eb7ce2d29619716e3c3798b269109da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416382, "uuid": "7ea46c9e-932e-4264-b460-64ed21b395d9", "comment": "Malware payload (Mirai)", "value": "b55491c69dad6bdf40e0b9b0b0264baf2d9d0c9a8f45936fe44d94e1b9a7cb91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416382, "uuid": "7fc967fd-4589-4200-a5dc-0e1fb5ff676c", "comment": "Malware payload (Mirai)", "value": "b39005d56c0244a687228011e42de8d748948112", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766416382, "uuid": "ef09e21c-f626-4205-970e-637586e904ea", "comment": "Malware payload (Mirai)", "value": "fb6f2d5bce687864d0a34215193a07d32eda5bc33a1cf67e625f170354775552dd6c3a5d8a4ebce61d4d082b78d8b239", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416382, "uuid": "a724b605-a91b-4736-8299-7975c5fe7d1e", "value": "T1323319B41516F2BCE9E22078F40720F529920A1C3ADDE2D3B0930575FFB5B4CB96AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416382, "uuid": "197f452d-afc5-4092-9bd0-5f4d5d35dfa2", "value": "768:TxVhMqBAy5Juan3mEAqPQi1NtoFAkwrJ5Tw8W6wOmj:TzAxaWE1FDtoFARro8W6Fmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766416382, "uuid": "d3fbcb8d-6eb8-4773-abe4-999cae8aa545", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766416382, "uuid": "9993e564-8613-482d-ad50-68f49dabd854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766416382, "uuid": "69d4eef0-f91e-4a58-8f8a-71f8e2f19cca", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6105f2f4-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387464, "uuid": "ba69eb8f-2911-4b10-a535-44f0d7d20b12", "comment": "Malware payload (Mirai)", "value": "95ec619ce0fcd8c2cf3e8b6716a07580", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387464, "uuid": "e9734395-0347-4c29-8dd5-1bce77c49f91", "comment": "Malware payload (Mirai)", "value": "ba3287ed9914220cf4fcf4dd493c67292c4d1095d9ead5359bc3f38666335b1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387464, "uuid": "9f04f0a5-2453-43de-9f36-3f7003c49862", "comment": "Malware payload (Mirai)", "value": "5a8b007ac1c2887da424aec18cbe1c1f9d476ddd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387464, "uuid": "c2e7a5ba-7701-49b0-9241-6336e13a871c", "comment": "Malware payload (Mirai)", "value": "95e5db28f548b1f7b9b55aa2dc416e979ce5e551debb44b71045d454b5c3fe650d3063688407c3b79fd14bfd26ccd4b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387464, "uuid": "4a1e842e-e252-438e-ae35-34e3fbb3aeb2", "value": "T19F63128BFFDC1FACFCDA17F906AB668E1360542084B641A80DE14986C19FA7111DE8CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387464, "uuid": "22c3c1e8-7adf-49eb-b789-59f5d8e1ea5b", "value": "1536:Jr7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgtPEwrPV:J7Mbp2L+Xqdfoz2sOvrPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387464, "uuid": "dcbfd83a-291e-4892-8d8d-60c8fba81036", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387464, "uuid": "ba40f9bc-98f4-4077-88e9-5ada1336ac5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387464, "uuid": "cb71bafc-3fef-48a8-87f6-e51b9ee54585", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463d280f-df81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766440677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440677, "uuid": "3efc0ef3-2c5a-4324-902d-2776fe4fcd14", "comment": "Malware payload (Mirai)", "value": "d34de5e95762e4425b87741f55ff2eb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440677, "uuid": "270b0b28-d831-4abb-a1e8-3fe20c5ef5f4", "comment": "Malware payload (Mirai)", "value": "bb53c80e89c03c910ee91eaa9a6a69b7834b835ee05c290cad9c86af29a821a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440677, "uuid": "d639d06f-bfb8-42f5-ba79-e86b41a84c97", "comment": "Malware payload (Mirai)", "value": "c2b2136eb8e5f69ee800447162c68ec266097339", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440677, "uuid": "e9d9aa35-922b-45b8-bac5-856474991d7f", "comment": "Malware payload (Mirai)", "value": "46a5a454044b7dcea1c12ee96db0548a82843d54b2848249c6f47ac3b82a630a0992e1dd05cb78af9bff13ee0eac466c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440677, "uuid": "e90ba0be-47e1-4607-8302-b0f6be62a458", "value": "T1C9A30886FD819B21D5D522BEFE1E518D331357B8E3EE7212DD206B25378A82B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440677, "uuid": "07a5a94d-2450-4ba7-8687-54a02514927a", "value": "3072:UCGY1QTu7VpT9eQSnISBJyCpAvF7ExxSqT2l:UCT1QEeQ+ISBJyC6vF7uxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766440677, "uuid": "5a216bb7-fe14-4ffc-89a5-8c2be9cafc02", "value": 105120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766440677, "uuid": "921b9a70-818a-4fb3-829f-0ba13df66b8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440677, "uuid": "05a5a82c-8f3d-451c-83c6-1268a8e63288", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8d76bb-df10-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766392079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392079, "uuid": "e0f311f3-a214-4dd7-8c40-d08e5dafbc96", "comment": "Malware payload (Mirai)", "value": "90ac62fcbd390fea69becba296892a52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392079, "uuid": "de6b7066-39b3-4d03-bd68-649223e537dc", "comment": "Malware payload (Mirai)", "value": "bbb67b5361c5abd6ac16953cb8947448c9b3df5386effa20da4ccf8adc36634a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392079, "uuid": "0dd5b768-4cc3-4c67-b7ae-7a729404d5ce", "comment": "Malware payload (Mirai)", "value": "84a01f79a24ed496026be4c59fc8c6dda4733710", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392079, "uuid": "ad7197d8-1c13-45ba-8c96-f95e0fa4e032", "comment": "Malware payload (Mirai)", "value": "aa231008c7bc2a1d173e4cb356aad10b8aa82e2d7eb4fcff852fb64299701c7101c2ea64c7eda6b5680eefacb42afe2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392079, "uuid": "170d7fbd-424a-4b23-acc9-05214fd2c7af", "value": "T152A34B56BD92DA12CAC06277FB1D428D371713F8D2EB33039E256F71368A91A0E7B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392079, "uuid": "261fc842-73c8-4148-92b1-60c0ca5e06ce", "value": "1536:U1nKWHmWlSTpkENpFHIFKJ/Fb46udHFE2gJn/dOURf/drH0MYnXEjNxyeml:CnKWHNsbHIFAFbju1S2gZRUM8gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766392079, "uuid": "f088adfb-54a6-4695-b3ec-2c69a7135953", "value": 99640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766392079, "uuid": "f0a628ac-db93-44f4-9616-4132cfd114c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392079, "uuid": "87834eb9-7b75-4c04-be2e-afd3a9f086b9", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898bc288-df77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766436495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436495, "uuid": "b6baf81b-36d7-4053-9629-4db1457664a4", "comment": "Malware payload (Mirai)", "value": "1101e43185a18662c8a3994d9b9c13e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436495, "uuid": "66619cd6-77f6-4549-ba41-90c49ccdb778", "comment": "Malware payload (Mirai)", "value": "bc8d6569cc5afcb397cf3b0c4f138223a5d3d1f60ef9fda7abe86b34ed217cfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436495, "uuid": "7c7aadbf-4148-42df-9fb4-a84ac0a2c035", "comment": "Malware payload (Mirai)", "value": "a2d4a451baee501d479186c58af9b2a94fad1a3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436495, "uuid": "5098c1b8-7c00-4fc9-9d23-bb2bc3ce4bc0", "comment": "Malware payload (Mirai)", "value": "a7bb5183b73f64c2dda59474c273a1a5bd7fc4bfd222180bac91f5e2407feed9aae33ed70371fc9b7a8ec33a1e78c0b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436495, "uuid": "99daa850-d424-437f-8d1a-dc1dcbd5eb57", "value": "T12DD3AED7734B1910C46202F01BD78B9E3F6362158E4BD8FB2D0EA67E28755CB194A7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436495, "uuid": "aad36618-5c12-4110-a035-85ba9354da49", "value": "1536:uPaCA+qvlMId10KXzQuO9j+W3QjNpvFApliktQixmMjgv4Sny/LWt:sA+qGGbXzQ5962ANpvuJtQGgvnyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766436495, "uuid": "c1a3c61d-2fd9-44ca-acba-a98124e4fae1", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766436495, "uuid": "cea714a5-ef60-4680-9407-12a00ef9a1bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436495, "uuid": "40839e43-cbb0-485d-8f93-7324eb32c996", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0dd0e3-df59-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1766423456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423456, "uuid": "4294d90e-ae36-45a4-be9a-761b383a1d43", "comment": "Malware payload (ConnectWise)", "value": "765b27103744f577e86d72c2fedb32c2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423456, "uuid": "32be3e08-d8c2-497f-a7c5-514ea9766a19", "comment": "Malware payload (ConnectWise)", "value": "bd1bff66aece33d9f32f4f0792883a3b90f10b746baa8007e78ee33c313ed1d4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423456, "uuid": "1e6612a4-9138-48f1-ad6c-654fcad66482", "comment": "Malware payload (ConnectWise)", "value": "32458253edeee456cb79a6f06307ab4d0674a9a3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423456, "uuid": "f0a41d2c-1100-4744-bc89-240e6fc4725b", "comment": "Malware payload (ConnectWise)", "value": "58d319cdedba82e0d29543d27766af3ecb1a9c5f9a472589db60c31bbc05cf1b7dfb53af50df1117ee71635f66b2a4d0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423456, "uuid": "ed548d7f-0b4b-442c-8364-43f3996b7120", "value": "T12CA6233662E4C026E2B71E39E9794AF25939BC468913C15F533C794E6871E81E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423456, "uuid": "b37e2126-62ab-4c70-b6cf-e1ec2fc203be", "value": "196608:r+kLGB18+Z3/P+kLGB13+kLGB1m+kLGB1:KkqBu7kqB4kqBlkqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423456, "uuid": "50aa0169-0a04-4f05-923f-21e10f4ab86f", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423456, "uuid": "6625a815-33ca-4a15-b1e6-daf63bded57c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423456, "uuid": "ad0144ac-acf3-4b08-9ad7-de516ef40c3e", "value": "adobe.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76050c93-df2b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766403820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766403820, "uuid": "2b7cd481-348c-471b-9466-480256fba7c6", "comment": "Malware payload", "value": "fe0674560e5352f5291a50a2d643b324", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766403820, "uuid": "23727e65-e8af-44cf-a1af-bcc87dbebe82", "comment": "Malware payload", "value": "be1011e76427d62f9a031bcaea22defc50235b635e87f2b3ec37d9715b452e6a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766403820, "uuid": "0d06bf70-5e57-4258-aea6-0a604bd42187", "comment": "Malware payload", "value": "323f792eb7a721b76af15583beed15c8b8c9914f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766403820, "uuid": "444c1e0c-3d98-4f22-ba54-b004ce19811f", "comment": "Malware payload", "value": "e719cecb46b9b7489cdc6138ff79bba14b9806b8e402b78fed19ebda5ee25212517ea16acb71935df4e80c1309cb77d3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766403820, "uuid": "40b15cd5-f745-41bb-8609-1d912ec92619", "value": "T1F2821A0BF204A4A7F149E37E880543545622D5359903F8E77FB5980F0AFB2EAAA853D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766403820, "uuid": "b31f2bd9-d4b7-4e3c-9c3a-bb6d914e9ca2", "value": "384:f45myJeUkLNkR3kq62R+wUhLwZ0bZSjaK71ykFZLn:FAU6R3kql+wUOZ0bwrBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766403820, "uuid": "cbbb5f82-58c1-431f-b7c2-6f6c883eb9c7", "value": 18285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766403820, "uuid": "f86b4acc-f0fc-4136-a138-837266a575ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766403820, "uuid": "bf849fcd-867b-4b78-b8f2-6eb36a66dc7c", "value": "DonutDupeUtils.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae265900-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388882, "uuid": "a8c65ddd-ff0b-45b1-9994-c66caf33593b", "comment": "Malware payload (Mirai)", "value": "aa9ca6c4d523a19eaccfbe5f5d41b0d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388882, "uuid": "0ffe360c-bae2-4466-b0e4-2b6adb85aa0c", "comment": "Malware payload (Mirai)", "value": "be4b8c7ad1e0afc3f31b378e75a90daf1fea407a0b240b38bb815452f2139623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388882, "uuid": "ab009a2b-35fd-4cbf-9e56-271b63637bc3", "comment": "Malware payload (Mirai)", "value": "00c1e69a99ba2b04aa564fdffdc941bfeb9da7c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388882, "uuid": "5b6901b1-2cbd-4d70-a2d9-c07d49bb015a", "comment": "Malware payload (Mirai)", "value": "59fdcf67e203a7acf463ff8c12cb91709feadf42dfeef46bfcd8fb5c4bb4b0693cfa874f546ffe491b692466940bb7cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388882, "uuid": "8533fd06-6551-4bf4-be15-baa3779990e7", "value": "T180334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388882, "uuid": "51024f29-3c84-423e-b08d-d596014410e5", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Tw/:ivW3jdQGqt7Y+Z+zN9cGgI6b/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388882, "uuid": "c69412d8-10ec-478d-9d88-6cda5301ca8c", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388882, "uuid": "732bcc37-3d0e-4fd1-b2af-828ce2a17938", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388882, "uuid": "dce83e9e-b5e9-4301-b1fd-db93b5a7aef1", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175132df-df1a-11f0-a129-42010a9c0007", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1766396360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766396360, "uuid": "dd72c06d-37d1-4402-b9ea-0f5054f530c2", "comment": "Malware payload (Cobalt Strike)", "value": "cbbef1e038d1b7826c464d33a4e9b104", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrikeBeacon!rfn", "colour": "#CF86C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766396360, "uuid": "753c9c38-3f15-453a-9ef9-25d68dd263d1", "comment": "Malware payload (Cobalt Strike)", "value": "bea27ed2fe4e48eebf79f045b50ab89be138596620155c3f47a75bf1b99ab824", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrikeBeacon!rfn", "colour": "#CF86C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766396360, "uuid": "0f2f63c7-6335-47bb-9b1f-5e4aa6828629", "comment": "Malware payload (Cobalt Strike)", "value": "2e20c8878c2be89ad453ca8c1c9ef2c6e4778686", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrikeBeacon!rfn", "colour": "#CF86C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766396360, "uuid": "dc1384c0-1ccc-4d1b-b125-4aff7d63a3bb", "comment": "Malware payload (Cobalt Strike)", "value": "6d522c3611dd43ce8b33c6f61cf456aaaf9e03cbbab446da5d95e13b5f978f7347b4ab3755eae9a8b58ee6788f06eb5d", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CobaltStrikeBeacon!rfn", "colour": "#CF86C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766396360, "uuid": "38109877-e3a6-4aed-be9c-d6dc41ab2c1f", "value": "T12ED59E4BBCE054A9D4AA533289B262927B75BC440F3233D72E90B37C2F76BC15A39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766396360, "uuid": "6ed26e8d-6686-44d0-b9ad-43751ed06cba", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766396360, "uuid": "7db3e9f1-7d59-4038-8d6a-c87d9e65d0cb", "value": "49152:W6/DXW4G1gKry+8XoUjXBX4OJqM8a40lB/dtwqS1H2t:9Dm8lXHea40lftb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766396360, "uuid": "3ee12433-f7f9-4cb4-aa4c-d6be085451d4", "value": 2864640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766396360, "uuid": "f1450890-d502-4460-a374-624201fb78c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766396360, "uuid": "1cdcb8f6-92bb-4331-80b8-02280e9479f1", "value": "\u5317\u4eac\u5730\u94c1\u8fd0\u8425\u516c\u53f8-\u57fa\u4e8e\u81ea\u4e3b\u5b9a\u4f4d\u548c\u81ea\u4e3b\u611f\u77e5\u7684\u4fe1\u53f7\u5907\u7528\u7cfb\u7edf\u7814\u7a76\u9879\u76ee\u4e3e\u62a5\u51fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbe0035-df91-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447588, "uuid": "6e92ac5c-4a41-4be1-b4f0-6d84eafbe523", "comment": "Malware payload (Mirai)", "value": "7046c3e405a2e0d794bef6cf9f3bd439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447588, "uuid": "21165e1f-9577-4b53-94b4-180058476cf7", "comment": "Malware payload (Mirai)", "value": "bfe80fbbec57ae28444d17b39641ecd3670d30e35afffafa088aead3346e645f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447588, "uuid": "657b51d9-4e7e-4522-803c-b2454999ceb5", "comment": "Malware payload (Mirai)", "value": "25cb1ef65cf7d95de51f9567afc825408d12f087", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447588, "uuid": "d08d6b73-49f2-4b24-8fac-29c18caa75c4", "comment": "Malware payload (Mirai)", "value": "01dc80586de72626d6b31279a47791c379ef02502c0ff371cc6ff302c037a88c67ff3a3cacd2596566602d0e2a265e20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447588, "uuid": "49885534-b407-457a-9b1e-53f9a49e7d83", "value": "T1D6835B42B2184E43E9A30DB02D3F27E183EE99A021F4B786655FAF4A4675E331446EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447588, "uuid": "2631b0fb-2978-441a-97e2-a8aa7adc4c92", "value": "1536:h9rhNJdMkG/S3Qco5NNSlnVU9xuXDtqqmg8T2bVR84S:ZISAjNSM9cXwnT2E4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447588, "uuid": "09d30681-d6e6-4114-931a-c8ff991e604c", "value": 81284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447588, "uuid": "49969fec-8db0-4178-a51b-e353eb4c5ac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447588, "uuid": "0cebd9d0-fabb-4685-a968-2944d5e66ef3", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331207fc-df5a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766423894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423894, "uuid": "531edf84-23be-4711-b8ae-ed9d8509e5f7", "comment": "Malware payload (Mirai)", "value": "0b323f8b9fb28b7a35142201df817043", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423894, "uuid": "3e9ee5a7-bf63-4acf-90e2-0cea8c68748f", "comment": "Malware payload (Mirai)", "value": "c015ba68be279cdaccf27c7b7a28edc18e3e02d9b7509fbdc4e5f79eda2fe518", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423894, "uuid": "d0acaebb-ce73-40ff-87cd-43205386ef65", "comment": "Malware payload (Mirai)", "value": "c9d313ca1ef70cec1ff91b7f48fdd807682cb017", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423894, "uuid": "fec5a8c1-eee1-40a3-881f-84c51660e08e", "comment": "Malware payload (Mirai)", "value": "7c36c24c07305f9c9ee71cff8ac8b5d10ec1b048e5c7a25cad01b23df00cc12e5890cede2ee429eb40275518612d74b5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423894, "uuid": "cdb7b865-1a4f-46bd-a3f8-8d34c8891080", "value": "T14F215FEF7595A731269CCD80B2E59429B44E6BE526E41D28FF8918B3D8E8E007748B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423894, "uuid": "d44bedd0-1aad-4b1a-81b8-b9af138654c4", "value": "24:boWBGhBh9Mk8QoOw92i9Rq3gOahv/iYZJKU3v3pZuFmatkk0:boGGhL8QoMziViu5/Fat/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423894, "uuid": "8978735b-73d8-407c-a9db-d983381846ad", "value": 1401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423894, "uuid": "6fef5cd6-7633-4ed7-a035-902245563248", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423894, "uuid": "df152c0c-38d9-44af-85d5-e19eed66f830", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fed3d0-df55-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766421666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421666, "uuid": "3022b557-61c9-41de-b6d2-1d76c6ac98ad", "comment": "Malware payload (Mirai)", "value": "bd204a6ae9fbf4c617b36dc8855c9a55", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421666, "uuid": "7d30c403-cc0b-4d7f-bb59-d53813cd6cb6", "comment": "Malware payload (Mirai)", "value": "c09f2c7202a8306d6a9b883855a20281c3376034d010046ae89151866c46e49b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421666, "uuid": "ad45d76b-dd3e-4e81-81cb-c766a531baa0", "comment": "Malware payload (Mirai)", "value": "45a96930749f5b801eaeb74f7d51fbeeda6cdd7f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421666, "uuid": "cfa56236-1ab8-4856-a6fa-60276b78e01e", "comment": "Malware payload (Mirai)", "value": "378b46084099a29430f42c238ca2674dae5ee9dd5b0c3b1cea3545810f3919cd264ac4cef8938d03a4122edeaffc8410", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421666, "uuid": "5eed222e-4f34-4f60-b0e8-26c2bc96c701", "value": "T1F3F08BAE0017AF02C05CDE397A75747BB470D79A095B4B987EC580FE848D6417328D61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421666, "uuid": "d5c1a9ba-2f92-44bf-bf11-79a9eccba230", "value": "12:ep3xnRDXuYnRJBnRMaLBm2nRVNITRYnRGTWnN:epfDeSJ/MaLBmEVNIlSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421666, "uuid": "45a7ef8f-73d8-4983-bf65-155ae0eab9ee", "value": 636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421666, "uuid": "ea0df3ec-cab7-437b-abf4-28c3b0503368", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421666, "uuid": "4c5fc2e1-bbc4-4bf3-ad9f-35f4dc8876fb", "value": "zxc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c3d533-df90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447036, "uuid": "b3c15d92-a4c4-4b23-8774-e68f28813942", "comment": "Malware payload (Mirai)", "value": "5f7d5be78fb1d712e920fe4516ad8c5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447036, "uuid": "aa7be9c0-5efb-4813-b2ef-934657b0dd16", "comment": "Malware payload (Mirai)", "value": "c0e5e329988731ca2a595ca0a63e768f99c53dd7e6c9d078d01748479d31237c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447036, "uuid": "c4ad9a43-028b-4c2a-b28e-169a0957d5ba", "comment": "Malware payload (Mirai)", "value": "a75f5ee5b77408a5d6ff7e67711885e0efb6ccc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447036, "uuid": "66dc214b-3dd2-4140-9594-1ff6c7e40506", "comment": "Malware payload (Mirai)", "value": "d807e17bdfe3c50faa886cfb0e4e0f8ec8cb644fed0853c0aed91c248ac18ba903b41fbb76eae2c2dbbc9b9ba6094091", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447036, "uuid": "7deffdaa-7c0b-4fa6-ad0f-3684014927fc", "value": "T11163AE26C87E9D94C85C9670A4B1EB751713A40096922FF75E99CEB18003DECF68C7FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447036, "uuid": "ed5834ba-20ec-488f-96dc-499f2d9e79cd", "value": "1536:HYSJR8i0vym0gaJoHS/EeUcrvYLsCanmeb1TAbVRXF:Hj8dLG7ocrvYLsDmeJTA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447036, "uuid": "1cf73f46-a02f-4284-b95a-8ce48f67ef37", "value": 70844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447036, "uuid": "4615feea-2094-4b7f-9264-0c96fdcda95f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447036, "uuid": "2a22fae6-804b-481a-bb4c-01b579f16828", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eeefe15-deca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766362013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362013, "uuid": "8585e948-3eac-4025-a3ac-696f13c1e2c1", "comment": "Malware payload (Mirai)", "value": "e101f5d27cf88e3241909554f6797a4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362013, "uuid": "e6fc637e-2fe1-4936-a19c-f40e43460ff7", "comment": "Malware payload (Mirai)", "value": "c197c82428c72a1ccfccd69af7d9919257c2e3d2e4b0bf708713e8fa02ac7824", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362013, "uuid": "8ba6e6a3-2cb8-4d96-8761-ad5956253c6c", "comment": "Malware payload (Mirai)", "value": "c689fbaa1e9db4d35faf8c4ecc4490492b81432f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362013, "uuid": "9632abdd-cb6a-45fc-952c-3a5e93ddb491", "comment": "Malware payload (Mirai)", "value": "005b6045e2f2e5a427fb04d8a1e8dcf905e6a8b8c1927b57711d83d6a092b3cc163b50ba393728ce33d625555fc44fa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362013, "uuid": "e273b1d0-8ca4-4025-9481-a9e861b17c2f", "value": "T13D83A41E7E719FADF66CC63183B78A20E75423D622F0D685D26CE9045E7034D682FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362013, "uuid": "69aaf80d-3a20-4d55-a7e3-ed0a54dd712f", "value": "1536:BwUKvfOjZnuQLPvgYN8BQpQhaB3iBVriBBTIvakBrCxD+YrOT2bVRQ:+cTPvgYN8BQ+VXC3rOT24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766362013, "uuid": "bb147fa2-4669-48c5-88d6-614ae781b105", "value": 80740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766362013, "uuid": "4d5f0693-003a-4294-a7b2-e6b057b5934e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362013, "uuid": "b60330b4-899f-4d0d-9fc3-218b5fc51b74", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97ffe5f-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384686, "uuid": "992d1421-1482-426f-924a-035edce95d7b", "comment": "Malware payload (Mirai)", "value": "3e9943ed460ed68cc9f6366896baa35d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384686, "uuid": "7d815440-eafb-4f6b-bf11-c40ec440e74f", "comment": "Malware payload (Mirai)", "value": "c1da5551cac7bec9e0c299a3e1ea843ec055cac7d889e6b790b7787e85d1e728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384686, "uuid": "a39b48f7-addf-4dac-979c-0ad01ad0c145", "comment": "Malware payload (Mirai)", "value": "07827b8681d4075c7c234b1003ecbf1ee6716d5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384686, "uuid": "47419cac-1f47-421d-9f6b-298c6ff4048e", "comment": "Malware payload (Mirai)", "value": "da5a2b5b2db401b2efa08ae3779d2d10eb77a154feded7daa5206fe7b73be66a2d10a32de9774392e66447f9330bee29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384686, "uuid": "dba6959b-46a6-465b-9077-2af001c0cb32", "value": "T16C63C516BF610FFBECAFCD3749A91B05258C640A21A83B767934D818F64B24F59E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384686, "uuid": "1b339bb5-9f1f-4e29-ac06-48b5fc2c75d3", "value": "1536:uk1VyO6oSFogomZ6nAnYe/DsdlO9Zg3DoI:u8VyO6oSF3oQ6PlO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384686, "uuid": "32e03041-64b6-498e-ac98-0e2738cf4325", "value": 68960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384686, "uuid": "5ca56636-6541-4941-842e-d28873d5d30f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384686, "uuid": "8cbec3ae-1534-4077-8fcd-73098eedaf33", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd6f916-df59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766423459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423459, "uuid": "28f2d26a-692b-47c8-801d-5af74615ff38", "comment": "Malware payload", "value": "dd189045b851af0574e303515c18613f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423459, "uuid": "7323bf4d-4499-41b3-b860-b8ab97301285", "comment": "Malware payload", "value": "c29295f74b5f645fd895d4edaf91df88ff0071039af732545d73f29aa888b5bd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423459, "uuid": "c30e3810-12d2-47cd-a106-f86a97197b24", "comment": "Malware payload", "value": "06435aec05d4482e37ad9d1515a9a13f849545cb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423459, "uuid": "0713d981-cab0-4a37-b31f-37c0b2e49e77", "comment": "Malware payload", "value": "f0c00d3c14c4c4f9516f5ad51a1dc5095ba036a43e343168f28a8d2183cfd7a7307a3a59c73c094c80477ff0989b6855", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423459, "uuid": "47fec2f6-845b-4dde-905e-290f05031397", "value": "T18175332AC984ED28FC6AC4F8E1544AD060CA24A1DFDBB5FC711B5583F49BAC7D9021B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423459, "uuid": "8322922e-a46c-4c6c-92cc-9fc9c6546c38", "value": "24576:RR9m9Ya8x6vdAcetjvXszOjmZZn2jWVr0XPdiQSgI95ugJUFEnpNx35WKUYD7K6:R3mEhdvczOYZ2jMrQEgI95uguS3x35q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423459, "uuid": "0211ff97-ed07-48ac-b775-2bf396d9b1b7", "value": 1577433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423459, "uuid": "cf9db12e-590d-49ee-ab4d-bbad5a12e124", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423459, "uuid": "d1abdc95-9e72-4ff4-92c4-7ed077898455", "value": "PAZARTES\u0130 S\u0130PAR\u0130\u015e L\u0130STES\u0130.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e273c687-df68-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1766430201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430201, "uuid": "80840dd2-760a-4c72-9b39-ae97639bda2a", "comment": "Malware payload (RustyStealer)", "value": "cc566241c478541299b3216ed442d5e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430201, "uuid": "2cd663cf-7a0c-44bc-949c-9bd00be7438c", "comment": "Malware payload (RustyStealer)", "value": "c32e1db396e6b64846792f05c776c5b52f34834b0500bc18f982927e07ca3eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430201, "uuid": "2bdd6d12-8704-4201-8ebe-22991a86fd16", "comment": "Malware payload (RustyStealer)", "value": "821a1842a06aa7ecaa5f70ff75905dc404f63d08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430201, "uuid": "f0db2f4d-7a8a-44ea-8036-10a115f59b15", "comment": "Malware payload (RustyStealer)", "value": "a09afc21b7139d0c0032a2a9017e415a6787deb7c96f05792ce16f35879624fa709e8121cc5c3f92fd1753823bca72aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430201, "uuid": "c6fcee4a-96ff-4faf-84a2-8cedae475c46", "value": "T1E8656B03E69989EAC49EC178C7578272BA32B88D0731B6EF17D51A243E67F902F1C745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430201, "uuid": "ac7d36de-df2c-4df5-9c1d-0137d805999a", "value": "1c072e6d0c02b4a1536f751c67de0f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430201, "uuid": "892bce1d-0aaa-4479-9f8c-e41563c43990", "value": "24576:k2zNL5V31UfpxQ6p0fkunuDBvc16qHQAfcw2t:RzNL5V318fQ6ekunuDB01RHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766430201, "uuid": "1b6d0306-a40d-4f00-89b9-f1884f96e7e2", "value": 1476096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766430201, "uuid": "098fa108-8b06-4db7-afe4-ad648e68f735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430201, "uuid": "4bbe0c8b-92b1-41b4-8593-3eafeb9fac41", "value": "ssldcs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2ca545-df55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421948, "uuid": "63beda39-b4de-4e5f-a11a-99610ae9643b", "comment": "Malware payload", "value": "a021630673fdf06c4669253d9e13075d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421948, "uuid": "ac182cbf-28ec-4695-8d93-785300eb94fe", "comment": "Malware payload", "value": "c39bc5b30eef8eb76a89a9686476c73b43989487b5adccd2c0d0044c5a23e919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421948, "uuid": "a1c7a239-faa0-43f7-b63f-b90649ff4ce8", "comment": "Malware payload", "value": "5fd5058d11f0c6405886d9e38e62f4e608c6fd97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421948, "uuid": "0166b93b-4958-4f41-b813-57c604596d37", "comment": "Malware payload", "value": "fb5d404695e6f51234d39077890e9b7cb14f33d045c640fff6867863c9f11e95dce7ae99abe774f7974d23e5337cc5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421948, "uuid": "8c3e4eea-38e4-471d-8645-300ad4f9e208", "value": "T19AF6396B73A19168C26DC13EC0A38F41E8F374B91B33C6F79AA5036C5E619C85D7A724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421948, "uuid": "b64dad25-4126-464b-8b63-e29115aef59a", "value": "661fc69f3108697bc229d2ef311102dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421948, "uuid": "bc3da426-2073-41b7-8a58-470e363cfcd5", "value": "98304:7MtFAoeoS90R2Ul3SMgyqZahkTNcX4Jp+eIbpgdQI:joeoJkUpNgyMpb+eIbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421948, "uuid": "2172c454-e168-41ab-b8f5-d8d5e509d6f0", "value": 16484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421948, "uuid": "075f576e-d8b7-4c66-abad-ab16ddab5612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421948, "uuid": "d0902843-31aa-44f9-b332-32d6e2c665f9", "value": "cotool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07eb96a-df7f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766440076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440076, "uuid": "47ccf6fa-5ca6-4d6b-815e-32710c706d1a", "comment": "Malware payload", "value": "675d9b8bc81f9f22656fee729038560e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440076, "uuid": "ac72468b-a672-4b03-bbf4-4b2e3e705d0d", "comment": "Malware payload", "value": "c3ff9855cb9697f49eae943960bdf82ecac6ab1b9256e0fb63d6acf662cf2302", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440076, "uuid": "559dc389-03b5-4ad4-b29b-f14cb98d6366", "comment": "Malware payload", "value": "1e248744243612781bff596923253eec7eb4446b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440076, "uuid": "8d7cf371-76d5-4d1a-b3b0-ce2b3d07fcb8", "comment": "Malware payload", "value": "31370f03563a47424fc845419af325943fc68944f273693a1973850332b81c4af0651a6246ae748487161090684f3d8f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440076, "uuid": "3e084901-dc62-4ba3-a65c-1d079291c6da", "value": "T1D291BD101BF94218F2B38F39A5FDA32292717AD17D32952D4561CF4C7C24684A87AF77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440076, "uuid": "5ec8974e-6401-4cc8-aa53-47168c26de63", "value": "96:8YH9omrvxz+IIUa/5468GumkShpJsOCOvuJ:8YH9hZlcfjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766440076, "uuid": "86e5d358-0fd8-44a3-b99e-ec16ceb9be97", "value": 4511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766440076, "uuid": "61c5db81-1fd2-41c1-9c29-739a4d1dd389", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440076, "uuid": "fbbb588c-ecdd-4fc1-be6d-519a1a8717cd", "value": "KUWUJELUSAHEV.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63031f0-df91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766447844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447844, "uuid": "c94d9d8c-977a-4418-9c95-bff2c15b6ab5", "comment": "Malware payload", "value": "2e9792ebeecaee6f551399256b9d2b48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447844, "uuid": "d424195d-4001-459f-b625-42b0a55a1572", "comment": "Malware payload", "value": "c418417d14f1d28b8ead43b923e549e0f795013c37abcc9ccf0a71467cc994ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447844, "uuid": "cf4aa847-d343-4c9d-bc98-8a9c571aae1d", "comment": "Malware payload", "value": "3d6c35076175b0c3c36345a029f4e01b182f16fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447844, "uuid": "a892b469-ea39-4718-ad1c-5b794875ff3d", "comment": "Malware payload", "value": "3b0f6e976037f93c2bbcbe8c963f49b59f086a2dcce6e80033ad8adcd66914d97106319cd733722291854fb013a0a57d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447844, "uuid": "9b740486-f012-4670-a4f3-0548cf20998c", "value": "T1AC832A86BC81D612C6D466BBFA5E42DC332253B8D2EF72079D156F153B8682F0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447844, "uuid": "b68df600-33a2-4c84-8ec4-ebbc0c04601d", "value": "1536:qneC1wY42Q9gDcItLTEX+qG5AVDfpvhoYZG4PMU6CyK1T2bVR:qnZS4DqIAVDlG4z6CJ1T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447844, "uuid": "f6d5b2aa-159e-4d53-a3a3-ca44efff2ef8", "value": 81668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447844, "uuid": "1fcb4ef5-8937-42ed-acab-a27fb0c6cb09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447844, "uuid": "195ef1aa-8202-45d7-ab7c-056f2e25b796", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bf6266-df10-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766392309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392309, "uuid": "86276401-4e8f-479f-a26d-3eaa859e8204", "comment": "Malware payload", "value": "74c1c6ba6c2092b29fe0ba90656dee2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392309, "uuid": "dbee04bb-af95-4602-ae7d-88693f6b53fc", "comment": "Malware payload", "value": "c53548839a08506275c03d0d5d21b9a85a5999fbad9dcf39a4d9556b5d18dbfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392309, "uuid": "7e0610ab-dcb0-494d-abab-9171857965d3", "comment": "Malware payload", "value": "2ffd67f30464f3b1bcd7e51027a09b07e6562f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392309, "uuid": "a3708033-c437-4b20-827d-f2516c204648", "comment": "Malware payload", "value": "d9fc4a1be0ab14d5ffbac4ccbae3cd68aace84f03e1766b87584414c5c8b6b31ab3f8046173d3a7ba062157df5757f09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392309, "uuid": "94ff64b1-69c0-4181-8d0e-4a8e0c5a1752", "value": "T1E02733483B840D95D5CDC27B829088EBA5A3605247B38647D6FBB6710DBFF98BF29710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392309, "uuid": "277ee702-9cae-4eb3-bc52-5c5deb652660", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392309, "uuid": "e50bc8cf-8190-4087-9215-68e128898dee", "value": "393216:wsFl7dCR1C99/L/W8buCRDvV+53SM8+sLwqbf4dSD0Kjbtikl:TFlUR1OTW8CClvV/M8+qV74sD0ipi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766392309, "uuid": "861d70f8-6288-4e0c-8817-4c9d0beb82f8", "value": 20691080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766392309, "uuid": "9223df51-4fd5-43aa-8fc7-f2dd4328deaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392309, "uuid": "25a469de-a4cd-44f3-9d2c-f6ba468e036b", "value": "Video_2357865217-962034782.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccde21af-df75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766435748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435748, "uuid": "04caca0a-f623-4652-9f8c-d6a0af8c0ce6", "comment": "Malware payload (Mirai)", "value": "178b44267716ddedee5abd319d881ad4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435748, "uuid": "24debc8a-36ca-45b6-9e16-ee5879b27014", "comment": "Malware payload (Mirai)", "value": "c5cd738fb9fad3cb94b11d797a5b7b72ee72e54f42e6bd6711f5e85899421cc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435748, "uuid": "fc783c1e-feb5-4ff4-9b56-65e888dd9a38", "comment": "Malware payload (Mirai)", "value": "f40e22afdaf02c49df4852c2c23850fe4a9b8deb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435748, "uuid": "7badc586-72a4-4ba1-9703-ccfbdc205504", "comment": "Malware payload (Mirai)", "value": "f6656c21eab16e80e4e5b4acc4f0199bbf5265238f24d981054e628b1f0339768e135f433c6797bc7d509cc9fcade09a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435748, "uuid": "b6b5db38-3af9-4410-9b57-bc2521c380a2", "value": "T1F9938E62DC793E58C2659AB4F0B0DFB9A713E505D1874F6A80ABC3799443D88F08A7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435748, "uuid": "60c84f11-f086-4f20-8fa5-80eeaf3a0f94", "value": "1536:SBUIPKSGN8SUSxL6QZ+WOl38vqJncwKreEG7AP3CrKa/4DZkfnzi:WbLGnUYLOWi0qhcXrIAP33G6Qnzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435748, "uuid": "48065f4b-fbcf-4c0d-aac9-8fc7086427c1", "value": 92624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435748, "uuid": "9e889aab-f6e1-402e-ae0b-64990a96fa47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435748, "uuid": "3a3a54bb-76f6-4861-9757-fbc9e2b94662", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c052872-df6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766430700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430700, "uuid": "dffbda2e-6788-47de-a3ec-1c1c23921a10", "comment": "Malware payload (Mirai)", "value": "f8176de0e61f246e0b8b7627a53c08e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430700, "uuid": "4c640ece-6f31-4dd6-ab08-8d60b81b461d", "comment": "Malware payload (Mirai)", "value": "c6965272f9cb958776a254eca6b8911c0365c4e90b389a68aecac513c509b86b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430700, "uuid": "f7f66d6f-3bd2-474b-af44-29e8ee7168e0", "comment": "Malware payload (Mirai)", "value": "426c5348cd80eb86fec83faccf85ac0aabb63c91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430700, "uuid": "499579ba-3bc9-43c2-bbe5-654b5c3b7ff4", "comment": "Malware payload (Mirai)", "value": "4b0cfc994f14c5a2f2df575c4f75795b34984aa0b19eb2e6aa5c8ae3e6c74471244992c2d63f2e81c7484702f7f6b5e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430700, "uuid": "1a620a1c-14a0-4f3b-b422-441278bb87f8", "value": "T13CD3AEDB734B0911C46106F01BD79F8E3F6362168E4BC9E72D0DB67A287A5CB191A7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430700, "uuid": "e5b5fca9-4170-4909-bd37-f917ad27bf80", "value": "1536:kHSKo+wP2Ypcc35EUQu2LjzWIXSeDqrlU5YfxrEq2ipgrns/LW6:kQ+74/Q/nvSeDqrEYX2ipgrnsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766430700, "uuid": "d83c8139-b39e-4545-8623-3c3967622ed1", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766430700, "uuid": "e7bc3d8a-5044-49b0-ab7d-3d1612b7d3c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430700, "uuid": "bef40e97-2576-41fd-a47d-18b6547a3b00", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cec0ba3-df71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766433762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433762, "uuid": "8395e6a0-0e95-4b9b-a2a5-aa593ad62bd2", "comment": "Malware payload (Mirai)", "value": "053692b994d4a0c80cbf440f3af26b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433762, "uuid": "07c7dd89-99d0-4a81-953b-80626d4c2818", "comment": "Malware payload (Mirai)", "value": "c74af2d163d0492645f5579d803259a444e62c5708ee8f63ccde7ffc37fd1d22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433762, "uuid": "d3c1c2fc-6e2b-449b-8af3-ecc1a7f4057e", "comment": "Malware payload (Mirai)", "value": "8b2861f2c2b949b1a0a4ff63169c4bb13a004cff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433762, "uuid": "98121acf-4f48-441f-b1bd-8f9da580c405", "comment": "Malware payload (Mirai)", "value": "5a6e5a60540b59a74dee7897205c7017da428128f8da2639b7e24d2750c92c93c9fbdf643a182046319dc864dbcdfe93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433762, "uuid": "621fd8d2-69f7-419b-95a4-8b42ec53c71e", "value": "T1D6C30786B8829B20C6C2567BFE4F528A331357ACE3DE72139D181F6427CB55B0E3E516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433762, "uuid": "966e9762-3665-4931-a20c-60a7f0b2f3ef", "value": "3072:TZHh+tAP/8zYYOeWOhbirVd+/cTfa6gGYlTUMO4GadQ5iLnz1:TZHMtAP/8zY9eWO9iz+/cjaBlTXGqrv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766433762, "uuid": "c454f901-61a7-46e7-8acf-06a1a7ab3be0", "value": 119936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766433762, "uuid": "b7116596-d593-4a7f-aff9-2ca2888f047a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433762, "uuid": "31fc8e5c-56c6-4475-a2e5-dcca7978678d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4823ca-df0b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766389895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766389895, "uuid": "bb387cbd-8617-42c7-9808-afe6fec34aca", "comment": "Malware payload (Mirai)", "value": "44c74d7ca64a71939f8740c83f649774", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766389895, "uuid": "684d6abf-c895-4dfd-a52e-66a3cc5fc5bd", "comment": "Malware payload (Mirai)", "value": "c752632eb29dec07a449725380fc22333d1811a346555d6b75ff461c16b11ee9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766389895, "uuid": "f245ed16-004f-4fca-9539-224645c38660", "comment": "Malware payload (Mirai)", "value": "84309feeacdd245fdee199a9a5c44bf47fcd5841", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766389895, "uuid": "73274de1-a1e3-4aed-bfec-7bb1810fd8b6", "comment": "Malware payload (Mirai)", "value": "4acdbdbeddbcfaf4504e94ba3ef359477fb8d9333951740d68277061777df851ee5b6b62baad2afb0dcc4e120c916b59", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766389895, "uuid": "54cbaf87-72ec-43e2-b207-669ad7da0f2e", "value": "T1E1217FDE3CA83230494FB9D4301E550C229B8FD5B039CBA9A6885072E185D24FF72F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766389895, "uuid": "7dc6265e-3c90-41aa-91db-aee555ad768a", "value": "24:q3KeKkNNIG07KlKpKz5K1+F7KWNfm7KGK6lKo0K0gKWHA:+F0eqajZ8D9lD0Gfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766389895, "uuid": "814e1d3d-f489-4788-be37-b127c542cd78", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766389895, "uuid": "9e1bf436-e0f6-4700-bc00-9a24dae8c655", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766389895, "uuid": "af96d9d1-da65-4910-b3a8-14807dcccb3c", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9748cef-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446561, "uuid": "d09ec988-36be-4181-885d-bc9c421f0a30", "comment": "Malware payload (Mirai)", "value": "37783f011e1c669f6f78581e7b46f1df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446561, "uuid": "6949e5a0-bae0-4541-b14d-cf54bd12e994", "comment": "Malware payload (Mirai)", "value": "c79429bee8a1e3ade5747644f0e566e0f18be1dda22e85d59077f04df2511e58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446561, "uuid": "baa2703e-80f7-4107-930f-931f71f98f3d", "comment": "Malware payload (Mirai)", "value": "f84c6b8b09eefa8554333546c87b4c2616734b74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446561, "uuid": "5a9310b3-7e86-4ba7-834f-ff8f8a88098e", "comment": "Malware payload (Mirai)", "value": "4a32f2f536be3fc81e25e790c511bff833b1f404eea7d713ccc1f8995200cb113f98047ba04cfd06ffd75fe7fbd80c6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446561, "uuid": "b17d7ff5-8f84-4ab5-9cc7-57407b892735", "value": "T159B31985BD85AA12C6C25677FF4F428D77165398E3EE3203CD181F64338B96B0E2B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446561, "uuid": "f0e9e0c5-7b91-4c0c-b1a3-04f91fcabf25", "value": "3072:gvNpPV1NrQQsTxAFdfcL8+ApSuXTXUoZuq6XInz4:gVpPTN8/TmFdfcw+ApSuXTXUoZR6M4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446561, "uuid": "fc4992a5-8108-4f40-bee7-90e82f384633", "value": 107724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446561, "uuid": "edeb5d49-36a9-49de-87c7-8991f2153b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446561, "uuid": "608a1396-4796-4528-9fc3-cd51d7ebb15e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752300ae-df38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766409402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409402, "uuid": "7e4b65b2-a178-4b1b-8b03-63f647e4705f", "comment": "Malware payload (Mirai)", "value": "24f1d642b9e1407c7a32d1c71103318a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409402, "uuid": "91e8a0e4-ca7a-426a-9b48-0ea5414c2025", "comment": "Malware payload (Mirai)", "value": "c7a3ceaf8035701817d155ecb7641e2b45beec9f8e1a0de98c0594cd691cc1c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409402, "uuid": "dc699548-8a79-45c7-9fde-9c724876cf1f", "comment": "Malware payload (Mirai)", "value": "e7431333206cdaf64fdcdc87ca354344c7a43523", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766409402, "uuid": "2d361f02-95b6-48c8-b433-9cdb9971fc6d", "comment": "Malware payload (Mirai)", "value": "6274933907e1e1d779256bab01ba16b30abf384917555ddf685f683a160bfc3c51062ad55a2935e4f86eb74645d998ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766409402, "uuid": "b8443324-2cbc-4138-ad06-8003b0590b25", "value": "T1E6B34A00F982C1F5EC0B4871A0A6B77F8B31E63691229B55EFA80F66CB27E45671734C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766409402, "uuid": "217b8ff1-375d-45da-bd7e-08480beb5f0f", "value": "1536:2lgMjTPrnjex2CVaz23M7FnjRtcWDY6qAme85FRWPyS9K94lf8D9hykzgK:xM/rjeYscltcWDYSmnsKS9K9k8BJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766409402, "uuid": "6ff97ad3-bf32-480c-a73b-c47288b370c2", "value": 117668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766409402, "uuid": "7469120b-bbe9-43a5-b87d-7037740a0611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766409402, "uuid": "1973b6be-9c85-49e9-81ed-a51f31ff4b0e", "value": "rondo.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad24ff5b-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388880, "uuid": "06fa6da4-c084-4e0f-aca0-a179d9104044", "comment": "Malware payload (Mirai)", "value": "61cc28c5e90e410c3f4ff5a368aa0527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388880, "uuid": "e88c2f21-11a4-4e8f-bd13-7106226a1376", "comment": "Malware payload (Mirai)", "value": "c8e49d22166dde0f11d60fb255907a06c3f63e34fcf5c4de5d424ee24241f3c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388880, "uuid": "f7a4c577-7153-4cd5-8bec-ab4358cb6e7f", "comment": "Malware payload (Mirai)", "value": "a17201ce02d183960ee7ced6ab3e1579a38dd955", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388880, "uuid": "fb2a828a-8cc1-4c58-9413-25e726eff0d6", "comment": "Malware payload (Mirai)", "value": "a39a3e4fec82ee88d9f8f0b5d8d1665b721f3586b5c6047a4592cd1d655b5ea54c16419bfd8c410a15833750c10152ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388880, "uuid": "573c0043-a17e-4c1f-98f6-c3ad39566b18", "value": "T1B573A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388880, "uuid": "4a82027e-428e-44d6-864a-461249bfdcd8", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESts:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388880, "uuid": "e18336d6-ab2c-4729-b7a1-4d4a0784b9ee", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388880, "uuid": "5f9c0904-cf03-419c-b7ad-e6dc09ee81c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388880, "uuid": "8a3f5f43-1778-4231-bf3f-a51d8226fc18", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e6fb44-df02-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766386390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386390, "uuid": "82b5fc16-d065-4a90-82db-8dd912c7fc2f", "comment": "Malware payload (Mirai)", "value": "351c9f47fb754269e0a8a028ed804f6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386390, "uuid": "191f2311-6087-4911-9b99-d62c78c8c5cd", "comment": "Malware payload (Mirai)", "value": "c9a4f7b1626cfc17d700850cf30703632e96354ae80b1c49532acb3b464d19ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386390, "uuid": "d7db88c1-892f-49fd-a40d-f240a8690644", "comment": "Malware payload (Mirai)", "value": "1b0afd4e39807949db6bfe8fa62118bd3622dfae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386390, "uuid": "5db388b3-793c-4877-ae73-1a5f7f44bb5c", "comment": "Malware payload (Mirai)", "value": "138a8c7b1e26a1c48331995a56d383b3d027bb8e9d489c118cee467eba806ba239dab421f7723f4f445ea421e71c0f01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386390, "uuid": "106c79f4-1585-418c-81ef-12679fd8baad", "value": "T108330224B5A7A8FC8B326C3BE398DB40A6CA8D99C0DB11E7150C01AC35164535FFC6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386390, "uuid": "4704aa7e-99c6-464c-8335-6163fddfd7b8", "value": "1536:mfLvZjAd4XQcWryy6iiCeWL3fP3fYJHjrF:mf5Wr6JCeWL3vYJHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766386390, "uuid": "7ff9e16e-8584-4e24-9122-b9234e551cb1", "value": 51960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766386390, "uuid": "7fbfb1f4-c35f-4704-8961-a918c53c0f86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386390, "uuid": "2833b4e4-70b0-4d40-80e9-39a20e18f1bf", "value": "frost.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7608c7-df65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766428584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428584, "uuid": "5910055a-0c8c-4fbb-9cb6-1af82a5424a3", "comment": "Malware payload (Mirai)", "value": "55346fe7ae479fb0cfc9325f8c535002", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428584, "uuid": "796aae4f-7561-4584-9eb3-37977b08ed7f", "comment": "Malware payload (Mirai)", "value": "ca0f9b94d5311c72bf476441983013837646b8aaa0ee9a06aeec3b4593aef8c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428584, "uuid": "a54cf1a9-e94a-495f-9956-cc46b7fa8d01", "comment": "Malware payload (Mirai)", "value": "85ecb63691a0b88379e9cb1995db2c29885fa4a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428584, "uuid": "9355f456-e8f0-41c0-95f1-11cd32b45ae0", "comment": "Malware payload (Mirai)", "value": "c202c809caa44e31e1ed510e232d8cb3b7d0bff1ce571872de1ce38cb70bd7410252ab5ddce8a0dc5ad99fa0be86d2be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428584, "uuid": "d001aadb-8846-458e-8cff-af322c16fd14", "value": "T1BAB31995B882AA12C7C25677FF4F428D7716579CE3EE3303CD185F64328B96B0E2A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428584, "uuid": "5b82d9e6-a6f6-4506-a661-7efccb0b1995", "value": "3072:0v0Png4VvkiS/sVBy7AludX/VNVCg4nzR:0cPngiv1S/sVk7AludX/VNvsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766428584, "uuid": "f1a02c47-e4e0-4def-8c23-5b92984d6e74", "value": 108540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766428584, "uuid": "995f47df-5ffa-491b-93b0-34e9ea082e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428584, "uuid": "d97b2dbb-02b4-4aa5-83e0-139075930bd3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc4e631-decd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766363511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363511, "uuid": "ef78a763-14d5-4e0b-a16e-813e51db3362", "comment": "Malware payload (Mirai)", "value": "9fe4f85e69c059953b26dd9492f52f84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363511, "uuid": "b5afb39c-d743-4d36-809d-4ec9ce38d15e", "comment": "Malware payload (Mirai)", "value": "ca5987b20abcbc2981c9f3525ad04540ace0c4bf5f9429a225689eab4b2f8a43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363511, "uuid": "5e528b7a-3d8e-4f31-afad-a62422328cd4", "comment": "Malware payload (Mirai)", "value": "cee3b75997302e72c40a89868d3948cd09a5d0ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363511, "uuid": "880eab4c-5b3a-4e74-8aa6-c4699e4916f6", "comment": "Malware payload (Mirai)", "value": "c76b40bd94affc3d4f522043953a76507ec25dd523e34492621d3d3a3e929361a3332c9e1776999d19567117e5b062c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363511, "uuid": "f30357fd-4892-4f6b-ae78-7069a4b0e631", "value": "T12AB3D74A7B650FFBD85FCD374AB95B05258D920721E82B3A7A74D818F24B24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363511, "uuid": "1c04f521-d12b-467c-be13-97aab30e77a3", "value": "1536:xt+wzhJYhVKRBNNsc9tn17Im8uQXxFIEKc43leVdfnxEEVRVxT2bVR:xl4hARBosL7IOQsMjRTT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766363511, "uuid": "8126d319-ec00-463d-b68f-6b6ff09bb222", "value": 109420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766363511, "uuid": "41e61032-0197-4e87-9f02-ec669f6dd2b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363511, "uuid": "b7452f3a-e83a-44c6-a8be-6fedb439bcd5", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706d1066-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424856, "uuid": "cab615af-65f3-4a8b-94af-f1ff7a156a0c", "comment": "Malware payload (Mirai)", "value": "72882da43fa811602a82f8f036cddcda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424856, "uuid": "986d7771-3295-49b4-9f28-9004cbbd31b5", "comment": "Malware payload (Mirai)", "value": "cb22918e82cb5953d876a8db3a6c4888a8b9b058918867e5abb12e078ff5a474", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424856, "uuid": "3d554d5b-bcec-4833-807f-b3625ea99f77", "comment": "Malware payload (Mirai)", "value": "e5145f00cb52a802f4d0b0e8af468cf0796ce323", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424856, "uuid": "bbc4bfeb-31ab-4e43-a5f7-4cbf8c18567b", "comment": "Malware payload (Mirai)", "value": "1338b900b0dbffb9bb263bd42d08c4de248c71a3c6bddfa12c65bf031b6d2ee23131b6c82cd1134749dfc1d5ed6a26d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424856, "uuid": "e32396aa-b5f5-4e7f-84a7-bf43c1df7f50", "value": "T1DFC2E996BCC2965BC6D1537AB76F474C339277A9C2CF3713DC0427103A86A4E8D62B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424856, "uuid": "a55433b6-bbfd-4157-b320-dcb492b59d5b", "value": "384:NOGbxAuQK0FBksoFcQCG48tG5rtlG6jcldfP5cKbFo6bSY/aLrybm+ILopC6a6uN:NOOHH0L7oFWEG5rtlG/btbakILop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424856, "uuid": "2f58754c-5e53-4233-bf26-264c32f2e03d", "value": 26480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424856, "uuid": "7291c49e-7eb7-49e9-bec5-463422c99350", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424856, "uuid": "b575b0ae-3bb3-437f-b36c-3cedd13558cc", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce13f888-df71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766434033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434033, "uuid": "bd9117da-cc70-48ae-8fb3-23b5b55f8ab1", "comment": "Malware payload (Mirai)", "value": "a57aef010c605a5803764bf5390fdd4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434033, "uuid": "0e104d3b-d87e-4647-b822-0466e3196d19", "comment": "Malware payload (Mirai)", "value": "cba70a6456ccbf21c45ec144aa4dfcdaa900f171e6fc254c7cee8973e20fe1ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434033, "uuid": "fd18ab8a-b460-4184-83fc-097cfab708e3", "comment": "Malware payload (Mirai)", "value": "fcce7a0c957eb7e915f4888e4a3512e1ed66a550", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766434033, "uuid": "d16e9314-6ca6-41b1-abef-a9d78c23f407", "comment": "Malware payload (Mirai)", "value": "a0c71d650ecfd2f0c8cd560da900ca2756f63dc71b6230420c17c1dcf3f11f3a600954ff6e24ee4ef53940336f0eeae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434033, "uuid": "1920292a-7d50-4508-8072-93214fcfc76e", "value": "T108A36C46EB43F4B0C81A0035164BA37A9E35E9322022CD5EF7E47B71ECB1B51DA5936E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434033, "uuid": "e1f4ebf7-ed1f-4c6f-b0a8-c3fd7a56d576", "value": "1536:OzgVvCETP8Q/ldqcQI1JezvqFHyUYNzu/4C6g5Ui31Uquoc3WDgwE4a6Sg+r:FLZldqhI8vwHyUYNzi/6ECGcjdoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766434033, "uuid": "20a8b14d-5724-413a-8db2-950640ea3d64", "value": 105956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766434033, "uuid": "00b560b8-4572-4545-9de0-2dbf1a469d31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766434033, "uuid": "06a6dda5-d13e-4d8b-bc08-767d8e1d0e9a", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efa29cf-df66-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1766429122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429122, "uuid": "70edfb4e-8c84-497f-a0eb-a1e0d3067a5d", "comment": "Malware payload (Socks5Systemz)", "value": "60ac7924fb2fe996bbfbe98e372481ac", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429122, "uuid": "e993a318-dc39-4a1d-89ce-cb3064600fd2", "comment": "Malware payload (Socks5Systemz)", "value": "cbf45b3e0366db47f931801634a12bde4239e5c404ac7a77a3a787c70f8f8e8c", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429122, "uuid": "f52e1763-b0b1-47c5-a101-57ea36b7838a", "comment": "Malware payload (Socks5Systemz)", "value": "abf6b4991d83eca574306e9c91af22ca0a2c2929", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766429122, "uuid": "9737bb05-e890-4578-abeb-b9fc579b7dfe", "comment": "Malware payload (Socks5Systemz)", "value": "a6e8fe5531bc0133816c00ba5978e7d4aea71348ce7074ebf1593137cdc879af212536bf9c52fd9d8fe45f255995d57e", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429122, "uuid": "7c22ec1e-3632-4160-842c-8b329553b15f", "value": "T148F53310AFDE1F35D063E0315E76A6510C30A36E2DB275D6236D83EC1EA76981097FAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429122, "uuid": "0d99ac46-6842-44b7-bf5a-0b7d726709ea", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429122, "uuid": "516cf409-63d6-4682-b434-267fcf4696f5", "value": "98304:MITSVWymgC6BK3Iq9TKodTtl2XxQQsZ+1AfwkFc:1TSVzzK39h+HP2wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766429122, "uuid": "83a52589-4d66-4568-ad72-de005bbd2be0", "value": 3465142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766429122, "uuid": "bc9f5d4f-d325-4a16-916c-00efdd38a30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766429122, "uuid": "792e80ac-9284-4fa0-94b9-f67e4589d1d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e1efca-df17-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766395225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766395225, "uuid": "e9b79ed9-46fe-41a7-b5b3-d9d11d7b34a6", "comment": "Malware payload", "value": "1290f1ab1fb6552508a7695efe1c66a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766395225, "uuid": "483183c5-6182-42b0-81d1-07ee73dab930", "comment": "Malware payload", "value": "cc1176e52c95918717252b486d693983260dc58df41527ef6e3f872089888ea6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766395225, "uuid": "02303be4-e85a-4371-9b4f-7971226709a5", "comment": "Malware payload", "value": "f6bd7f105df3b1237afd4c702318a9d9e60d109f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766395225, "uuid": "ddafe5b4-a611-4a87-865c-56dd9116a1e4", "comment": "Malware payload", "value": "27302cb2564f998498eea173f43cb4eb9ae3be9652e4fb6aa5b618c4f75e1c3d727d289e4c4511c6de70cc87e1e6a2cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766395225, "uuid": "ce539f7b-6fe0-4fa6-aa58-2a3900cff492", "value": "T18C9602C425D097BCC4918538F18416EAE0E07CDD8CF9D25AEFC6A4233A31DA5D8B5BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766395225, "uuid": "49081d8a-067a-44b2-af1f-6399e89ecf0c", "value": "22a94ec8b5f069cb6a4775cecdc3ab07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766395225, "uuid": "41371149-15ed-4a2f-9230-bd8eb9980e96", "value": "196608:NqxSwauJ2YZFW+kV4K10g0iaXlBYNj2IMnEZE:NkaeZKSK1ePB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766395225, "uuid": "6f9f075d-0964-4501-a26d-aee080f30a7a", "value": 9140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766395225, "uuid": "9e41a164-6bcc-4f79-9a81-fc3ed4f36179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766395225, "uuid": "46cac1fc-8d2d-4ae3-99d5-bf8a118635d0", "value": "LocalSyntax.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6e6cc6-def7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766381522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381522, "uuid": "f4154f4c-20e4-4421-b13d-185813972e5b", "comment": "Malware payload (Mirai)", "value": "796a34056c47662c4444eb3e53b571f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381522, "uuid": "4f023ef7-5809-4d0e-a558-a40a8d915374", "comment": "Malware payload (Mirai)", "value": "ccdbacff8e06c494edb527baa8f68a1b8d35fc4d60654b975470274b9d0e4356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381522, "uuid": "9a0903e1-410b-4377-ba93-498a65686cab", "comment": "Malware payload (Mirai)", "value": "e0c957a947ee59b8688a15d795efe8f87d4b179c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381522, "uuid": "c4851b3b-b1ff-444d-bdc5-48584c6b1b47", "comment": "Malware payload (Mirai)", "value": "7515ead36d04456c8f92aa417a0a4d634696fa0d36397db3e23f2b54f03e9d63549a08576cfd6351f151cf8473afb591", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381522, "uuid": "fbd17815-0f4a-4303-b8e7-5bd85b05c6aa", "value": "T12553024261734027CD123A30A13A17BD537AE8B77987D403E7E92CACE16721B7F7AA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381522, "uuid": "f4fdb450-1919-48ae-8b26-0f50c380850f", "value": "1536:aj4QqGJylssrFycstIFVtxdOe0Z8HAs5iG3A/LqMsS0:aj4QRkGsrKiF/Oe0ZyAsE/Lh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766381522, "uuid": "23a6d54c-68e0-46c7-8898-55bf7c44baea", "value": 61620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766381522, "uuid": "671372e5-27fe-44fc-8e25-3cfbef395a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381522, "uuid": "970b50b5-ebeb-4e40-a3d1-3c7292194c2e", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4ce137-df5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766424285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424285, "uuid": "295b85b1-f08f-4f72-a9d5-50a92d6e2b5f", "comment": "Malware payload", "value": "1a1eca4afce8019df602f317f2ade1ef", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424285, "uuid": "1d2eb859-8a4d-4c54-aa14-2c084844b919", "comment": "Malware payload", "value": "cd26dbb9c803aa81bc353a528ea8335bd3070fdc988e0c98b070b1426d595c28", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424285, "uuid": "2a2c5eb8-0499-4808-b852-1cbfb1df40ff", "comment": "Malware payload", "value": "82269ecd26d3809a7af1f54af01df1ec628870f9", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424285, "uuid": "75be150d-0bd4-4878-8d32-4cafbd23cdb6", "comment": "Malware payload", "value": "3db6ce76bb32b37e773862031c509a693c800b6264bf313b5528af5d55288f7b95760a5650f70deea21a3bcc8a63d7aa", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424285, "uuid": "31ab107a-5565-4904-ba0f-3dc4341fd572", "value": "T14E764B93FE5046A5C59FD33DE8A20285B27478441B7131D77B6436660E3BBC81A3BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424285, "uuid": "ff8958c0-3453-44be-8ad3-5ed308bce17c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424285, "uuid": "17a2de90-7109-48c2-82fe-8eafef979d6d", "value": "49152:8QbhJ0U5JS5ozdYIaJy6WdyaO6Ytv3dPm:8ODvmISy6Wg5Pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424285, "uuid": "9c2e6d48-2421-4790-92cd-c1d00a2fe7c2", "value": 7563264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424285, "uuid": "1412aae7-45a6-44e3-84e3-63f45e1dd5c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424285, "uuid": "a62101b8-a00f-4dd3-a465-3a7d43d1957d", "value": "UStarteX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7585f17e-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446339, "uuid": "bc0236b7-1ecf-4ac8-b7b0-776c3ec0ab26", "comment": "Malware payload (Mirai)", "value": "224e27f09b2db4e14cd4fed041b8fbe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446339, "uuid": "b9865c71-e21c-45b2-868b-ee90a73c456a", "comment": "Malware payload (Mirai)", "value": "ce1e2970fc032ad437f9ac51f7e9f3899253b106aa1fa6fe29883174674b1cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446339, "uuid": "badaa109-b78d-431c-8294-8901b5ced442", "comment": "Malware payload (Mirai)", "value": "1c4e5a175afcb7c8b116af11b4371ef3195d9c4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446339, "uuid": "87af7fdd-0e86-4b84-b871-9e5ad2da0381", "comment": "Malware payload (Mirai)", "value": "59ea5f00997d894e9e471626d4ca0ccb4b6c6796f391a418f7c7af92abb5f73071cc669012c592180f182343c40c5c7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446339, "uuid": "d13d6579-60d0-42dd-8473-83c37a9f6624", "value": "T1B0B34A52F404ED6FF88AD7760283CB35B63173A58BB30662B653753BB9393A00D16E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446339, "uuid": "2c5104f6-d5a5-474e-be4a-14e124966325", "value": "1536:eIrWAi60iShND+CgpwnI+r1dP9RLs6yKZOyk9rR0Aeth3C:eIqjDNgpwF1FTLs69ZOy80AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446339, "uuid": "cc76e47f-7303-4884-8a96-19da69f13f81", "value": 111924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446339, "uuid": "e6150f5d-c048-445a-b54a-801d2173a427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446339, "uuid": "dba34245-2062-4158-afec-3e8510117d48", "value": "SecuriteInfo.com.ELF.Mirai-BYP.79931957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214c9c4e-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370177, "uuid": "f5072cfd-5556-4830-b9ea-e77045689c0c", "comment": "Malware payload (Mirai)", "value": "321d85c40575942568f1f254bd2f4c36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370177, "uuid": "c29cce33-d9ad-4bd9-a8e8-e06c1b695cd4", "comment": "Malware payload (Mirai)", "value": "ce6cdd32be80466f6207d7d77a55ef4bc781f77eababdd502bd7c99f881865bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370177, "uuid": "f0868c07-f324-4262-b4d8-9e5622d8a212", "comment": "Malware payload (Mirai)", "value": "93ed8ba1d0a1bfd46dd9c2a70fab73708dcdfb9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370177, "uuid": "e12ed280-0e33-4d15-857f-69e83ba8fe8f", "comment": "Malware payload (Mirai)", "value": "c12748cf830a7a494f10cec57207b1144eecba3e1c3e2409cf76e779c0c4c55658bcb9383523f7452b61d5ba56976ca9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370177, "uuid": "0d40e177-6f9c-4ee8-8ff9-8ca4e916dbad", "value": "T142D32A56E7408B13C4D61775B6EF42453323ABA4A3DB73069928AFF43F8279B0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370177, "uuid": "bfacdf3e-d74d-4108-84ba-406ebb5d7737", "value": "3072:lS6VGvy5uaDAFEsHY07NSIYwxGnVR+SQkM/9iH:lS6VBuaDAFEs46NxgnVR+SDM/9iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370177, "uuid": "29447537-5f6e-4559-8c46-b827cd088b1a", "value": 140758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370177, "uuid": "8185526e-f5e7-4bbd-b4f6-8ee8ccbe0bf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370177, "uuid": "4ac38cd6-9ccd-429d-9d94-b4b1293255dc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846f5016-df82-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766441210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766441210, "uuid": "880b4ddb-f577-491d-acba-c7b6fd40a150", "comment": "Malware payload (Mirai)", "value": "48990db3e06ac79434708bad1a1feca9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766441210, "uuid": "f345130d-eae1-4b7a-a455-d95b5df11ee0", "comment": "Malware payload (Mirai)", "value": "ce8f836fb5f1824ccd36e80792b35673d7517c2720d57736e2b66222ff5d453e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766441210, "uuid": "746e292b-2293-4312-92d2-e762bf9c64b2", "comment": "Malware payload (Mirai)", "value": "f9594b976cd5e0d3e157c9763a7f325c844c1394", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766441210, "uuid": "bded3b0a-58f7-4af3-9559-3380425624e9", "comment": "Malware payload (Mirai)", "value": "2b193168445536e33b0b23b1f0cb11c39e0eb831feaa3ce8b55dc6c18a750938eb514eb90e5d812b7c541a4a254f2aeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766441210, "uuid": "d614b34c-1051-4c4e-8ffa-8072ec669a7e", "value": "T1DB831A86B881DA16C6D466BBFA5E42CC332253B8D2EF7203DD156F157B8682F0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766441210, "uuid": "45dc2a89-ab4f-47b2-a176-1c6de22888f6", "value": "1536:stYEqxCIwdtCcxsfzZPsg2gKwnwcsAVS2kla/8h3IxXgT2bVRL:stYEqoRz8nwrAV8a/u3I1gT2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766441210, "uuid": "3347ccea-7fd0-4902-91f4-32317e8c3698", "value": 81684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766441210, "uuid": "f16cf4db-841e-49db-be71-d295586a0ff2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766441210, "uuid": "4ea1131c-99b7-447f-acd0-071eea8e8eb7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138faa36-defb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766383039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383039, "uuid": "023e380c-a51b-4e4a-918d-9682f386030d", "comment": "Malware payload", "value": "36c1d0b2466739e8ed78fced32d509e4", "object_relation": "md5", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383039, "uuid": "188431fc-ccb1-4bcb-9f9e-8a4bbe4a1b1f", "comment": "Malware payload", "value": "ceaef98ebe3aba6b8ee969197b14031c3abb3fcb1bd84e041c4d8806ad81317b", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383039, "uuid": "8c22a659-3c4d-41db-80b6-b7db9ea44396", "comment": "Malware payload", "value": "a0bff7fd74ac7cb6e97f7505220e587d0658d9cc", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766383039, "uuid": "6cc3400f-478e-48c3-8f8e-499e84ced969", "comment": "Malware payload", "value": "f2877e1fe7acc587efd93b96f47ec83dcabdd90c0e88dcbf757147ce95b39a627736fc9f96b93300311caf0eab8ba193", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-132", "colour": "#FCE258", "exportable": true, "hide_tag": false }, { "name": "bocking-netlify-app", "colour": "#EFA5E1", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383039, "uuid": "dd68295c-1a68-4b83-9d8c-9bd316ff780f", "value": "T1ED52FFC3F3C45BE7E256B72762D66D2D970E07D8C0BB50883DEAD20B266DC604219D97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383039, "uuid": "23002499-f615-4083-8b07-38f960605e64", "value": "384:a27AaUdoz2FtYomZI+s28P3YL63wpTTdge3RCTK8QOCq:T7DUiz2FtxmZ9p8P3a3TTdgesQOCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766383039, "uuid": "e87184a1-e08c-4e38-8f28-7eb003963d7e", "value": 14162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766383039, "uuid": "db319307-8e11-40f9-ac4a-c4032f6c1574", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766383039, "uuid": "561f08e1-21f2-4650-ad52-2db50c41be41", "value": "nipoli.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d31486d-df7e-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766439319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766439319, "uuid": "c27b0027-56f6-4da9-960b-a1a61c20c6c2", "comment": "Malware payload (Stealc)", "value": "0a8b53d32d0ace1a69289ddf876045c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766439319, "uuid": "ef57ab65-433d-46d5-bf4a-63af58521788", "comment": "Malware payload (Stealc)", "value": "cef044e0065c13da7b0d6c4b4d985dd4c24d86893d4f0084f1d844972cfd3927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766439319, "uuid": "7445a056-f16e-4dde-b802-a4d68e307761", "comment": "Malware payload (Stealc)", "value": "c0ebbcdd1d095c2c6c3ed9675adefa41375eadb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766439319, "uuid": "8edc6c25-5819-4b92-8e6c-ee8604366e67", "comment": "Malware payload (Stealc)", "value": "5cac8f91eff11d6bcd4f1a7ceec54d9b4d056f67e92c6028b2f332bf1683f6c51ca68c199fb775ad350e455d1f05f67a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766439319, "uuid": "b49e9ea9-d4c2-40eb-b1d3-f9d4ee0f9eec", "value": "T1D1A56B47BC9115B9D0AED2328A6652527630BC990F3163DB3AA0F3F82F72BD45E75318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766439319, "uuid": "aa9665a9-1d96-4c21-a06b-1ec22520ff9d", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766439319, "uuid": "fdc6cb80-d948-4229-b360-a0c2ae194de0", "value": "49152:xzAUxQXmUP3ONrb/TcvO90d7HjmAFd4A64nsfJuTe9HC5LJfpSDny+OoYg15Q6ER:NrG3OCJfWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766439319, "uuid": "4b2cc893-c46b-4140-8f6c-36daacf488d1", "value": 2224128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766439319, "uuid": "677e7639-f447-4470-8ad8-03eb3c280e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766439319, "uuid": "0fc3e1a9-a89e-48c3-a40e-218060f1572a", "value": "0a8b53d32d0ace1a69289ddf876045c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8ac0f7-df12-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1766392990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392990, "uuid": "594b171c-cd84-4389-8b52-cccdd35e4cf0", "comment": "Malware payload (Socks5Systemz)", "value": "9864fb1d14d3e8e901adeac9c7f223e2", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392990, "uuid": "5fcb9f90-e348-4204-af43-c7aa32b59940", "comment": "Malware payload (Socks5Systemz)", "value": "cf52dfb895abd3686b216b7e34723d8b59942cde8ecd5f9103079393afaea78a", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392990, "uuid": "e899eb4e-de92-4341-8c84-f24d746ab183", "comment": "Malware payload (Socks5Systemz)", "value": "2810b3b278be52cdc5d29e8452dbaf4657c38965", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766392990, "uuid": "1bb7220e-a4b7-4bbe-a6cf-5453a8b10c45", "comment": "Malware payload (Socks5Systemz)", "value": "e524f98455c715b9338bfa03e0f4f2a043a56764ce9ac57d924f2c27d4ccf85a3413470d825a3bbbea178dcafeee32a9", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392990, "uuid": "e6d32a4a-72f6-4824-ba27-874f4886f4eb", "value": "T145F53303A5C4257AE1E2953D0C5586D568362C022E7B326035DF99F6DFBF28ABE1336C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392990, "uuid": "59dbd4e1-f2ac-4d18-b281-a154e51c6e5f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392990, "uuid": "78cf064a-6e68-422a-9ae6-275c10c0258e", "value": "98304:M31UiOzadi8aYA063bbzd453xImZnLYyqyEjW9AJeYm5BV:IIcJa90636X/5PWmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766392990, "uuid": "2dd8eabc-1e00-482f-989c-ed128b0be71e", "value": 3633420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766392990, "uuid": "4d5978a3-c4be-43c0-9328-e1e4a1fc3967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766392990, "uuid": "2686ebf1-b0b1-40f3-b220-8f6adf1c6950", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99354c11-df04-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387129, "uuid": "fbd7ab2c-c803-491d-975f-28070cb04cdd", "comment": "Malware payload (Mirai)", "value": "ea9e44e88d098f36e34c23d48eec7588", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387129, "uuid": "b9e3b263-6117-4826-94f5-6f1f3d82b694", "comment": "Malware payload (Mirai)", "value": "cf642a2210f02af51797257777169041c7d55d1558d030e36ce69d2321ff8601", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387129, "uuid": "f5398109-c89a-4d11-8974-37c1370aed8d", "comment": "Malware payload (Mirai)", "value": "3a42214fa0f5b1440f10081986b6dce6582dd03a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387129, "uuid": "c6d9488b-4267-4284-835f-de856f71353c", "comment": "Malware payload (Mirai)", "value": "c0a789de67a4f5dafe45707317ba09db411a231f540e45bf7648c421e685e8b4dce1e0227b361b21f7f82ce8217d20d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387129, "uuid": "651ac34e-cde1-4e2c-97bd-646dd8093420", "value": "T1DCC2E174D2025EC5CF6BBCBD2E70D6E237755F5B275ACE9510468B3026222E1A3362D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387129, "uuid": "50829408-518f-457e-8f4f-2f996207b481", "value": "768:8tm45q7uFZx83MA49dpAsnKq/VwLlZf14uVcqgw0z9:cmlSFZx83VcpKqGHf14u+qgw0z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387129, "uuid": "d9c65ae5-5301-43e4-94a5-0f55850b52e8", "value": 27192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387129, "uuid": "83d18779-0724-4a6a-b972-4a5389a4cee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387129, "uuid": "a92dfa23-94a9-414f-b993-d14336b14cc6", "value": "frost.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba3b01e-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384690, "uuid": "ec5b46ff-48b6-4a76-8a42-7aa12a497ccc", "comment": "Malware payload (Mirai)", "value": "a76be1fc53c3f3a928e056238aec112f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384690, "uuid": "3be8747c-f436-4903-b01a-214707a0e150", "comment": "Malware payload (Mirai)", "value": "cfe15493f8c7f3c7c6a82dd154c1b1d439a573cdd95f10c2c887437f26e94150", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384690, "uuid": "6dada385-19e5-47a8-9937-3b9193cff3aa", "comment": "Malware payload (Mirai)", "value": "64573d2ce22a671f1de8cd250abd088f4f5f93d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384690, "uuid": "7d94bd96-b1bb-44a6-bf1e-4fa38084c7a1", "comment": "Malware payload (Mirai)", "value": "35897a3e75643c95aad465d9a95ee16fd617693e04b0d6287f96f62137a9b85697257e3096361eb185b35a708acbfb02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384690, "uuid": "ce88f324-63bb-4cc2-9e78-5dbd225fdf40", "value": "T1C563B60E6E219FBCFB5C873447B78E20A65833A626E1D245E15CED015EB034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384690, "uuid": "153f9bcd-9578-423f-8499-b1953ad24df8", "value": "1536:i1xZeojGvZuKrgFrmWRTBKH0toHMXqbZwxmvi4OJpEJPsi6KO:i1xZeojGvZu9FrfRTBKH0toHMCDZJPsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384690, "uuid": "78ecaa3f-ab28-443c-a183-30f3a5148ea8", "value": 67808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384690, "uuid": "52c8524b-43e2-4d6e-bafe-d1839883a24d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384690, "uuid": "14c21e02-62cd-405c-9dc2-69b5a1f68c9d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364ba2a0-df3b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766410585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410585, "uuid": "1ba33e5f-4b8a-4434-b4b5-c8e8a7484392", "comment": "Malware payload", "value": "f21ca956660a00dfb799c4dc0dffc501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410585, "uuid": "e8ae559d-faff-458d-a7f8-95d6b2fe4883", "comment": "Malware payload", "value": "d02614602759f4f8556091ffe95514640e0835c6d7e9715f5000d6dba17bfe58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410585, "uuid": "a5b2792b-8e00-4566-a220-f69c66c0f978", "comment": "Malware payload", "value": "a66b29369c66e1e30fb5e98742f57867e6305377", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410585, "uuid": "3c60b81a-903d-4592-8f54-d40aa7d7fd50", "comment": "Malware payload", "value": "f5fe8b602331b88b060f2094361a628a5bd9706513cedcb9e65cbe5ec963ce7a9bb26d1e377f0b648883f9afd44a951b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410585, "uuid": "c14a126c-76a4-4aa9-86a1-a3df4d180031", "value": "T12D94CF52F3143A97E10A8135588147406B84AE7573E2E303FBA7B27D752B5F58F283AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410585, "uuid": "5b02cc57-d646-44d2-88d7-e21e93938c9f", "value": "12288:yXxM2fkTnicNxOHD3nIqQOQI08lizSy4fdPzUU:n1TnpNKD3DCnsfp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410585, "uuid": "d956385e-8b37-4d99-b11b-63b1df61401f", "value": 432384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410585, "uuid": "5d7314cd-aa17-48e7-91fd-c9dd01012ae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410585, "uuid": "dfd4eed3-bf9d-4780-8cdf-82798a40a6d3", "value": "rondo.armebhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c418b8-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384682, "uuid": "d1f50786-0cc0-4039-a95b-082ea66c7953", "comment": "Malware payload (Mirai)", "value": "8926303749776a9133844b51447eb56d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384682, "uuid": "772d407b-9d98-477e-9b20-bce05b3a1ee7", "comment": "Malware payload (Mirai)", "value": "d0ee413c5fb0547ac39287393ccdb7070d3153805e45c6464da18dc9c60408aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384682, "uuid": "6c2ad543-8380-4549-b1fc-a5ea198b9758", "comment": "Malware payload (Mirai)", "value": "699af294c7f7b86f3a7449d3bbda942b18e763a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384682, "uuid": "b068c0f4-f46c-4186-bc24-cea3baf2ea76", "comment": "Malware payload (Mirai)", "value": "ca82f1fbda185288e0db5d9b9fd75e88deb18bd5530a8121c9323a42c738cb8ebd0866c9aa2866c515267e51226f212f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384682, "uuid": "541ee9b6-84f0-405d-8c6b-28005122a101", "value": "T147331AC0F94BC8F5C807893090A7F33FCB71D8394175E6AEEF59AE65DA27642421628D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384682, "uuid": "05278a14-caee-4dcf-9c61-7fd6965e55dc", "value": "768:Ejf9mvyavZmpI6tZiFGustpGuiN/q230tZdgJh7z2fBVEv6xkMSmy:2llNI6DiMuOpGuWihuXz25VXxkNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384682, "uuid": "253febe8-2544-41b3-849a-2de501095197", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384682, "uuid": "5af80fd3-4a42-4ff5-b7f2-f38440b98ad7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384682, "uuid": "d225f84a-5da7-42e9-89d0-2f32ec5465a1", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d164af8-df74-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766435239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435239, "uuid": "01469989-f2c7-471d-a0a6-3a9e9628571d", "comment": "Malware payload", "value": "76c11d1b608cbc136524b8b7dd5e4903", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435239, "uuid": "a027d4af-d06f-486c-a687-6b4d71fb567f", "comment": "Malware payload", "value": "d17a3b074caba6fec94711d6c0d446ebd9d806df726cddb63df933c0bd88c42c", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435239, "uuid": "d367f134-2322-4faa-992d-105eaecb0740", "comment": "Malware payload", "value": "3274d1cf2925d067665ea64d8930517583ddde48", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766435239, "uuid": "60e1dbaf-7a70-48ac-8eb3-9968af253b98", "comment": "Malware payload", "value": "c7b5482d4b3d11ac191cc3748ec98afe103c70f7efbea4e10e1f8d0862060aa7044f13e68c0cdbee92664b1f22259b7f", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435239, "uuid": "bd1bf63f-d7d7-4a5c-80a7-b8127b00e513", "value": "T1737633C6AE139FD6D50D457D0F7229993209C4DA2E827FCEB3A8EEC65C8260113BF945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435239, "uuid": "50b5b6c1-ba0f-4e3b-b587-545c5c7e1b95", "value": "196608:famFe3sJZKmrtUmISHk1MpJ18gi/mTFQDk6fx:fNFeyximIjqTS9Nk6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766435239, "uuid": "9eb5fbf3-f889-4918-8dc0-9f0f7ed74f96", "value": 7321094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766435239, "uuid": "afe6c734-c83b-4a9b-acb8-663899b036c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766435239, "uuid": "c4cb699e-33d2-4925-a2b9-d6afef73e774", "value": "Document", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfd836b-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387484, "uuid": "c5005fff-c6e1-4709-bfc1-843f3da160a9", "comment": "Malware payload (Mirai)", "value": "47189951d4a2ccb29ef7f4bb5b903e62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387484, "uuid": "eda5e440-85ae-406b-8262-3f726603bfcb", "comment": "Malware payload (Mirai)", "value": "d265fd196d8c4113f2a52dd397cfd60d75c125983f944e4869adf929e78ce039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387484, "uuid": "4d90fed9-c686-4f9b-9abb-20319aa3314e", "comment": "Malware payload (Mirai)", "value": "3e811b0c27048c89d9a74a6d0575f75bfff8d6e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387484, "uuid": "d07fb08f-9b2c-4de9-a537-74107f6b5448", "comment": "Malware payload (Mirai)", "value": "3f72e3b32d230c0ba2194c770cb84d0fbb4d17c6d4558c62ac1232386368d30c9a727f027886056afeffcf3171494dc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387484, "uuid": "bb685b45-3898-4e41-93f6-d9ae79aeccad", "value": "T1B2534A9AB802DD3CFE4BE67A54160E09B96473C142C30F27A2A7FDE3AC731945D16D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387484, "uuid": "8a11fc9e-e4aa-4b13-832c-dcd39f667ec2", "value": "768:WieiqxPpW4WRREIxj11H8SlsLIQC7Dtw8ZIUu/0V1xM7V6LeqX+d8JwGKlC8:WiUJyjPcvE5mOI9/0tM56iqXm8fKlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387484, "uuid": "8edb45c2-1d26-4bfb-9884-ba9a0007f4c0", "value": 64792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387484, "uuid": "3a3dd4e8-05d4-45ae-8ffe-a421fd3ed4cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387484, "uuid": "9b8a480e-f27c-4ace-becb-9603a4c0d6c6", "value": "frost.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92815b5a-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388835, "uuid": "ea102bfe-0e65-46e9-bb3f-822f166d89ac", "comment": "Malware payload (Mirai)", "value": "a5bc87c4314a37de258b391e1ccf1972", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388835, "uuid": "2eeb8d44-9733-4a2d-add5-40ff69e78898", "comment": "Malware payload (Mirai)", "value": "d2c6988e49e77b5850afac5d42d1eff103c0f911cfdaee4ee5f980086ddc1f40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388835, "uuid": "fdcb7177-52a8-4508-ba81-b5d69ceff50e", "comment": "Malware payload (Mirai)", "value": "6454280ba6c19e3e3cba4006a7e9b95ffe1c1e90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388835, "uuid": "b95a6e3c-65ee-42dd-933b-981a029c52cc", "comment": "Malware payload (Mirai)", "value": "6a1fb65da2157de3c2b103579b27728bd902f36dcaa9416bfa1a7d2d6e960127eefa760ddf447e46216d885d0ba3f013", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388835, "uuid": "c34f816d-b9e5-4e8c-a4fa-c9d0e07f2315", "value": "T119A2E01472632D66F3AD1C3DC96A8357F9A71BFC80F6327279451A20C94920A3E39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388835, "uuid": "59760ff7-8bf2-4f43-8d2e-f305572c7f5c", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjbwhymdGUop5h3:TvQn4j+ZO5fKAlx3ws3UozZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388835, "uuid": "77df0272-1ef3-4e98-83fa-86b767698a6b", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388835, "uuid": "17eac8d5-755b-41e4-9a6f-8d1702e77795", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388835, "uuid": "6f9120a9-f00c-4134-9b99-ad3711d58940", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a5ac03-df42-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766413510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413510, "uuid": "91b8780c-0f95-4d64-abfd-7d4c64eb5963", "comment": "Malware payload", "value": "9026d365f677dc078721406a780b14f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413510, "uuid": "5281337d-9143-4f65-947b-91ea3f61275a", "comment": "Malware payload", "value": "d32c0a59471acb3015253bb8504c2cea8bbe0693456a832e0b92145763a7407c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413510, "uuid": "9ec832c1-a050-4446-835d-3d2d8aff76ce", "comment": "Malware payload", "value": "74afe4ba422942f25f8e366ad98c45a24153021a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413510, "uuid": "52178879-9848-47ac-b82e-1aad8e8ac2b5", "comment": "Malware payload", "value": "245d6d0da4a3983061403f2b0a0cf0473cd0435d5c36bd510c0333b17a170f6aaf98b67a0957e684ba2b87f44b3332f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413510, "uuid": "504ab16f-eb07-4de7-b6a7-2f011b25c794", "value": "T12B9649A3FE904266C19FE179D8B2414572307C48073425D77BA12B655EBBBC42A3BF2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413510, "uuid": "6a2e69ec-ff12-4391-882c-7cb29c777886", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413510, "uuid": "abcc80cc-6ff9-4db5-bc9f-de9ce33e01fd", "value": "49152:ih/rwT3ecB/wUNEe+uPHE/ecN2YuldmTppUc:iC3/wQk/ei2YYWqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766413510, "uuid": "be34a29a-3821-4724-867f-d5cbc98d38d4", "value": 9197192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766413510, "uuid": "67db3ad0-ffc7-4179-87f7-aefb1c625ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413510, "uuid": "69c1e142-e3ce-41c6-bc37-88ce1372df24", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1686bf50-df90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766447039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447039, "uuid": "0fa6b031-26ce-4a5c-9465-b3eadbb0adc7", "comment": "Malware payload (Mirai)", "value": "3501079d2d0e2f48c0c7d0cfdd71cbc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447039, "uuid": "d7f8e716-f0b6-4776-8a6c-e408bac3545d", "comment": "Malware payload (Mirai)", "value": "d34ae1ce031daa7160009d092903d9f81d460697e91bb8c4321656241218af60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447039, "uuid": "7aec7d02-52bf-4331-829a-1af45f55f2e1", "comment": "Malware payload (Mirai)", "value": "b7abe2df5ee6a9263a046b2c06698a73077e7799", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766447039, "uuid": "3ca6723d-0581-4da3-bcd2-b6caeecb1b33", "comment": "Malware payload (Mirai)", "value": "76c9bf6b2c9d05d7bda34c2b81fc07ca86366169675f6b064820719d1f490228bab228c198b02df115813cc01cd64519", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447039, "uuid": "b6bb845a-e4e1-4c14-ba4a-011b0012ad8c", "value": "T165833B86A400CDBCF84EE67784574F10FA35B7119F520F27A665FDB3A9720988E1ADC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447039, "uuid": "4c8e91f1-42fc-4602-8457-7a2eabb94644", "value": "1536:AeFU4rgdrqUOE525hzDGn6TrkaY/8QjOEnBkXc2MqxKR3IginETPN:bFU4UqDEO9RTr+HOvXc9qxKR4VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766447039, "uuid": "ae0017a0-cc8b-459e-8f8e-68000c2e546a", "value": 83760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766447039, "uuid": "1dda8a0e-61b4-4ee2-aef2-a04fb1d0c724", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766447039, "uuid": "03146048-0374-4ea9-9916-a39ea23bda66", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe9a587-df6f-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1766433177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433177, "uuid": "5752d42f-2fbe-4f7e-9a9d-7d15c415f445", "comment": "Malware payload (RustyStealer)", "value": "26c0aee6c79935ee6da46e6444f1c109", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433177, "uuid": "44d83151-fec7-40bf-a0cb-c85195b35500", "comment": "Malware payload (RustyStealer)", "value": "d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433177, "uuid": "5f8a8df5-12e0-49c2-87a5-41b4145bfbb4", "comment": "Malware payload (RustyStealer)", "value": "26b9b123e0f664dd9792b820255fe991496cf2d6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433177, "uuid": "f801174b-a777-474e-95a7-bfb0ba24e057", "comment": "Malware payload (RustyStealer)", "value": "fdce9a58c538062b9c51366be896a29019d72835085e72efc64ef2b8ebf8758ab7e6524f4680c1a12e3980bb2ffbbf1a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433177, "uuid": "9fd84c8b-77b4-41ad-80ab-c3b44e9ffecc", "value": "T14F854A03F66584EAC56AC07883566232BB72BC8D073576EB26D47A343E76FD02A3C715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433177, "uuid": "7409a6d7-1ef1-4f51-bed1-402e8241d9fb", "value": "49152:o2+a9ZTGUJRqMwLVMMWZ3i5O7TEeiLjU/9ax/:GuqjeoU/9aV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766433177, "uuid": "2e7f6b08-1445-46fb-8933-3e65074c7651", "value": 1773568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766433177, "uuid": "a58d3497-2948-4d6d-9501-38811e3784e1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433177, "uuid": "8339f332-0d18-4e20-9d01-619dd067fd26", "value": "installer_1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d98ddae-deca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766362010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362010, "uuid": "fcbd0b55-e8f1-4966-b09d-af5fed11bf3e", "comment": "Malware payload (Mirai)", "value": "f1d67871159088ca2619121ff5f06c26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362010, "uuid": "376342e0-21f1-4a3e-ba89-2d3304a5cec0", "comment": "Malware payload (Mirai)", "value": "d5ec332ace2e37a23b28fc7cf8e5a997f8257c6d48e23b4efa2d6c3e3d6293b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362010, "uuid": "8f7e593c-5a54-480a-95f9-c7a38039d3cd", "comment": "Malware payload (Mirai)", "value": "d5ded2441549782fcdd6aa6ef93fd26f14072bcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362010, "uuid": "73a7b3c9-5d1e-4f4f-8ec8-e1da49814f0d", "comment": "Malware payload (Mirai)", "value": "bc50fb975f40f7976c875b25a8a378e943d6d6cebd9608307e711e2f17f588485a14b5dbe0cc18a2106a6cd8d21f7852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362010, "uuid": "a278df6c-ff8f-4468-be9a-e9b0f0ff87b2", "value": "T164A30886FD819B21D5D522BEFE1E518D331357B8E3EE7212DD206B25378A82B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362010, "uuid": "b1febd98-a129-4012-9695-5f376f80d854", "value": "3072:UCGY1QTA7VpT9eQSnISBJyCpAvF7ExxSqT2l:UCT1Q6eQ+ISBJyC6vF7uxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766362010, "uuid": "95344a64-a123-45c5-b967-a396d9d3569a", "value": 105120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766362010, "uuid": "d740e20a-0e82-44c4-9183-8479eedb0988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362010, "uuid": "74c325d4-ffbc-4054-b49b-3e4b788bbdd1", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97baa2c4-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397864, "uuid": "4b721110-1eb0-4074-b3b0-ce277a8f932a", "comment": "Malware payload (Mirai)", "value": "b878e81143acdb27d186a1e37e9ddaf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397864, "uuid": "16db891d-7c68-4b55-be56-a4991cbdbbfe", "comment": "Malware payload (Mirai)", "value": "d5f8cd97c9934b17559179623aeb7b7a9ed580d9367c051bc92e83362af8ca25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397864, "uuid": "b0d778b3-60a5-4e15-a1ef-3fb5fcf6325d", "comment": "Malware payload (Mirai)", "value": "7d4332c6c338e5965bbc155331e9aef35811fced", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397864, "uuid": "ddeba58d-694d-46e0-afa1-3c0a9bfec20b", "comment": "Malware payload (Mirai)", "value": "66a9ae534383a8b43804e4acfc087934339c1a6e5792bec21c4c7be6879bbbc59b4cd08632528ef71ca3cedf191e9626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397864, "uuid": "5ca6a0d5-f29d-4e43-b22a-5679856bd835", "value": "T18AA34B02E31C840BE6E70FF427BB53E1936B6B4126F5E282760997454675B329B06FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397864, "uuid": "11b8615d-ef83-4d56-a872-6768e0868fda", "value": "3072:yTfwNU9yt3Nl467jlN1KdJjy7ychVtRyN:yTfwN7l467/1KdVy7ymVTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397864, "uuid": "035447f4-4a45-4328-a9d2-d686ec40df1f", "value": 104832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397864, "uuid": "92ca1f71-5efc-4252-a214-d3c32183e3fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397864, "uuid": "afd16101-e301-4ac5-8070-ca8c1e4dcab9", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fc5495-df40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766412948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412948, "uuid": "c2abe47e-e96d-454e-9b0d-3981c34a639f", "comment": "Malware payload (Mirai)", "value": "7bd3408de2949543e41c6b55aa45cf7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412948, "uuid": "8495a1ff-a831-4eeb-85d7-3579c2a362eb", "comment": "Malware payload (Mirai)", "value": "d697d91bc302d4941415266e7c6b503cfb3a286bfe4d19d7c3ea4eb297d56e88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412948, "uuid": "7a5ab5af-db7f-44cf-8a42-f8174cd8b6e3", "comment": "Malware payload (Mirai)", "value": "924b9b473eb68a929f5e482a66dbfd9b99699169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412948, "uuid": "19f78281-2e0d-4ec4-aec9-95ea1c291238", "comment": "Malware payload (Mirai)", "value": "533db1b4d91e2264bc5a0bf59866ea411384bd3e2df63514aa2da875d0d6470fc7112097a374f75f70e73f59099374e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412948, "uuid": "cf8ca15e-ba5f-4b1f-b3cd-b1f08fe6673d", "value": "T159F32B56EA418A13C0D6177AF6EF42453323A764D3DB73068928BFB43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412948, "uuid": "69c6b5c9-a613-4f1f-ab56-71c845387952", "value": "3072:pyMI8VOoJedaDjDrx8vxu69VIH7APaJu6Lur3M/9ZZ:oMI4adaDjDrx8vT907caY6LuLM/9ZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766412948, "uuid": "9c9950e0-3dcb-42e8-96d4-36635c7b3d64", "value": 159738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766412948, "uuid": "80b8b017-d9f2-4e8c-8d90-8b015f29d951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412948, "uuid": "bb7dcf5f-ddd9-4e12-8604-8d87ebda1e16", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d893935-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370171, "uuid": "2480a6f1-8155-473b-a49f-7cc286b60d8c", "comment": "Malware payload (Mirai)", "value": "089c2287dfa70e10b55334515091af64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370171, "uuid": "3be8b67b-d929-4175-a8ed-d41790c10b99", "comment": "Malware payload (Mirai)", "value": "d76029d827359aba3a619bf54644c00513150243b406937e0708eb1282e48886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370171, "uuid": "e727c91f-b0fc-4272-ae6f-8effa7cd4b93", "comment": "Malware payload (Mirai)", "value": "04f7dd3290d58223dcef111e1e6902ed5b7336ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370171, "uuid": "990eda63-649b-4f43-a633-0009d9f16186", "comment": "Malware payload (Mirai)", "value": "d05e5a070b28d7f7cf56bd51fa0dc04c276e789b1c4f0175d0bb6bd34815376a66ae4002a87d7b6b875eb4bf0d985861", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370171, "uuid": "1d97dd6d-aa18-409b-abd3-6e3e6b27e3c4", "value": "T10DA3188AFC819B15D6D522FEFA1E518D331347B8E3EF72029D115B14778A92B0E7B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370171, "uuid": "78968750-ba0b-47c5-8fcf-c65c80d2d3c5", "value": "1536:e9nlCdZwyxYiTZMEOmQI/ChQ6FepCyoD4QNpfcw3sM9o5EO3630Nlu1iBc0027+7:bohRPyoD4Cpfcw3sko5EO3+ah77+xWqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370171, "uuid": "16d60b97-7479-4219-b0a6-64d1dc6318ac", "value": 98288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370171, "uuid": "24219926-1e3e-462d-9330-9088da55671b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370171, "uuid": "6229c9b4-18c2-4549-ba7e-ee3f8b35ac66", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ac02a6-df76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766436216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436216, "uuid": "6e4d7148-a882-4541-a22e-3cd1e26578a8", "comment": "Malware payload (Mirai)", "value": "c710a907918b4b53ed1dd4e80151bb33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436216, "uuid": "8571abac-642b-4697-8896-34504b150c3e", "comment": "Malware payload (Mirai)", "value": "d79395a4d78b7213be8993e568638199c704390fdbfa4330fee630d4dddc3938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436216, "uuid": "3649eb39-7bec-441c-ac94-d15261b256fb", "comment": "Malware payload (Mirai)", "value": "7a3e8a4824c91fbd4176fd46866355403c8ddedc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436216, "uuid": "e81509f2-a921-45ab-a656-2b3ad32ea566", "comment": "Malware payload (Mirai)", "value": "afb6da2dc6fc540863ae379c7821d847de74664e754e7008022a66b0b9f598cef23bd79da3a931efacee921fac80b4a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436216, "uuid": "5e01325a-ee59-4ce3-ac26-b25106b6dde7", "value": "T118E3E90AAF601EFBD82FDD3702E90B4524DC650722983BB53634D528B65B65F4AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436216, "uuid": "fc042ce6-e5e1-484d-b0d3-5e5d55c68cba", "value": "3072:It+U2VLcNPA7FK0jUyv+nPpvBwZbQgSnzi:It+UJNPA7UOUCWPpvBwMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766436216, "uuid": "d6f1a2f4-d954-435e-bbe1-fa83f52f84d5", "value": 146848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766436216, "uuid": "0df68987-a8ec-4cb7-9118-488b4731608d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436216, "uuid": "472d8b17-5e7b-44ac-a9b8-3dea5c10e513", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4a3df8-df30-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766406171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406171, "uuid": "3644e211-90a3-4deb-bfab-9fa46af1d532", "comment": "Malware payload", "value": "f865af4f075b09cca5a1b6637bdf5c19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406171, "uuid": "d49b6657-9292-439b-b29e-2d8aed127fde", "comment": "Malware payload", "value": "d856c66caeba8bb675968ef363b174c89ef810193a8e16359271d690c6655183", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406171, "uuid": "dbfaef76-8cc4-4460-bb7e-2f84b414effa", "comment": "Malware payload", "value": "ac85a4b7e96d19510a833ce3db4f906c55f5f2a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766406171, "uuid": "b0049732-1cfb-4244-9b5f-5df82a74e79f", "comment": "Malware payload", "value": "6b3ea44cfc3b8f9a99a5812e0f361f7985fe1aa4c44cf03b71cfc0b951f18ad5c405ec9caebd8216616b27c660efdc1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406171, "uuid": "100f6d5d-55d8-426a-8659-cb79e9c9be1f", "value": "T10794DF12F3103AA7E11E9135588247006784AE7573E2D302FB97B2BD652F5B5CF287AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406171, "uuid": "319a86da-326a-4b74-b453-b048bdc9731c", "value": "12288:AvGmc5PCSP7P/EWmm01n2ptDon6VyI80SybfklzBz:bUSPz/Om01XqfUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766406171, "uuid": "92e46e56-a217-46ed-876b-615318030685", "value": 432352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766406171, "uuid": "3dc5b723-36c8-4021-bba2-f6e9ffe38355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766406171, "uuid": "59738ead-7941-420b-82d6-30e6f752cd1a", "value": "rondo.armeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53090172-df89-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1766444134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444134, "uuid": "80a484ee-d26c-462f-9cc7-c196c34889cf", "comment": "Malware payload (SVCStealer)", "value": "80d91a12d74dde6c863cbe0fc8427674", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444134, "uuid": "b2f4e8fe-b227-46dd-bb3d-c41c710095b6", "comment": "Malware payload (SVCStealer)", "value": "d898bd013497daf22a83fd7a0d13022336bad30ca1bf7803f0a644b538b12e14", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444134, "uuid": "68e813f9-7ee5-4f44-8bc8-bea8e9098d82", "comment": "Malware payload (SVCStealer)", "value": "608b37216346d6bae1cdf13f3ff746a9aa64ccbd", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444134, "uuid": "c4b80cd4-0d34-4e9f-933a-6ba1bbb8d60a", "comment": "Malware payload (SVCStealer)", "value": "4b1cf7e47b1f92b46c8e8b6ac3f7737838e8f0ba8c9c78455f269ed38b2ef7f177a77e953f2b0e694787c398754b90d2", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444134, "uuid": "991861c7-e97d-43c5-ad4e-2aaff8694db0", "value": "T102538D13B7F2C032F16695B409249B624FBE782156B4D6BB1B8C10E9AFB1690CF35367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444134, "uuid": "3e01ca53-9eb5-47e0-9452-b2daaa8b9143", "value": "55380ca6450e841d3d090c9d1307b680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444134, "uuid": "da04140a-58f7-4cb4-b174-5d74c806fc3c", "value": "768:MUp9fff0yKZax2wNfEiMgQacRZidIZMq+sZhHxDPakkWLEDDNVntAiNwZCi3AhRE:jf0yyaRlDsAqxpSknE/AAhoB2yk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766444134, "uuid": "95340dcd-3034-4663-93d5-56e62bc3941c", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766444134, "uuid": "1b178da2-e599-4260-9b06-6dec2519608e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444134, "uuid": "94e9ab49-9ecc-4f52-b14e-5bbe4df0aa3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d774a223-dedf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766371342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371342, "uuid": "a66ac966-25a9-4c7e-987f-9324aaef4e96", "comment": "Malware payload (AsyncRAT)", "value": "5e6567507683312109ec00ded032fe54", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371342, "uuid": "00782813-37dc-4324-9f7e-7ee06a1eacc0", "comment": "Malware payload (AsyncRAT)", "value": "d94f1a8c06ba2a60cec5d119e68e545f6b896a862bac0e08fc81642ffc61b189", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371342, "uuid": "eca7d407-d783-4265-9c7b-2c239fbd66fd", "comment": "Malware payload (AsyncRAT)", "value": "df7258fbe23f4a0ddaa7fd9aceee548af40d3388", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766371342, "uuid": "2f5f2de9-7073-42c8-af2f-11ea757d333b", "comment": "Malware payload (AsyncRAT)", "value": "3c5934010151cb1c5859c530a6481eceaebadb2d9519843af22f053d621dcf3efc5ea92c7705a14e1c0814f998c8c4cd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371342, "uuid": "2bb86a8f-fbcc-4b57-9d05-73c5eabb312e", "value": "T1DE231A143BE95226E2FE9F7999F12645C67AF6132502D74E1CC002CE4A23BC6DE127F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371342, "uuid": "6752a7c1-adf6-454e-a741-9e2894f5a2fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371342, "uuid": "b2724a3a-c3d6-4989-9d5c-6740bdec1d14", "value": "768:HseY+fVg1ucvegh2f+Wenm51a5vXglAAeb1igUptwE3irAK8RccWrWBNuK:jiucv2fana1N+xb7U353irvYcB2uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766371342, "uuid": "506bbda0-730e-4c5f-b534-1ee9aa101ef1", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766371342, "uuid": "c47b08a3-ac4c-40ba-aaeb-afdf3ece2e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766371342, "uuid": "627274c2-e2fa-4fcd-bcfd-6cf61ffcd1dd", "value": "cb21cn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb955e76-df3a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766410406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410406, "uuid": "bcda6b95-2df0-4de4-bdb2-c35ab0e3a443", "comment": "Malware payload", "value": "b253d5a915c083807a7862741878e74b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410406, "uuid": "c000f5c5-1513-466c-9007-ad47cab968cb", "comment": "Malware payload", "value": "d987f20423453688e30c825a687c777de97fe5d8a1938a995fbbc7ad4891167a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410406, "uuid": "10963ffa-3d14-4d7f-89d7-5bf6bc62d78c", "comment": "Malware payload", "value": "38575bb2e2a82c056b1c99403e05b26d422d671a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410406, "uuid": "8022bc67-fb64-4337-9697-9d81fb2350d7", "comment": "Malware payload", "value": "80c612a448b9df1b8804beef7dd82ff7f8cb8e31e454ab5cd5ce80186e915a6aadcc536e5dd8f901e08c266c3b3a760b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410406, "uuid": "ac9f8778-10b0-425a-af5a-4f91c644c6ee", "value": "T1F73723913CE6A1DCC362CA35C7C66AFCE18A79990E76542F7FCA15012A32D81CDE5C36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410406, "uuid": "89ef3ef9-bacc-4090-8212-1c9abd72c764", "value": "2967a767bac26d54500af1e7666d1b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410406, "uuid": "e8221a6d-f6db-4ec5-8690-48b4bd20f8ea", "value": "393216:qY09CtxNS2X0mPTDb7/j7QIdH+wChdjLeKy+nJa+Nupolt:q1a0u/XQIdiPjSKjnJa+Nuin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410406, "uuid": "eaae97d0-068f-44cd-acdd-a208b5ef6a97", "value": 23001098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410406, "uuid": "715f9d47-2b2e-49c6-8195-e4f0965d4188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410406, "uuid": "7a845626-ad44-482b-acbc-5fcf292f73eb", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6f4900-dece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766364099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364099, "uuid": "2c4fb7e6-46b6-4553-914a-a905b3bec042", "comment": "Malware payload (Mirai)", "value": "fb622735243407ccd59749426c70b242", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364099, "uuid": "d20e6bfa-d7cc-4e04-8e87-ce744aa0b1c2", "comment": "Malware payload (Mirai)", "value": "da5d0d9c238565fb0b3581cfebcbf99975fc603eeb045dec477228ecea22e50e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364099, "uuid": "ba06a48a-dbe4-45bb-a883-4c365006a8b1", "comment": "Malware payload (Mirai)", "value": "21465716f4965758d2207ea9a729c06a52153cbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766364099, "uuid": "c3947a48-ac6e-4b75-8e16-b27c56fcbd83", "comment": "Malware payload (Mirai)", "value": "322ff25d5defbe16a88ca7a3b42d74ae21e5c1153ebf83a11452afd80c0e143242363bfa67931c57b8739c922eed43a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364099, "uuid": "622dc14d-8aca-48bd-8e52-34a419b8c536", "value": "T1BC835B42B2184E43E9A30DB02D3F27E183EE99A021F4B786655FAF4A4675E331446FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364099, "uuid": "e407a334-4294-46fb-856f-0168461b3762", "value": "1536:h9rhNJdMkG/S3QcozNNSlnVU9xuXDtqqmg8T2bVR84S:ZISAZNSM9cXwnT2E4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766364099, "uuid": "97f9d8e7-a087-480d-a45b-87dccc219e01", "value": 81284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766364099, "uuid": "2d62c2a2-24e0-4f4a-a285-fa6635f0ac9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766364099, "uuid": "6ec0857b-b5b1-47cf-95b4-3c64240ca4b0", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab868be-df7f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766440094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440094, "uuid": "1dd6ea5a-e5e9-422d-a051-43fb22f743c9", "comment": "Malware payload", "value": "b5660108a20c62ba418540927110cdf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440094, "uuid": "1b5b690c-f782-4c94-934d-ef684dbc985f", "comment": "Malware payload", "value": "dae2d48b205ebd40a029d64b7143f29fbb35fff3f3b6eb93e8ccd418b37df249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440094, "uuid": "4edddad5-50bf-46b0-ae99-5782e2577a0f", "comment": "Malware payload", "value": "b633ed55ed3f9fe6047c569f79b4d6e6ea6ceb09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766440094, "uuid": "4328e6b1-0f01-425b-94aa-d47cafe18bcb", "comment": "Malware payload", "value": "741f998a995bd9ec75febd820bc7d54293d65cfc9f599e65f5178e3dadadf6ede69b7250c828ea96fae2fa97e9c8b6a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440094, "uuid": "12906f4a-4a33-4ecd-a543-d973f4694e35", "value": "T187E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440094, "uuid": "d96b3b4f-34f5-4dfc-974c-3577fddb8fb7", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440094, "uuid": "5a9f2498-411b-4d60-9d66-e745dbaf3198", "value": "393216:TeF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1P:+rRxvoC/7a0jUxX7h1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766440094, "uuid": "a2cf2931-0bbe-49f6-84fe-cba633cbd888", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766440094, "uuid": "772ac33e-cd23-4f5f-8bc9-e0808543a8bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766440094, "uuid": "e4aac87d-064a-4eb9-bcd9-371c2c9ad36b", "value": "NovoPedidopdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7a77a8-df70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766433495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433495, "uuid": "c8537d5c-040d-417e-a3c1-15f74d45fa2c", "comment": "Malware payload (Mirai)", "value": "a5ba7b1cd54ac94a6a0d7dceda62f629", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433495, "uuid": "554e0c9b-495c-41b9-89e9-494cf6f987e5", "comment": "Malware payload (Mirai)", "value": "dbbb80e5514d68d226d806400849a8bce1f334942512eb20baf09f4d2584fb49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433495, "uuid": "b8364489-ef91-4891-b94b-9901e10db68f", "comment": "Malware payload (Mirai)", "value": "25e164cc56ecde759663353eecd80096d320afe7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766433495, "uuid": "5d70a17b-380b-4c7e-b433-a27ac0c29124", "comment": "Malware payload (Mirai)", "value": "1c266c102ec5d3d80abd0fc2e1fb67828bbcb786104ed9f1e919e6135e432664ec4d99ea5e5d55f971ccc6c4f25cc345", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433495, "uuid": "341cb80e-a2cf-4eaa-9ed3-1e4f9799a556", "value": "T15EB31995B881AA12C7C256B7FF4F428D7716539CE3EE3203CD185F64328B95B0E2B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433495, "uuid": "513a2406-d811-4480-865e-7a9a32a4a721", "value": "3072:o86PsMhNffgwX1hK2jwYZ6LoiwRivwKqOnz4:o5PsMP3gwFhK2jDZ6LoiwRiv+S4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766433495, "uuid": "05a11e83-84ce-480b-b35e-b2e126e4a13c", "value": 111820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766433495, "uuid": "f4bf644a-f8b9-4842-9c42-3470835efcdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766433495, "uuid": "2f4f8cff-a36f-446e-84b7-5b7a29062ad6", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84a25f3-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446559, "uuid": "9b7ba20b-17b7-431e-a863-354386e762b6", "comment": "Malware payload (Mirai)", "value": "0a41c149cf39e65870f731878be8fcf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446559, "uuid": "c4f9b63e-a9a0-420c-ade9-69f9e3da933b", "comment": "Malware payload (Mirai)", "value": "dd106bdaf843ae4081306ff6f1105a24dd7664bdbdc31094a4c200f6fa9a8bb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446559, "uuid": "7079fa70-bcc3-48d6-a76b-e80650218c08", "comment": "Malware payload (Mirai)", "value": "bde6d52b252e51c51f7dc9829ea7268ae9dcf4fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446559, "uuid": "1cab9a2c-857e-4bdc-af02-af76c1f0bf1d", "comment": "Malware payload (Mirai)", "value": "70fe6e2e61ffce8ac559483aabf4f8aed46771c78ad847c29b68bb9f73c0e028f84e284c0de2db0d6692b6ac238be50c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446559, "uuid": "6389886e-b39c-41e3-b05c-79e90688c12e", "value": "T1D5E3F90AAF601EFBD82FDD3702E90B4524DC650722983BB53634D528B65B65F4AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446559, "uuid": "a43ba08e-913b-41de-bcc1-ba54800b0fad", "value": "3072:It+U2VLcNiA7FK0jUyv+nPpvBwZbQgSnzi:It+UJNiA7UOUCWPpvBwMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446559, "uuid": "e8aa0e4f-b6ff-4b35-8823-fd3233aaddec", "value": 146848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446559, "uuid": "d103a84a-307d-4738-bfac-78a036e6d0b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446559, "uuid": "d4cd5d0b-8a34-4987-bd2d-e64a9f8bae66", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9359f5e1-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388837, "uuid": "b37bd3a0-8b7a-41b2-acb2-9729f01a7aac", "comment": "Malware payload (Mirai)", "value": "fc2a4365e970dbd2615197d28bab10be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388837, "uuid": "05b8be7f-f459-4123-ab69-49634bced59c", "comment": "Malware payload (Mirai)", "value": "dd7b2fd074eae780ab4f768cae2b7ccc76435dfd049315a14ddc918ffcc31e20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388837, "uuid": "24cd4180-fff1-41fc-a8de-9b4b74a4d5de", "comment": "Malware payload (Mirai)", "value": "3f54c7c5a8a1d10e16f5c5d10252e5e5406b345e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388837, "uuid": "5c41b588-78db-4aa2-a3bb-91e28a5f9625", "comment": "Malware payload (Mirai)", "value": "e8748381a128545923add28681957d09ba02942832ec412e3a17f24d45d11ff1770246c5cded64c096785dbc899e3a67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388837, "uuid": "e1f16154-89aa-4ad7-af48-b5be1822c51c", "value": "T15A230261850F9EB129303C76EA95D393B6E12AB2C6673013D6290B3C2F75B131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388837, "uuid": "8e8ecba0-a712-4476-a063-2f13c5f7d63e", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3W9q3UELbUXfi6nVMQHI4vcGpvk:DECFd+A6YHAx7LRQZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388837, "uuid": "1bb480b5-0775-4ede-93f5-86daca11a625", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388837, "uuid": "6b0a9425-e8c9-4f57-a4b8-c0b5cb41baf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388837, "uuid": "880be2e6-53bf-45a0-a928-31d12bd51925", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e60f763-df02-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766386064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386064, "uuid": "3dee12a9-f190-43c2-89ce-a54f28591313", "comment": "Malware payload (Mirai)", "value": "875afe659d97cbcc59b61630d4c8bf37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386064, "uuid": "f26b21bb-9b25-40fa-925e-5bfcc4da4db3", "comment": "Malware payload (Mirai)", "value": "df2a5ff1d9f25fbca547bbd8ed3bba1d3a2ac96f4a4c1c92da48430aa3f3a34c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386064, "uuid": "66265ab6-ee74-42d1-ac8f-03d2fe810540", "comment": "Malware payload (Mirai)", "value": "0db77d02a75fb6c5fe99505bf871409fe6b2b3c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386064, "uuid": "61cb78e2-6c9e-44c1-a1b5-26bd0d1fcceb", "comment": "Malware payload (Mirai)", "value": "55c81308b59dd99681e0147bdb3e62c1061024808b3bbb6dfc16328c368e14d7b9b845e351b9559c9fa52dc6a6d9a5a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386064, "uuid": "5f6c793b-c458-4420-a192-c083f55ee946", "value": "T119835AC5A743C4F9FD661278513BE3675A33E6390128DB86CB24BC36AC16A01B72739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386064, "uuid": "2b53b348-66ce-4b47-93f6-ee20c7a26621", "value": "1536:lMjatiShnCLcTVKWbAJVXkAxIsvJUnva8exXCBBbw9hBM7AM7c:H1CLcTbAJKAXqS8e1C/U9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766386064, "uuid": "be5435fa-6497-4506-bafd-27937643ec2b", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766386064, "uuid": "2094d9ee-04fd-4f4f-a75c-a4373ddd7b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386064, "uuid": "3145e9be-3fa8-4115-90ae-fb3e51876a18", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da20b553-def0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766378648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766378648, "uuid": "20ad31e1-e7fe-48a3-9195-54b43aef586a", "comment": "Malware payload (Mirai)", "value": "fd350cb74f1b8e9229956c103a621bf1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766378648, "uuid": "3faa576e-5d08-48a4-bcaa-77b34634172c", "comment": "Malware payload (Mirai)", "value": "e05cd77674237f7742760f087e923194c1809b5a164a37ebbc31719951ce0015", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766378648, "uuid": "942df4ee-e07b-4614-937f-a963da35c871", "comment": "Malware payload (Mirai)", "value": "42ca0244b61f8b2b7dd0a8a92b9bd3a977938de3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766378648, "uuid": "b49a554f-7bbe-473f-ada9-80232bae5ccc", "comment": "Malware payload (Mirai)", "value": "84294845a3836fc9514d93122ecbdd7d0a20c71ec939766ea77503f30dc2c264c33ade6d4dd0831026427f049066faf6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766378648, "uuid": "f3786e78-87ac-431f-a574-c5461892b8e6", "value": "T1255121FD02911B7A34068B2563E355AD9C868FC0B24A575CD4893C279C0F61CBBFAD83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766378648, "uuid": "da0099e5-b668-4592-a81b-a98c6e217663", "value": "48:oQCa0XHa0IOVd5Gsqpa8fnhFgapwMZBYcZ+VVWR/y7AF3OHXfZNPMv7AF3OHXfm:oztJSfHgaGuB9+SQn4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766378648, "uuid": "c8555dfb-6682-4af6-89fa-2ea2f2d08a17", "value": 2484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766378648, "uuid": "c8611122-1c79-4535-bbaa-a0e1935fed6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766378648, "uuid": "a5c6b469-7071-496a-ac31-2ba019980f66", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6ad50f-decc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766363220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363220, "uuid": "a3669e97-c60c-456e-8cff-32d6227aca1a", "comment": "Malware payload (Mirai)", "value": "63e4a9bde355910d99a7fcac769bf67a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363220, "uuid": "9037306d-dd65-41cc-a91b-c64022c91552", "comment": "Malware payload (Mirai)", "value": "e114c8a29885b499183faff97897578b048a4a53a069f19fa7d6f7e531b85256", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363220, "uuid": "fd88c75d-4aef-4b72-869e-ebbc5b2f2f12", "comment": "Malware payload (Mirai)", "value": "f47f757599f78543e4d55e243ae4fb053bba83b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363220, "uuid": "0cf85b6f-568a-4d8e-bc06-7550e0656ce5", "comment": "Malware payload (Mirai)", "value": "fae5753158b71a98390ea711b00aadf15eddf4840bae12e691b2c10fdcf45f457c75f941ca07172b1d7aa15e5d378296", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363220, "uuid": "0de90755-7668-4b84-8a91-cb10222917a1", "value": "T12B734AC9D753DCF5E82A053115B7E7735E72F53A1068EA83E394F933BC12211A64A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363220, "uuid": "68b402e4-9e2e-40fd-a26b-f0dffdc7f60f", "value": "1536:ydUJtGZZSLzUyPlvPzVX8GTeTQFk1/JoO5PxtUP9XRR:ydwGZ0/DPlvZ/EQFo/qiJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766363220, "uuid": "c492e557-c29f-4009-b11e-bbd8459de1e1", "value": 74704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766363220, "uuid": "dc45fe96-441c-47a0-b74c-14e7e5850006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363220, "uuid": "b4634042-f92b-4a7d-92d1-fefb4f23537b", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6fd720-df69-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766430433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430433, "uuid": "411caac2-1e43-47ee-82bd-de61b0343ad5", "comment": "Malware payload (Mirai)", "value": "2cd8d0720a06a9c5a8760f7bcb255349", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430433, "uuid": "469e1497-e33e-4384-a5fe-c85e189257a8", "comment": "Malware payload (Mirai)", "value": "e18d56796d521b52ead1af34d42432827f6cc4511619226389d6622d002ace9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430433, "uuid": "13b248bd-b35b-4c45-b5eb-5bf0978249c5", "comment": "Malware payload (Mirai)", "value": "1ec475a36bdab35685fa8a1aaede4f100d612dde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766430433, "uuid": "13da489e-d99b-4126-9803-0e99a5602794", "comment": "Malware payload (Mirai)", "value": "4a0a3afd68a744be304b4ed59556485b9f527558242a2fb5a54a67e2f72ed7643385cd6e564ca6feb50927f544c54936", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430433, "uuid": "c05217e5-471f-41e5-9ea2-9de94ebb85a5", "value": "T143A35B02A32C840BE5E70FF427BB53E0932B675126B5E2C7360997855675B329B06FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430433, "uuid": "25b6a856-2ed2-4c3d-b949-8c6c47f4f768", "value": "3072:CHvwNU+PyyQmzbhN1K7jy7qcpIvFhzlgE:CHvwNqyQmzz1Kny7qWIv7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766430433, "uuid": "53575815-3fb3-4a43-8c67-f018ea4ccff2", "value": 104824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766430433, "uuid": "a8d5308f-16f9-49f3-943e-9e4b5b0acb99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766430433, "uuid": "75f42d6d-68f6-4eaa-a72a-79aa9d9c07ff", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bfbe17-df60-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1766426455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766426455, "uuid": "989d33e1-e095-4011-b992-27a783f9d8bd", "comment": "Malware payload (SantaStealer)", "value": "54d3b7c67b6ffb08e45e26ae4dac02c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766426455, "uuid": "731cc5b6-dac4-485e-aeed-0d344246a827", "comment": "Malware payload (SantaStealer)", "value": "e1c045c2c33ca3843dbb245bc81d4fa21cf84212af0bca14a5ed16b2bee0239d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766426455, "uuid": "11ef011a-7514-4e67-afc6-92c9bdbde73a", "comment": "Malware payload (SantaStealer)", "value": "d6c92623351e913697eb0e4c32a1cc46da4be6aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766426455, "uuid": "f3103406-c414-4d83-8054-69aff125b431", "comment": "Malware payload (SantaStealer)", "value": "cec9e5ae19ce8903890aa0f712e7803a1c0bb409476604be44903799315d1b8daae642c42be6086c6ef3e8f7a07875fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766426455, "uuid": "79b1a018-31df-4728-b125-a7bd163716e2", "value": "T14B560217E2A360FCC567C1748B6B9672F931B85941347EBBA694CB302F21E60672CF25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766426455, "uuid": "06a05664-6b3c-42ec-9ffb-29046a6fede5", "value": "2dd062c2c751d7c2227b6e994af7a9fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766426455, "uuid": "97b7f20b-37f9-4bff-91f9-afc96b3fa90b", "value": "98304:SDSFPxQstPckvWW2MyWdseSQemF6U3tcbQLxp8j5D1m96GpH0qD:nzQstPZ2cdKcdmbQVpG1bGpH0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766426455, "uuid": "79426401-2afd-46e0-a9ca-8247a0a477af", "value": 6190080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766426455, "uuid": "6f9af417-1c73-4250-b0fc-3a258d9a7deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766426455, "uuid": "b27d7380-9dcd-464f-b5a2-0e1d0ed82bd9", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f02c217-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446302, "uuid": "a3f6db8c-cb9a-46c0-a78d-e45d897fdb41", "comment": "Malware payload (Mirai)", "value": "e277ea6527a8c5bcc73888a38b54efd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446302, "uuid": "95c8bc94-937d-4ae0-9afd-1052cf81c0a8", "comment": "Malware payload (Mirai)", "value": "e214832b789fea7a7b7701cd2a1724e5719d5631f71518e2ff587c0235ebe54c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446302, "uuid": "5750a2b9-676e-4477-a4ea-ed5c0c81dc22", "comment": "Malware payload (Mirai)", "value": "fb59a392c67b41b40124d5f48e4f3dbc437d1b53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446302, "uuid": "efd647df-ab0a-408e-8f51-9bbd81930f2e", "comment": "Malware payload (Mirai)", "value": "8381b16ee5df2d05479aa18c31c7970b68161a1c5e9628e965e5d8317cb5b89438118837586d00088d778102706d0989", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446302, "uuid": "8d0a52e3-ded0-46c3-a205-bc77c6e6d005", "value": "T1FCA36C02A5C084FDD4CAC6784EAFA216C932F46C2371B95E23D47F253E5DE603B6E265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446302, "uuid": "cf980f53-18f6-4514-9700-9a554a485bf0", "value": "3072:VjFkYmBBj/g1ngVGw5v/5AIZgH7FEWJa:VWQgVBRNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446302, "uuid": "295ed69b-4cc7-462b-a959-48edf4b3899b", "value": 100384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446302, "uuid": "f2c8e5ca-a840-4469-ab90-24c223f6b8b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446302, "uuid": "b26b7104-ae3f-4a4c-8ff7-6dc3e212f769", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884610a2-decb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766362619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362619, "uuid": "86bb1479-045a-4327-b355-a4e653f52234", "comment": "Malware payload (Mirai)", "value": "c560a26597588ccc9fca3a7aa26ec2ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362619, "uuid": "e457ef63-3928-4960-8a14-259d7b669d3e", "comment": "Malware payload (Mirai)", "value": "e24188f12892b5ebdf6c9bc48ea56914193f0de9a257f8d740a3288ee158d234", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362619, "uuid": "443ffbcf-9f1a-4f65-95e4-2361b828f7fd", "comment": "Malware payload (Mirai)", "value": "29d01e61008a6b7412222aa24d3e925e2a94f665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362619, "uuid": "154518ab-6dd1-4203-b3e7-cdb0ec348ac8", "comment": "Malware payload (Mirai)", "value": "9218e3385e6b01a05e25cc18e2feff638ef01a7582186820c2a156569c759c0757c509fe6e1e43bc75c70d1ac632006b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362619, "uuid": "04ccb855-7804-4ac0-82c0-143f34eca52f", "value": "T1CF935B21B97A2E1BC0C4747B51F30B35F2F7274A21ACCA1A7D720E8DBF156102557ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362619, "uuid": "0c942220-21cb-44f4-94f8-83e8612f15e2", "value": "1536:I+X9xScBoZQfKekrtSZea2VWc7Hjgn/XJC9UH1bNltP08zm7uhq:ZtI4ieNzE+/XJkUhm8zm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766362619, "uuid": "8512fe59-e9a7-4f01-ba58-606c1b9a8d90", "value": 91340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766362619, "uuid": "1dcefcd1-94cb-4420-b5b8-a42fa92da609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362619, "uuid": "ac5543d6-354e-4b52-90f3-6bdddc3f0359", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7f0f0b-df2d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766404775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404775, "uuid": "882630bf-9475-4dc6-a98e-eec581d7e27b", "comment": "Malware payload", "value": "93c9c76f1ae704c49012d64fd403fd1d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404775, "uuid": "c26d31e1-75ea-4d2a-a680-60e51046fd16", "comment": "Malware payload", "value": "e285a93350ac4f9997258e4e55637506afbc907585ef2d37b2f68e40f81c0b28", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404775, "uuid": "28a7784e-f707-4cb5-b9c7-a6be70c96c20", "comment": "Malware payload", "value": "9f8a63972a8e73acc9ddf5a01ab36cb5d6e6f705", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766404775, "uuid": "5f35ff0c-d47e-4e91-ac97-ac8c19ecc0c7", "comment": "Malware payload", "value": "5ac5da044bb335395de03f608c162f5d212f262ddaf2bad6e55004b05cf02fe293e7b1db328da2b9c9724afc60a810b0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404775, "uuid": "ebe1e5fc-1302-4312-ba69-0bb5ab43699b", "value": "T11A37AD4675A50194C177C038CE67C217FB713C1957B15AEB22A8BADA6F33BE02A3B711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404775, "uuid": "020a71e9-9f34-49e5-b295-76e6eb090850", "value": "393216:cHDeVIXHqkOSvkbbMx65E1Jsv6tWKFdu9CrZVTUogDxX9KRbsTGD:8+5EpZVTU1TKRb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766404775, "uuid": "b6a771d4-e197-42c6-9c15-89aed30d3bac", "value": 23973888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766404775, "uuid": "ef4650df-8fbf-4d62-81a8-1ac3c08baca8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766404775, "uuid": "2e3a85b9-321e-40ea-b39f-c29b1a3c93a8", "value": "Installer_TheFastestMouseClickerv3_v3.0.0.0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdc5496-dece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766363808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363808, "uuid": "dcb6c477-3700-42dd-b285-fa90528794e2", "comment": "Malware payload (Mirai)", "value": "275493d45703fb2d7dec26f605f5ab0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363808, "uuid": "ffd93d27-9af7-46ce-8181-a62e2a181c3a", "comment": "Malware payload (Mirai)", "value": "e293f15bf6d3ae6a6de42b94d0d9ad72e871d96faad67ddcc2cc32495112117b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363808, "uuid": "4a2ea08e-b061-46bd-853c-42459021d5ce", "comment": "Malware payload (Mirai)", "value": "f7e452d386ddae3ca4abd72598ffd4d901a87574", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766363808, "uuid": "09d003e7-6f5a-4f14-8f6e-8280382e3e9d", "comment": "Malware payload (Mirai)", "value": "f709d69d9082d629d6f2e8b61ca6cdc1c8147c6da4af517c8adc16a86e807fbba37bff1d0a06838f6c685dcbf5a0c848", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363808, "uuid": "04fcca5f-2bc0-48e2-bd92-081ed8ad99c9", "value": "T13993C50AAE259F6DF36CC63547B78E30D74823D62BF1C645D26CEA014E6034D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363808, "uuid": "bb6c7a98-0918-46e4-accb-2605a0d95342", "value": "1536:76lNj2+26u86RuiRPo8VVI+rqEmPgiCePeeiYeee9JObR0K1B4LeTAbVRs/0:Sj/26iVVI+rqEmPg1OR5KLeTAE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766363808, "uuid": "0259fd00-197b-41b4-a243-683da58c8eaa", "value": 97080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766363808, "uuid": "07ebdfbf-2dfe-443d-b587-92fe37189173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766363808, "uuid": "3c6c4384-f2e6-4de9-a908-e2660f5326bd", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9574cd3a-def7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766381539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381539, "uuid": "7b0d4255-f974-4083-90f5-c53710c3d7d1", "comment": "Malware payload (Mirai)", "value": "afa698d64da3b1ee28a106e2ea7e70ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381539, "uuid": "1ddb1940-5030-482d-b48e-d939353736ae", "comment": "Malware payload (Mirai)", "value": "e4a99fe52e1565c89b55179626a63c61349b915aeeacd173b4c39d01f378866a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381539, "uuid": "3f4f9d9c-2f75-4cf6-a93d-7b73970db1c0", "comment": "Malware payload (Mirai)", "value": "7a4619f2d36264d707fc45716c3b85809e6a4202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766381539, "uuid": "33250e83-0636-4838-b890-049343f2935b", "comment": "Malware payload (Mirai)", "value": "928c06001b1d6b273d855550ae3ebc215e38ef305b4fba8abb7ae527299caa54b7cb2f6a6a06a0349397c454153a6d18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381539, "uuid": "7068c234-9621-4b75-bf04-d5417bcd3132", "value": "T1D0C34A81EAA3E0F1E18701B00557F3EB8A34E6305156CDDAEFA93971EC716829D9B71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381539, "uuid": "2520bdea-88a8-4aef-8494-b21c329b7f9d", "value": "1536:UbdvbOEoLtc+0vZSX1sKuXFzbYlt7A80xZQkJg74SgvAZrdh4rddi71lYjHyuhug:K9JRSluNgU+kJQgvOr/4Y1aHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766381539, "uuid": "2c95ec7b-101c-49a8-ae7e-acdc1419074d", "value": 119484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766381539, "uuid": "34e5351c-36e4-4ccb-9dc3-8b941a90486c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766381539, "uuid": "0c329b94-c012-4d1c-aedd-2e456d06c68e", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df7e904-df53-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766420960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766420960, "uuid": "5e66abce-663d-4fea-85c3-71dee681fa61", "comment": "Malware payload", "value": "35c58b22eb39ef826794553e1da0bd09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766420960, "uuid": "8e5c5042-9887-4bbb-9508-e352827f25aa", "comment": "Malware payload", "value": "e56aa4a56013428a699d626c3e7970befea642eff8542511d5f9ac2b569d19f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766420960, "uuid": "9ac36afc-f533-47d6-8dd2-8a7f9540cee3", "comment": "Malware payload", "value": "06d5fbf16878b3aaa322f54940bcc298a53b7066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766420960, "uuid": "55303e7d-4aae-4405-9184-aa830ecc58fb", "comment": "Malware payload", "value": "1766a0e1021bf5460bdda233b66c0b499fb711e8ad0bfc06dcd96c5741b83b5e09c7a501d446668dcfaa32b109a7dd11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766420960, "uuid": "4fd28e35-456b-480e-8dba-d89d33a06ec0", "value": "T1E2B34A5B77A540BBE17A8234C8530E05D776B8624760AFAF47A0429A1F233D58D3EFB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766420960, "uuid": "96da1c2a-4b1f-465a-8bf7-b90705f9167b", "value": "6245d613cf86cf3a2137c6627c491d3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766420960, "uuid": "e253a233-ea50-45c4-847e-6e5c0c719d63", "value": "3072:4/cSIvFWzBmLZ3lrnmXrb5cL14v+g5dLJ3BsIL:UIvYzaFnmXbX3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766420960, "uuid": "d089b54a-aecc-48ac-b411-ea4cf4b5a947", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766420960, "uuid": "9394e79b-e938-4046-b72f-34c43325eb53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766420960, "uuid": "50d01819-e83d-4218-a03d-1113a1ba331e", "value": "1766225785.2111099.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bdea34-df64-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766428249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428249, "uuid": "84a3f87c-e54b-4516-953a-21f9a42c17c2", "comment": "Malware payload (Mirai)", "value": "534de8e1b685b250608adf94897e0aae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428249, "uuid": "ae9aa00a-d660-4fd4-a429-5828d1c9aabd", "comment": "Malware payload (Mirai)", "value": "e5b423ac51e2719554a8dbf93b5f201dcd4f16f6412459eadf07e9bd9054c4e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428249, "uuid": "282fcc79-aa57-4b1b-913d-682061f3970a", "comment": "Malware payload (Mirai)", "value": "f33cc1e956884f2ef372c5535f61d51bc28b2552", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428249, "uuid": "131ce618-4a40-428c-9564-8027f83a042b", "comment": "Malware payload (Mirai)", "value": "c5c5c9eaa981edfab38ed5592385592f7273c89d4b26354ae7ef3dcabab9b76f09373aa7a38b77d1d6b9c99bacd04fea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428249, "uuid": "8fba8e32-5b4f-4635-a4d2-c8141775db77", "value": "T1A6B35B53F804CDBFF88AC7724683C735763233A25BB3166276526537B92D3A40D26E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428249, "uuid": "7a499c25-5597-4349-9ae7-c64ae22724ac", "value": "3072:4iTRqXJZLR+NdIkZwqYVs3MQfR5u7hxbR0w:4iTRqYNJKscQfR5yr2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766428249, "uuid": "5c47585e-4825-4645-8b3c-a300449884cc", "value": 110328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766428249, "uuid": "0d75c5b8-1513-410a-abca-70438089cfbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428249, "uuid": "15c53c43-2165-4b24-855c-56cfac8c3d8d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98732a78-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388845, "uuid": "dce123e5-c955-4fc6-a3b4-b0f0629b5120", "comment": "Malware payload (Mirai)", "value": "92b18a04e650083e723fb8c726c69144", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388845, "uuid": "9e3e18eb-2df2-4c7c-9a64-4473fbc705ac", "comment": "Malware payload (Mirai)", "value": "e6389910db7f5ab6de0443cf3e19c95535604a95e9f2b5934f22c17400ffe3c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388845, "uuid": "f70432c2-2d32-4358-9d01-a52578e409a7", "comment": "Malware payload (Mirai)", "value": "4882fa4642cea9fc3930ee95d20e2b5156ed1e27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388845, "uuid": "04d43bfe-e6b1-4005-9068-4d1e7d1e7b58", "comment": "Malware payload (Mirai)", "value": "3495e662cbe93e57325a3ec200a8a8ca942294343983c497b65c5c6678dc469156006476f22d12acb754b6b2773ccc30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388845, "uuid": "9110b8fe-c671-438a-9234-78722d06d968", "value": "T13B336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388845, "uuid": "d75c926a-b4f6-4ac9-904d-c11cae06bf05", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388845, "uuid": "23ffc6d3-181a-4383-a628-b250f2a8841e", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388845, "uuid": "7adbdb25-4315-4fb5-a1ce-76762f4399f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388845, "uuid": "efbffcce-f054-4a9b-b32d-065dd6682cf1", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5870799d-df7a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766437701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437701, "uuid": "8e6588eb-bf21-4059-8cf1-a35cbe796d24", "comment": "Malware payload", "value": "81272a9f3185eafee465f7581ff796dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437701, "uuid": "dde32bd0-99c8-4b56-ab03-ea59f0ed13fe", "comment": "Malware payload", "value": "e6aa8eede0f32c363db8db9119c061904f6cbaafb736858ff1c1d5ef6ac9c6b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437701, "uuid": "ade7f0c2-ddf7-4d7f-aa24-4b92d06c03d4", "comment": "Malware payload", "value": "553e8243253634382bcc174f5a28243acb2737e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437701, "uuid": "5fca86de-a047-4101-a579-b47d9aa93742", "comment": "Malware payload", "value": "2c94139c62a36319f95d30ba3a256ed49f2a37dc05ed169892b1f4c1398c514a56749be2a12020464ce120c1e455d1dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437701, "uuid": "d6510596-be01-46d1-88e4-3045b21689b8", "value": "T18BC4C40CFE81F805DE5A3DB7CEE911104B7169C1AE1195863109AFFD8BA63B349E267C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437701, "uuid": "c6c8d408-0a20-4956-9cd8-4bdefa0f204b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437701, "uuid": "7596e3dc-0257-4485-a7dd-b954be9a050b", "value": "6144:IFVapHCRwDxZr2d8QXz2QA8e6VlWT8b9TxCT9b/Eh2cPUZNltLVljb5eJ4YU2F:cVurDxZSe8PVle8R+g4cPMlde+YU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766437701, "uuid": "32707c1e-5807-42f7-9caf-c760cb744e7f", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766437701, "uuid": "fc94a545-f528-4b4c-90a2-aa73995550f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437701, "uuid": "338b228a-317b-426f-b5b9-2fd5d858dbce", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839635b0-df82-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766441209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766441209, "uuid": "5475554f-7c79-4c42-a220-5ba071b211a0", "comment": "Malware payload (Mirai)", "value": "10d0825cca9a55c234de8c4e40a19aa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766441209, "uuid": "cd2630b5-9862-4f71-89ee-58673212ec0a", "comment": "Malware payload (Mirai)", "value": "e9558c54af92187bd8e634f62d8c3a2f6642cd8078df5c24acf1d59784254e31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766441209, "uuid": "fc0609aa-ba56-48cc-a3fc-41aca93c2982", "comment": "Malware payload (Mirai)", "value": "dcbb7cb5c01b75779c2cf1c38e1cef11584cad68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766441209, "uuid": "fd44ad5c-9a3a-43f1-994f-20817f99f113", "comment": "Malware payload (Mirai)", "value": "f626dd09cca0b9c87758e434505cb65f4eeffa76d8b6efc959f5977559d5978fd96a9c555c194b94775352143031d7f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766441209, "uuid": "62d3a0f8-d50a-4ce8-abe1-24b41bad4628", "value": "T13D735A42B3184947E5670970283F2BE193FF99A021E4B78A754FAF4E4672E33444AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766441209, "uuid": "c4087d8d-aaf1-4e2e-a1a1-68995d0734ea", "value": "1536:6p3RrFKWBXkaUNkWS/SJu/paaXMlPTAbVRc:exvUNsSJuXeTAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766441209, "uuid": "257a276c-5f41-4dce-9cb7-0101dc7dd849", "value": 75044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766441209, "uuid": "ffa15ab0-ba2d-4348-831e-aff8b7c76ff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766441209, "uuid": "c390905e-bd5c-4b0e-a67e-7bf469aca0df", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7828bb-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446299, "uuid": "b9e4aed9-46d1-48a8-b4ac-868ddbdade17", "comment": "Malware payload (Mirai)", "value": "fb669b608c79e57a6d15371392c7b967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446299, "uuid": "666b2e4b-7fb8-4bb8-aae3-0f59366db24c", "comment": "Malware payload (Mirai)", "value": "e95ad3a35b161c37d7ce96adfe5020070d383e346e4f46f6c8632e5e24280cc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446299, "uuid": "a8203122-3117-4f16-8c5b-84531c2ed89a", "comment": "Malware payload (Mirai)", "value": "e23a6c24b4b905cf3a35c109d6fdac0bd054f7c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446299, "uuid": "79753a57-e9d7-4422-adce-bb1e5e707a15", "comment": "Malware payload (Mirai)", "value": "0a61199779e9c4ff3d2753e1ad1db7fd62aca41d54a8ef7c4fbbc301ad7fbcae85c48f004d4d1f7a58a197386152c059", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446299, "uuid": "a80ca6f8-8e7e-44b6-99e5-76600d6fd8b9", "value": "T1DB734AC9D753DCF5E82A053115B7E7735E72F53A1068EA83E394F933BC12211A64A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446299, "uuid": "b19125f8-3452-4275-b6ee-f8dcdf5f4ad7", "value": "1536:ydUJtGZZSLzUyPlvPzVXaGTeTQFk1/JoO5PxtUP9XRR:ydwGZ0/DPlvZNEQFo/qiJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446299, "uuid": "fb0c8956-3439-4fcd-a51b-f3628f05a9d7", "value": 74704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446299, "uuid": "61da14f5-1c88-4dbd-8b04-38ed24d78fb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446299, "uuid": "82a11dac-8aae-4eb1-9be3-0531a0d253d9", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc37f94-deda-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766369232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369232, "uuid": "f8e42224-cfc4-4d55-9ac5-71db847fc037", "comment": "Malware payload (Mirai)", "value": "8cfa36b3f5c6160687de1a880ad1164f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369232, "uuid": "e89805eb-745b-42a1-bc1b-d8828b48571b", "comment": "Malware payload (Mirai)", "value": "e9824ae1d8fa7b52e82e77504f3e6b3d80239bf63af06e0a8cd884a48ce220ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369232, "uuid": "beed88f3-0014-4d80-aa81-3b1b131f2990", "comment": "Malware payload (Mirai)", "value": "354309c9730750868ae72d30f635516edcf0fecc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766369232, "uuid": "455015dd-b7a7-48da-9ebc-82bad939263a", "comment": "Malware payload (Mirai)", "value": "55250ed4976c463e15924119dcee18de6d770369d76a1882ba62e0f039a2da3b7569db5778b57be9f277420b55395854", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766369232, "uuid": "951132f7-875b-4aa3-ad27-383ea630d278", "value": "T146735A42B3184947E5670970283F2BE193FF99A021E4B78A754FAF4E4672E33444AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766369232, "uuid": "74922b3f-cba4-4315-a062-ae4a3097836c", "value": "1536:6p3RrFKWBXGaUNkWS/SJu/paaXMlPTAbVRc:exZUNsSJuXeTAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766369232, "uuid": "24d76bf2-a711-4a51-ace8-a1674e777110", "value": 75044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766369232, "uuid": "56f976d6-95b2-449a-a14c-2629662a0a88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766369232, "uuid": "76c68a94-197a-477b-90ff-9403933d5df2", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8473789d-df7a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766437774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437774, "uuid": "8d0d63eb-2dc1-4406-8350-42c2ec021cc5", "comment": "Malware payload", "value": "485a3de4225ffc3c1af2ef5b356f0e2d", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437774, "uuid": "408d476c-3542-4c15-9f88-82ca1445cff5", "comment": "Malware payload", "value": "e9ebd1f4426b95dcec2d15d80ecdda826aadd55abffdb8226c1a9ec00bc77f77", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437774, "uuid": "49345674-dfd9-40bb-8ccd-cc496e6f4bee", "comment": "Malware payload", "value": "ab0bd95cbe565e84863b8d644b931962a9540dc9", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766437774, "uuid": "c0609c6b-bb80-4db9-b171-0243b013432d", "comment": "Malware payload", "value": "5ba506d5869e1534497051f98e8a9270afe7ddf36fc63c3f1ea888874342c4216cc87e16cdd070ecd5af71a7452aa107", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437774, "uuid": "c08e95c1-cee1-430c-b816-71e86628e48b", "value": "T11497333BFA8C88C4FB4B4AF6E039A30811D29561329354E77B6466258E6F1F0A773747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437774, "uuid": "19738497-c68b-4d57-8923-54fe55cdc2bf", "value": "786432:UjUMRiGw5FN9+CVGXP4NXhQOsYseq7/oCT8KqIjquq1p:GUuw5FP+YdQ7Y6kCTRqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766437774, "uuid": "acc8d472-954a-43f3-8b2a-761a2e18f0f1", "value": 41178725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766437774, "uuid": "24f4c34b-049d-4ba4-853b-37c6657c1b5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766437774, "uuid": "ea3ad3b2-be9e-440c-a6ea-509f09dbb2e8", "value": "(2) Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7243ded-df46-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766415553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415553, "uuid": "7890aee6-5564-4ee0-a9b9-4f9b2ea6d4d1", "comment": "Malware payload", "value": "c81c1dddc98790ebaf412f69cc7a3e25", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415553, "uuid": "dbaa1b27-5470-4c82-a2e0-f1c8173066e7", "comment": "Malware payload", "value": "ea4522d81da33b44db718726765ef9d7259759439cd8900263861899a1f17137", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415553, "uuid": "72f08173-701f-47e1-aed6-aecf0f7104b0", "comment": "Malware payload", "value": "a9783238635d49fa0789e750f35296891d75c309", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766415553, "uuid": "af90d00c-0b15-419a-87a7-f18da7354058", "comment": "Malware payload", "value": "65d271cb6d9acad09aa5e6d3d93c8568dadbd564c3f7d72fdf7d3873c7602328101e15f6ffca0dfafc7b73c00dbadc4d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415553, "uuid": "edc6366b-77bc-451f-a0a4-b76cb73ff4a9", "value": "T11E9701CDE64C9B0FC4FAB0F76D4A01A173587C194611CD83291ABA2ABDB37C94E267C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415553, "uuid": "6178db5c-a6ec-4d22-aec6-f5dd2ca2735c", "value": "786432:X8AfM0mjw04kfZ1pt+z0Xjg2F0LeXXTjUefWNvYRAsX:XxTsVH/f+z0XjgIXXTQefWpYfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766415553, "uuid": "6acaa08a-599c-4cd8-a589-42e76e28fc0d", "value": 41703008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766415553, "uuid": "d9c009d1-3133-408f-8886-0a8651d02e57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766415553, "uuid": "13e2056e-03e9-4e9c-8d6a-e66ce9f1fad3", "value": "freecine_fr.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8813b95-deea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766376014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766376014, "uuid": "3bd84ebe-f48c-4c7a-808d-cf56938d7f19", "comment": "Malware payload (Mirai)", "value": "65834d748a2da9ee4a625160c1b79ff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766376014, "uuid": "4eb280de-336e-4547-b3df-6357e0f40328", "comment": "Malware payload (Mirai)", "value": "ea95889e1be7ae3975562b861493eb7ee6d2ef2e01b5d2960b52cd53305db4a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766376014, "uuid": "a14d83ba-8fb5-4581-8fda-8bcc34066a3e", "comment": "Malware payload (Mirai)", "value": "f81f28a197aed403abe25f0242b3093e1df7298b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766376014, "uuid": "2a04a2cc-8be1-471f-b672-f5f24daefa69", "comment": "Malware payload (Mirai)", "value": "289ffdf77e1313256917855cba643bee1f3d4e470052e49c92e444dff4dc25bdbd59aebe8c32f93b0a3e10748c06e071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766376014, "uuid": "f92c372d-7cd9-4fe6-bc5c-0430b67f2f46", "value": "T1ED935B07B6C194FCD89AC238665FA176C932F42D1236725B57C0FA26BCCDE203F2A655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766376014, "uuid": "1b9cbe84-cca3-4de2-84a1-f5024d37a9c0", "value": "1536:eMhV+3Q683jDY5Z7W9Zfh2Vop14bMReKMmFXofP0tk45qmCL:LHf3o5Vafh2618MRcmFS8tkiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766376014, "uuid": "2a9f703a-d15e-404b-b5bb-43cfa426d75b", "value": 92560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766376014, "uuid": "93698152-0d25-45fe-ba2f-8b69f2d3f0e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766376014, "uuid": "f81f6c6f-1ad9-4f82-80e0-e11ac115cdbb", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e790fce6-df36-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Generic)", "timestamp": 1766408735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766408735, "uuid": "c98b8cdb-4058-4148-8433-cc90185a9e57", "comment": "Malware payload (Adware.Generic)", "value": "bf1298611b7d83ef69cdcae3b46deccd", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hidden", "colour": "#6C4AF6", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766408735, "uuid": "4a86c27f-f28d-4881-884e-02ecadc02234", "comment": "Malware payload (Adware.Generic)", "value": "eb6a79fcecb598b626b10d34951d6b51b7c56af25c340a59c208b879f3d2e151", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hidden", "colour": "#6C4AF6", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766408735, "uuid": "3e794339-7115-404b-adc1-6f8a82557b07", "comment": "Malware payload (Adware.Generic)", "value": "f10e2b24e5ce2983cfe261389cf7c80cfd06662f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hidden", "colour": "#6C4AF6", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766408735, "uuid": "82599471-fd43-44ff-a733-ee5faa2bd422", "comment": "Malware payload (Adware.Generic)", "value": "1792c76614df673849789a4d32d2edb35822d9992921cac496ea97862b7dfcab7ec76f6cd73520a472a8f298b2742d41", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hidden", "colour": "#6C4AF6", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766408735, "uuid": "abad5fef-2d9e-4cbe-9751-d4e409cea754", "value": "T104E50127B298653EC4AE27314673A11058FBB66DF417BE1627F4C88DCF660C01E3AA75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766408735, "uuid": "efe2fef4-0164-47b0-94d1-b72a7801876e", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766408735, "uuid": "b257d622-23e6-4bbc-b31e-4bcb171ae133", "value": "49152:PcW4fnDxx323y6S8xA2S/3Kn8RlzQekPlec/klph4zVpPRUaP7x7Bjq3+n:PX4Lxxi5k9RlMe6ccsvhkV5yazx1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766408735, "uuid": "c26e6aaa-d506-4ddf-9725-0a7f92d07672", "value": 3198717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766408735, "uuid": "6ecaf3f1-5965-400f-a7b9-a9aa7eaffaaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766408735, "uuid": "c33afdf1-10a5-4f1b-af12-6dc2b7f38d13", "value": "eb6a79fcecb598b626b10d34951d6b51b7c56af25c340a59c208b879f3d2e151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13c14fb-df3a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766410415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410415, "uuid": "21ece3f5-fe6c-4e00-a757-1c7fde96f733", "comment": "Malware payload", "value": "bf102868797a6389c516c2c0980dca72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410415, "uuid": "8cd5c28c-5041-4265-aecc-38d7995c35e6", "comment": "Malware payload", "value": "eb76efb7e8863498d0227499257650dea2b5a1afb58ffce2abcb88b03c4049f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410415, "uuid": "80af642b-9b32-43c0-bff4-59f7ad3b6532", "comment": "Malware payload", "value": "1f59b19271ed0e161b28b4eb13511bdc338e00bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410415, "uuid": "27652d33-622a-4a41-b08e-553aa14c8951", "comment": "Malware payload", "value": "9609b8d1450d9fc8e80f2bf766c310b5cafdf1cd0360c1513539a3c94ce63dec5e563d222f69fbc9a914cd02a8ebeca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410415, "uuid": "49e5b848-7c2f-4180-a895-68032b6d1273", "value": "T107E5CF5DD84F544BD2A2FBB89AB33D0A0B64E0442D0D058E9A9C70FDE560CFDFAA6531", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410415, "uuid": "9a468991-4d2b-4fac-b8f8-3a015b786b39", "value": "e83aa0cfbbd938ddd3e89445b2f57e45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410415, "uuid": "9f4abda6-dcb9-4fae-803e-ba1f8c48979c", "value": "98304:LqaC7WzwvwvEW7DEJ0cUvGV7UZH+5aDzFdIcnHR:uaQWzwovR0qkAN+YD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410415, "uuid": "6bffeb37-769d-4cb0-a2e7-d919f493cd2f", "value": 3223552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410415, "uuid": "2da1052f-8bdc-41a7-8e8e-40b2d4b603a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410415, "uuid": "eb900fc4-fa9d-483a-80ce-4fabe0cb348b", "value": "pcptei.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9419e840-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397858, "uuid": "9cce0ca9-8fdc-4d5e-b9ab-3ecb103d7089", "comment": "Malware payload (Mirai)", "value": "0ccb6462cfa0813dfe7ee8e7e0d5e33b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397858, "uuid": "98b7f67a-479e-45a8-8bde-2a89a74e060e", "comment": "Malware payload (Mirai)", "value": "eb8a3cc2af3dcbae8119370f98c6b0decbb9fde28372af94d6ff5a48acd36193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397858, "uuid": "a132144b-6bab-4558-bc0d-ebb16024e1c1", "comment": "Malware payload (Mirai)", "value": "9f407b912b77d5c44b7f105c5dc4791a5335727e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397858, "uuid": "ca5e7308-4b34-44a7-a569-98694f830b94", "comment": "Malware payload (Mirai)", "value": "3ae336bde64b312268016a9158cf10674f8bbb4c1d8d884414c9a88fc321627a90e30e5b78aab515522aff45f25cd2c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397858, "uuid": "c2092a18-1e09-4e6b-b426-413724025da1", "value": "T14DD30845F881AB20D5C626BBFE4F518A33135BACE3EE7202DD145F2427CB95B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397858, "uuid": "514875a6-2404-4512-a28f-b2c5c90eb20f", "value": "3072:XsgdY6tD46e15ohfUF42hjyrV3GQnsJqYmE3VqKzcrXaJR4r3/XSBnzr:XsgTt06e15odUF42dyxGQneqYmE3VqE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397858, "uuid": "cf706cb3-a623-40c4-ad7c-b6fb00413262", "value": 132336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397858, "uuid": "5312f853-df74-4220-affb-11e228534474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397858, "uuid": "ca51202e-fa25-4070-9b39-9ecb23f8ebdc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0311672c-df78-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766436698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436698, "uuid": "40f08adf-1d1b-4a8b-9c69-28511016d9b6", "comment": "Malware payload", "value": "c850478769cd20c0263c0766afad1429", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436698, "uuid": "9a4cbe3f-ed4e-4701-85e5-8bcba4240195", "comment": "Malware payload", "value": "ebd014655735f18825ff7a73226476410eeac5b2613f4d0de166ce4267ebc98c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436698, "uuid": "86625841-5f7e-4670-9d9b-f3dacff58c35", "comment": "Malware payload", "value": "3aa8f5a6d2eb55fcae2cbe09e95c6f9507d7d546", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766436698, "uuid": "1d852d69-3d96-460d-a869-31ee4e7c858e", "comment": "Malware payload", "value": "79dff02444af143b77ae29ac39d82da5f61a79d7795eaa7657497b15967711646a493acabec06f13e48c55c981dcacb3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436698, "uuid": "82f2fa59-7482-494f-994f-c6b5c1ede21c", "value": "T1E7864B93FD504EA5C99FE23DE8A20185F23078641F7121D76A9036665E3B7C41A3BF2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436698, "uuid": "1b2450e6-f5bd-46ee-9bb0-441a2b8c3039", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436698, "uuid": "5de3912a-3088-42bc-ac7d-c1c02f392ccd", "value": "49152:1uUMU62glG1gbcmIpg98CUjpNrn460xR2DlowHChsUymVg3a5jdynbjwHxIxR2De:1kFv+CUjXrGCbMHxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766436698, "uuid": "9a3cfde3-a3c2-4701-aef4-6762f604a6be", "value": 8005768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766436698, "uuid": "16fea578-b205-453b-aff9-f95a9685c916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766436698, "uuid": "e56aabe9-d0a8-47c7-a88e-862bc8e6372c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c1046f-df40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766412946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412946, "uuid": "9443db9f-d606-4dff-82b3-e3e6d1cfb1af", "comment": "Malware payload (Mirai)", "value": "8e71bdf8d1057164af1d48756a03abef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412946, "uuid": "0604a30c-e42b-4b2f-9ab8-84fce95e9fb0", "comment": "Malware payload (Mirai)", "value": "ebef0dc5f6c4e36d3755e7b0f728488627b057f667c5a40bb4ee567700581aff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412946, "uuid": "2db86999-5a66-4fc9-8685-2d78ba3c0d10", "comment": "Malware payload (Mirai)", "value": "18feb1f32065d1dca33c97c6b774394efd62e927", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766412946, "uuid": "f6b3d1f3-32d4-41df-9f4f-4b32a3bf5561", "comment": "Malware payload (Mirai)", "value": "d6364d10b055976f15c9f46a19727bbf4bf26338ee0360f9901d387819edd47c7762256be77ea2853f2aab789103843a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412946, "uuid": "041bd758-83ba-4f0a-95a9-6dfbcaddbe2a", "value": "T1E613F6D1B8C2572BC2E023BBE66E558E33A563E8D2DF7217C8112B017B8981F4D67B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412946, "uuid": "5fe318e5-ceb8-4731-bf41-9959f7e24109", "value": "768:GvnwvvXxpSwq60h889MQ98WA6nIOQybC6/UIX25LBMSV:cCXxMwv0xtA61X2LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766412946, "uuid": "3e754495-38b7-4b6f-9ca7-207e9389e80a", "value": 43084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766412946, "uuid": "776cd86d-84e8-49bf-a762-9a83475435e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766412946, "uuid": "d35aafb8-d55a-4c26-8f71-020f52b2e92d", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62499512-df59-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1766423544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423544, "uuid": "817f0786-ade7-4fd7-8ee9-82bd5c163e29", "comment": "Malware payload (ConnectWise)", "value": "5445809c084ed8da358a811a38e92867", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423544, "uuid": "112b5b06-0fea-4177-882c-8c555b04d6a1", "comment": "Malware payload (ConnectWise)", "value": "ed0005466b47ef8db81556269696d920a74827c1e2deac61e8a1041302fb594d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423544, "uuid": "8fc10c9e-725f-472c-9e7c-a77d4a4a5cf9", "comment": "Malware payload (ConnectWise)", "value": "b9ef4a3fa2039d64f61d9646e3167fc10a6d22d3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766423544, "uuid": "1d6a7f8e-2ead-483e-a5b9-11ef9003461f", "comment": "Malware payload (ConnectWise)", "value": "af227f5d6dbf879c42829255a6e5b8f07983a45488e564231547123be2404f8fcd0e85e2147d3e5325e492a5bcf24e04", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423544, "uuid": "93352a48-805d-4641-8cfb-4a04010e8da0", "value": "T1B3C6231126E89134E6B31736FE3656B55B3ABC25DD23C52F122CB91A2A73D808D72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423544, "uuid": "2c79dab6-80f0-4c2c-b74f-a59393ab852e", "value": "196608:/suCcGaDplmcYMDAsuCcGaDpZsuCcGaDp9suCcGaDpKsuCcGaDp:0uGthMDvuGjuGzuGiuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766423544, "uuid": "d4575655-16bf-47a5-83ac-209c6e03a9f1", "value": 12177408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766423544, "uuid": "48020052-547f-4b4d-98df-9cfdfb66385f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766423544, "uuid": "6da3fd09-d82b-4c4d-bb77-387024dd05b3", "value": "SSAstatement.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa8fe99-deca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766362014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362014, "uuid": "16d6a7c3-502d-4b77-862c-a6d9e7c76844", "comment": "Malware payload (Mirai)", "value": "d0081a2f93376480ed90351ac975c42f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362014, "uuid": "6cb1fef3-4b87-4bc0-9b7b-022681c7301d", "comment": "Malware payload (Mirai)", "value": "ed5ab255e2561a6f0fd7dc6417d7df82d2f3189ad126455a42fd3b9c244bf62f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362014, "uuid": "ce03bfdc-c361-42aa-9dab-3d57c72e8152", "comment": "Malware payload (Mirai)", "value": "9c017052cb22f167044fd49824472ce7c9a9de3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362014, "uuid": "a94247e9-2e72-42b0-bdf1-920fb4243461", "comment": "Malware payload (Mirai)", "value": "d616447db54b7f7fc53ee799ec8771d4bb1310b1f73facf2bac8c6601e0999784f4734f0758a527b35e1b18ba7c77936", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362014, "uuid": "407c83d1-173c-4d38-aa1e-fb3aab5ef9dc", "value": "T16943F786B991DA16C6D5657BFF4F82DC371643A8D1EF7303A9186B61368B82B0E2F440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362014, "uuid": "3de8f4e9-7eb6-4efa-b768-1242b4478453", "value": "768:dd/LMC7zQSOt1Ud3CMKB/AlK2fycg+DYgeTNNJdwvAVcwQXMoMiZ3UHPSnFgdT2P:v/LHg5AlnfdKJ2ic58P3SGdT2bVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766362014, "uuid": "ab9b0c60-365a-49c3-955e-f94b4fb84303", "value": 59296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766362014, "uuid": "49cbf47f-8cd3-4261-994d-3f431aa1f8cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362014, "uuid": "bed9e38d-b6ab-4052-b300-966301d0139f", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b25f0ea-df85-11f0-a129-42010a9c0007", "comment": "Malware payload (Blackmoon)", "timestamp": 1766442322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442322, "uuid": "f799f99f-e26b-40d2-93b4-3f8a22cff34a", "comment": "Malware payload (Blackmoon)", "value": "612dd726d15ff8cd38415a595d3e40db", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Fuery.D!cl", "colour": "#02D62F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442322, "uuid": "b1e85cae-8652-4908-9b4e-2658e4b4f04e", "comment": "Malware payload (Blackmoon)", "value": "ed624ef9def66eab4d8d59dd9693e9b6e6cd386d422f2835d97d577756c6634f", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Fuery.D!cl", "colour": "#02D62F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442322, "uuid": "6a6952f4-ac14-42b9-a3b3-05b2d663a2f4", "comment": "Malware payload (Blackmoon)", "value": "9c7a0a0ac12da26ee7e09a6744f61644001bb8e1", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Fuery.D!cl", "colour": "#02D62F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442322, "uuid": "5a6f73a8-8158-454d-81bd-5cef8724d206", "comment": "Malware payload (Blackmoon)", "value": "23d773eabcd650cfeb9a6ec392da509325549f19fe74055616d963f50e2374dcbaac322247442f0591ba797a0d8e3f4a", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Fuery.D!cl", "colour": "#02D62F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442322, "uuid": "e9b3f615-6ee6-497f-85e5-0c677f47afbe", "value": "T12317F1829D030782DC1FB6FD315D5224AAE85D5F5FA660891FF3C528CFAE128689BC17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442322, "uuid": "8055ddc7-17cd-4556-8d5e-153f4bd98036", "value": "7b03024aef6cfd677f07d591c97991b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442322, "uuid": "8f2a17c8-04ae-4bc3-adac-ccb75cf89712", "value": "196608:AFToKTWPTIMMPz/TgTl/iBJAJw0SCnkWc0UkDWqov3wvVYMUO8FdXsj:gbYgcqcZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766442322, "uuid": "a0ae2c26-01fa-463e-aca5-a579d95088f1", "value": 19591168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766442322, "uuid": "06bc9e5d-7a3c-4d72-b3f8-f77ca87ae4fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442322, "uuid": "a263f183-44e3-493c-81f9-3e6b1a2faf0f", "value": "Y6DZJP78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783e99ee-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424869, "uuid": "130e3343-44db-4b27-8ec4-35a09c455a28", "comment": "Malware payload (Mirai)", "value": "82b829902efbb580477a393f4d4b1e74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424869, "uuid": "8ab869a5-db51-44ec-aa95-e4cc97985fcb", "comment": "Malware payload (Mirai)", "value": "ee4c21474592329e7443d1eef98d512a9e884fd2a707e493057e63c4bed4ac0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424869, "uuid": "42e3ccc6-9fc9-4602-adb2-59d800aa1176", "comment": "Malware payload (Mirai)", "value": "57a6bae87bcd96a7f48aea145dbffc6ae6f2a1ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424869, "uuid": "47fdb2bd-cc87-42b7-9c01-fcf8ee4fb493", "comment": "Malware payload (Mirai)", "value": "f69fe82498fe3065c3cb1b4e85df170084f09014df66d8913625e6ac904f363fe783ce2ad854e1f48a7e40a46f247365", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424869, "uuid": "86d17bf4-a47d-4229-907c-cab955a3ac04", "value": "T12DB34873CC29AE6CC664D5B4B0B18FB92B53A960814B1FBE15A6C2749043ECDF6453F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424869, "uuid": "68d27628-e8ed-42a7-86b0-cd66ee1db2c6", "value": "1536:ejKvZA1OI3jrECxVKqVCF7QAqdyiccLW+rLH7/kDWlEg:eGgOwrEE8qUKdhpLWSH7/+ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424869, "uuid": "99c0c460-2b8c-4ad9-a7c2-2610a3a24b42", "value": 117164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424869, "uuid": "f77ee0de-8379-47ac-b307-beebb0ac75bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424869, "uuid": "2d41c5d1-dd73-40f9-9edf-0dae4ac1fe1c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27fdbee-df3a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766410364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410364, "uuid": "77c128b9-9b4a-42ad-a741-f5e6a5149165", "comment": "Malware payload", "value": "3a5c23fb310737d2a4f9cf24c968d657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410364, "uuid": "8f008510-c11f-4bea-a1e2-48f970b946a7", "comment": "Malware payload", "value": "ee6acaab372f7331474290086f46c4f211249bcc83fa6f634b05078870a6c797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410364, "uuid": "b2442b1a-9b9b-4600-881d-20e76172a2b3", "comment": "Malware payload", "value": "a6352c1987dbb92afcf2b8b8e901ab768eabb514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410364, "uuid": "e0347312-2498-4526-b870-ccf4d7176b9e", "comment": "Malware payload", "value": "508f49cf6cb45f903d25e54699c316ab03085d1870d6a9321b13f27eb761318d1df8ff0894e644ea636764cd25230ec9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410364, "uuid": "c4d2e32d-29fb-407a-8f2f-d37d893d020d", "value": "T11D95BF42F2B541ECC13AE1388656B61BDB7178190B205BDF27E44EA97F63AE01F7A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410364, "uuid": "caf0b6fa-6e15-4e29-bba8-87c8cd0d7dd2", "value": "631437f717808c92f8bc1a2f8e660b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410364, "uuid": "c8661dfc-11f4-405b-ae5c-d5d7db5cf835", "value": "49152:9v7vUJD0bIzkkJUwo8ze40VDLOkNNtUsGa:d8J3zwwox9iMfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410364, "uuid": "f62a31fd-70ea-416c-b9e7-e45ee73ff8c1", "value": 1896448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410364, "uuid": "4ea064e4-b9d1-485f-a0dc-6f1fe21ef5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410364, "uuid": "2fe3da2d-54da-4e17-8581-204cac1eb712", "value": "Bapbase.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa34c69-df0b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766390253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390253, "uuid": "f15068ca-9521-4963-9d3b-8027f98a4e15", "comment": "Malware payload (Mirai)", "value": "0b713fb503e6a0f6c890840d48013158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390253, "uuid": "1154e805-9c1e-478d-a1ac-eec8602ee73d", "comment": "Malware payload (Mirai)", "value": "eec7f66f18d53e7a73987d079bbea53d3cb060b83388fd0d850cff7a5aac1f8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390253, "uuid": "a619ff7a-7a69-456a-b2af-569e1227d647", "comment": "Malware payload (Mirai)", "value": "414815a9a48696a6c7beb20844712d75298d4b5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766390253, "uuid": "c2cafa12-c038-4f4d-9420-c7433df754f0", "comment": "Malware payload (Mirai)", "value": "0f7f5fbf41662af0fc09c43391500e8a5f6aef529598f58ed2e6412fbb0d0b7336148e45fb3615bf2ea43d1e68ad7fda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390253, "uuid": "378503f5-029d-4fd5-a80c-1147ca5bb01f", "value": "T170C2E1BBA0CF85BDD514A339105D8D4B4D2A85E04F789748760C266D8BFF82D9C3EA1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390253, "uuid": "af53632d-93ef-42d6-9535-28ea66060276", "value": "384:M2v66YgiokzDM366q1tl8JQ7nOt7GvvfGjWNC+yfIzsYFqnZ3OeL+v1Ru:b66Y4hy8h7GnAmufAYnZ3lcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766390253, "uuid": "07d44fa3-35bf-46b5-bfb6-560157f28586", "value": 27176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766390253, "uuid": "4c49f81e-211e-43aa-9392-82df5f488efd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766390253, "uuid": "be80d08a-cd2e-49ce-b242-a807d39ed56f", "value": "frost.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724b5b00-df86-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766442898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442898, "uuid": "3bddd5c0-361d-42d0-af75-5cc2487f993f", "comment": "Malware payload", "value": "a6f11a0694e0709f98f330100d708668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442898, "uuid": "6169e2cc-2fcd-410b-a73f-6b7b0e2d3ec8", "comment": "Malware payload", "value": "ef08459125a017651d2e87b64f1cdc320e46a496126b2b110e8b48b2a3d7f494", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442898, "uuid": "ce2cf3b8-3945-4c50-8259-b404c84e6f39", "comment": "Malware payload", "value": "6938fab051537066df2de3070e00ffd0df4d4264", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442898, "uuid": "ae7c393b-a6ec-4319-bc5b-cdf2a8d2e370", "comment": "Malware payload", "value": "3b3c272304abe64401b401f16f71f5823d108b797f13325689fea06f0b06ede5140b9032001a8e57c6a786ecb2ef5044", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442898, "uuid": "090a2444-541c-4c76-9258-3c58e3db4677", "value": "T12B832986B881D622C6D5667BFA5E42CC332613B8D2EF7207DD25AF15378682F0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442898, "uuid": "29c1d18f-81b2-4d0a-833a-9fb2af234117", "value": "1536:6LAKso+VP0PIVhXr7qK6wQKMS2Jf/KZFaFyIlvMvqT2bVRw/:6L3FEAwQKMSBba48aqT2I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766442898, "uuid": "7a026d94-aa74-470e-b93e-64fee219722c", "value": 84696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766442898, "uuid": "5fd4e1da-9ab5-40c7-9704-0da121aa17c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442898, "uuid": "056ee39c-8fb5-4c2f-b294-1c84c110b96e", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89038e24-decb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766362620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362620, "uuid": "264c215f-de7b-4ae6-9de1-0f75c65842cd", "comment": "Malware payload (Mirai)", "value": "993ac7aa78ffe0275a2ee09bcf992142", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362620, "uuid": "4b1467fb-1ac5-4911-be03-0d80fce28c11", "comment": "Malware payload (Mirai)", "value": "f11cfa41192f935db9d5a29b1026a54ab5827a2386ca390c23ddc650ba370651", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362620, "uuid": "9c1b0378-4854-48cf-9f4e-a54e3156edc6", "comment": "Malware payload (Mirai)", "value": "abb2599667488833cadf28af86e423a1d7c3bc08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766362620, "uuid": "8e57f85f-00b4-45ad-aed9-1f0b467c493d", "comment": "Malware payload (Mirai)", "value": "085d5cd1ab48a5208dfaf20b6368bbdd9eb71d960b1d4f811ae891270b37eac7aa37ba83a202920a3a33e41c53e2575c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362620, "uuid": "71c82845-4d96-46cd-b173-457b69e0899c", "value": "T132A33B52BD91DA12D6C1627BFB1E428D372713ECD3EB32038E256F21378A91A0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362620, "uuid": "8fbf20e2-9b58-4e78-bea9-0af312827141", "value": "1536:6dflVU0Y3vcSF4ZWuDl/asC/5b8JEdChRFZJn/jOt4VtrRtj/v8lemb:6dfg0MESuWuDljC5b0EkfFZRp3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766362620, "uuid": "ee6c814a-fa25-481e-9cec-a6d20aa85aa1", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766362620, "uuid": "32c69714-cb8d-490d-b7da-774293abe6a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766362620, "uuid": "ecae512c-7292-4421-925b-2f72a12466a0", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e3fc81-df3a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766410443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410443, "uuid": "3c84f96c-1ddc-4799-876b-6e38cb778740", "comment": "Malware payload", "value": "256a844caace61a2ce834cef03749b7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410443, "uuid": "d5f09d9d-410b-4118-bc9d-f602bdca1c4b", "comment": "Malware payload", "value": "f1d96aca4ddb6b317e43e2cc599ce69f32a2c41a1c1adf94312da48269536fc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410443, "uuid": "d6a65ff3-eb8d-4b35-8929-7c0728932871", "comment": "Malware payload", "value": "21d166a1524210c53e2f282f599ffcd33a7d4bdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766410443, "uuid": "81146d14-4f2b-43f0-9a91-3a56d672b102", "comment": "Malware payload", "value": "fbcf53bb3fc35425929c0ba4aa5035cc65c491bb8a1fd76ce70ec446a3bf6866cfea2144e98c43607677c864b7e8db36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410443, "uuid": "2498e78d-7cf9-49fb-be38-a633aba2625c", "value": "T12A1623C1668224FED057C3F082D668ADB1783BFA4F714CA26B8939174DB3D242D79789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410443, "uuid": "4f90e4ba-04d5-470a-9d68-8e0db9a3ed06", "value": "25fda2001e585d511e3be36a7b6d03b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410443, "uuid": "6cdc72f3-942e-4912-b787-d1ca327f1fef", "value": "98304:a+KGARODeC+QID+Ejg/bOVnsj5VYNUPvltp5SP5jJTV27:uq4QIaSu54Qvlk5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766410443, "uuid": "65113fde-de3e-449a-ba5e-b451976eedd3", "value": 4361216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766410443, "uuid": "863a2f6b-71a6-4b69-bec3-d6939d842d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766410443, "uuid": "b75a4004-c8ed-4f71-8b56-43b2604ac79a", "value": "SteamSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb2bf1e-df84-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766442269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442269, "uuid": "e25d6eeb-c55e-44d1-b0be-8577ad087e59", "comment": "Malware payload", "value": "1ed31b1c874bac74032052b9fbbe337b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442269, "uuid": "a7c7c76f-e991-41e6-be63-7cc4aebac8f3", "comment": "Malware payload", "value": "f1ec1791833bf98da73b948306fddc7085265fdb3bfeb6aaf67a697931e094ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442269, "uuid": "20a51fb0-ca63-43db-a23b-177e53f83abf", "comment": "Malware payload", "value": "ff86319d51252436d45e9d12f7f66a8a8e797e24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766442269, "uuid": "f443fd77-dcca-48d6-8de3-39b71a6a9388", "comment": "Malware payload", "value": "e48c78606927e2140b642654e178656fb6ac3349da774b17adbaf60380987814fbe74b1a94c6a2ec77420b539dc5234e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442269, "uuid": "b37a61d4-a768-473d-bf92-84a51cecbb9a", "value": "T19A34A64D2D9D8150D16B20B657225AC3F3A2BD2C723583B377C029593C6DBEE949BAC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442269, "uuid": "ca23e41e-1735-4d83-8a21-9f391c80cb53", "value": "b6b254d968104c765200ffce42b093cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442269, "uuid": "3a84e236-deb9-44c0-aa85-00140e8e4567", "value": "1536:xLluoqkxTJfCVvjK4Fh7QcMoYGRsDuevd/2CWRr07jE4wVdG4NOP:fufkr8mvcjbMu+d8mIDVdGS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766442269, "uuid": "6b29a36c-3ea1-4088-909c-9c48e55db373", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766442269, "uuid": "c6fa09a7-292e-4cbf-9e02-c338b54b2ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766442269, "uuid": "a02600b9-54e3-4be8-a101-b11920a5b4e5", "value": "2025\u5e74\u7b2c\u4e8c\u5b63\u5ea6\u7a3d\u67e5\u5185\u804c\u4eba\u5458\u540d\u5355\u4fe1\u606f\u516c\u544a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fc37cc-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370178, "uuid": "47f25315-3eba-4ef7-b802-909201a11b91", "comment": "Malware payload (Mirai)", "value": "8f23ac5a72c1ec63a9d3736194943a3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370178, "uuid": "5d945526-7afc-4932-846f-6b4230a3605d", "comment": "Malware payload (Mirai)", "value": "f2a46fcdece4665d88d9f3a408550ef6858df4a4dd66af525acf32fb6f81fc55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370178, "uuid": "a4ffc4ce-22be-45a4-b38e-57e137347f4e", "comment": "Malware payload (Mirai)", "value": "5afd147ee112339ddfa48b276edc6c8e123011ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370178, "uuid": "bdb08b21-0ae4-47a2-b320-f69908367928", "comment": "Malware payload (Mirai)", "value": "5ee2a8af4e9076232c18675a4f5b7417fe1fdc731fd5218b9f790e32205f720227828c7d7886748b33e4b28aa930d082", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370178, "uuid": "de578586-d50b-4a0e-b8ff-bd83390f8674", "value": "T199335AC4F643DAF8EC5705701177FB339A32F5E51229E743C3A99A32AC52602A906EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370178, "uuid": "89997ba3-3321-4f65-ba7e-d081161d3a7c", "value": "1536:GWa2d5sf1Gg+ya+nlQ5F0ffDRTfwVsp3MSfCYL:Gt2d5sf1GCammr0ndjMW3dCYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370178, "uuid": "a8e3eb56-eeea-4e87-96b7-bdf6d76443e3", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370178, "uuid": "5c47fa2b-de3d-41f7-a1e6-a6b593d015e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370178, "uuid": "04e1fa32-673b-47aa-b674-72547e8a8959", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf829c2-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388878, "uuid": "d5c3a214-8bc1-4526-a47f-0e684a803cdb", "comment": "Malware payload (Mirai)", "value": "23cd64ee4a997a74f0fbd83f2c88f6d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388878, "uuid": "e552dd92-b167-4860-ba98-093aeede8626", "comment": "Malware payload (Mirai)", "value": "f321178a11a0a5fd366484a6009778d53fcc39187235a09bd4b9562d503f4a1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388878, "uuid": "528a827c-b86a-4f7a-8db7-b771e9703b15", "comment": "Malware payload (Mirai)", "value": "b2b6f48ffad3fac87e2260eb6a8282eea29746cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388878, "uuid": "da92f618-123a-49a1-813b-034edcc9f2d5", "comment": "Malware payload (Mirai)", "value": "bd0da939d08ed1055d871aaf5a3e85585931c19beb8d8ecfc09e73cc385ef850c0ac08f9d131b4f3bf1350e749e4302b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388878, "uuid": "3132f732-9ea5-464a-a880-8a3b119b2496", "value": "T1FC2309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388878, "uuid": "3d62de82-6b32-4cbe-8e42-34ecc28f635a", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2i8e:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388878, "uuid": "c51d3c89-f815-4ac7-86b2-a8c8c6f8a5ec", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388878, "uuid": "bd2f419b-9991-4405-ada7-3a465598ce22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388878, "uuid": "08468ccc-f4d8-4465-91ea-d4441b6968b7", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7055680-ded8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766368308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368308, "uuid": "43b70178-953d-4ca4-8015-a234e483da59", "comment": "Malware payload (Mirai)", "value": "42254dcb8e7df576faf76f1751e91d48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368308, "uuid": "2019b38e-f2fc-49b2-8308-4f772a66988e", "comment": "Malware payload (Mirai)", "value": "f4532f82fde2319b94eb48d87dfb8786df4e25e1a59bc3b835c5b558576eefda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368308, "uuid": "8687d5c8-05c7-44af-8acc-e6d89ac1d1ab", "comment": "Malware payload (Mirai)", "value": "b00a664f1ce2316bacb705636fdb2867c6ca6aa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766368308, "uuid": "56205295-7a53-4bb1-b43c-18b097580881", "comment": "Malware payload (Mirai)", "value": "fd16793a121c8395135c6d34db8808d45846321e41ee4de2aee17547221197641bd2b220f5c42153df79bfa9b4b55291", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368308, "uuid": "969c2ac2-8df3-41c2-ba65-c93899127f22", "value": "T104B3FB163B51DBFDF6A6833487B386719AC4279113E48786E2DCDA182E702CA5C4F3D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368308, "uuid": "b2aa4410-51df-4976-bfc2-a7c79d1c8113", "value": "1536:EcC8vjg0o/TVJPtSmyeGjABaXEmCxGY19FTmJ/drFdNLs2Asxh8wW9B3t9sishrZ:EcC87po/PoLl9GB3tshsPH4hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766368308, "uuid": "b13e66be-86d1-4c17-a404-360637ff659b", "value": 114559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766368308, "uuid": "860bb514-abba-4b11-9fce-6e01e54cc1f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766368308, "uuid": "471cfc1d-9a4a-4058-9202-d68230a16707", "value": "n2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3796e526-df57-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766422613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766422613, "uuid": "51030025-cdb7-4cab-b6dd-7f15ee71bb6d", "comment": "Malware payload", "value": "4b05576b405fabf7c5ef5d3a371c98c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766422613, "uuid": "80771a1a-3cfb-445c-95d2-436e84845cf3", "comment": "Malware payload", "value": "f5276908c952aeacf2ffc901f47d27ad6f2b21e2de394374125ecacae67847b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766422613, "uuid": "b8ca9f72-b871-422d-ab2f-944bef691dcd", "comment": "Malware payload", "value": "654f0a9143e12c23ad6b1f815bf19acd2d635795", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766422613, "uuid": "2e1e17ba-2850-43fc-8f94-17482c465e7a", "comment": "Malware payload", "value": "e99082b68b20740bfabc24b7e98b2462978df3b835e4a5f4ec484c588083a7a4e8559e79c3acd377de0e0a2ce25766fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766422613, "uuid": "af456311-682a-4b77-ab68-890e5780a94d", "value": "T1200633F9C52E55DFA55BE73C328489E0A15630BB58CCA6F8CBCC524A577AEBD03890C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766422613, "uuid": "2cd0e8db-eb3d-484a-b853-c5dfb976e310", "value": "98304:iNHyh+ZkJdBSSm8Uc7iG//WRtb8oZvsko/pDt/kzu:iFyZFScebtb8o2ke8zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766422613, "uuid": "a26a31bf-27c3-4df8-80a7-6675b3f08d3c", "value": 3717416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766422613, "uuid": "6c3d55e5-9a60-4ebb-b6c4-513f42b56bd4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766422613, "uuid": "2b6e4b31-9469-4816-bb5f-f643e1de4d02", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c43168b-df55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421816, "uuid": "65d152f0-c6f0-4940-b8ae-01fa967ca445", "comment": "Malware payload", "value": "3c74d21543d6ff780df842652d890f72", "object_relation": "md5", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421816, "uuid": "c6d1efe0-d2db-471a-ab0f-f4e7e36419e5", "comment": "Malware payload", "value": "f58056af2ee8a026f77617845746947929b52140b4c7240bdfb985fcef6b6279", "object_relation": "sha256", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421816, "uuid": "fd1c1661-8fc9-45ce-9d4d-daf59b96e5a6", "comment": "Malware payload", "value": "deec7596b98971d022168e9d6c753c63b6f35c4c", "object_relation": "sha1", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421816, "uuid": "caf0e60f-4052-4f42-a38a-60d3708d04e3", "comment": "Malware payload", "value": "7a242e7266c0fb99e1eb005a93902d3e24f7ae83110a9a940ccf06d2ae7fbf13784ce6a61cad1025294ae71c92f55dfe", "object_relation": "sha3-384", "Tag": [ { "name": "miteamss", "colour": "#956E34", "exportable": true, "hide_tag": false }, { "name": "partner-hotel-app", "colour": "#6D138D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421816, "uuid": "384009a6-b1fd-43a3-a478-6830e3521d21", "value": "T1F011F418375F7DE409D484778E8928EF961101AC1D6415D837CDC2516F6B1CF167B30C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421816, "uuid": "4f086d46-cd37-442b-97cb-09f8a02df2d9", "value": "12:s8U0lu/LCUcQ9Oqa3tgB1O+PPzazLgyaIS1PKC2Gs8BxS55ksz8vJpp6aFCIq29:ELCUnLa34hPP+zLw1PKC2Gxo+DpBTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421816, "uuid": "de60d906-7a83-4374-8887-2e9de16fbffa", "value": 868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421816, "uuid": "563974be-4f3a-409e-afac-c72baec22bef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421816, "uuid": "9af8a0ab-df5a-4809-95cc-cd53f027fa8b", "value": "codigo.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fdca26-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387469, "uuid": "c7ca6b6d-645b-4aef-bd78-169504d0a1b7", "comment": "Malware payload (Mirai)", "value": "063dd96ce9f234a247ce149ec837cfaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387469, "uuid": "1b6d1870-156a-4729-9206-0cee2b21ed11", "comment": "Malware payload (Mirai)", "value": "f5b8a7db2093e66948c70002ca7de6cfa8da762c068bd7dfab4e3fdd51143da5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387469, "uuid": "5157e54b-f676-43c6-8667-200c31ca7a7f", "comment": "Malware payload (Mirai)", "value": "7752d5c07189f6440304a2f4d58521f7ab36b2e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387469, "uuid": "76d0bf2a-402d-4fdb-b87b-7744a3db9940", "comment": "Malware payload (Mirai)", "value": "7177f62dded78c42960d85f57c7e7f3ca0af4cbfa25562da2756d1c621ef4050be63a402b9acd8c0a724356f00356407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387469, "uuid": "942780ae-14c4-49c9-b512-6746b929048d", "value": "T19553025116BCEC3ACAF2D9390B6841E68ADC59B854D2500F53C97CF44A06D74EEEC6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387469, "uuid": "66a719bd-48ea-49fe-80ab-7b39b6f61e0d", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/VpuuAQg:MaHJgMo8FwOA4zUFGUO3UhbpwQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387469, "uuid": "fd831a61-b0b0-4484-82d9-150501aa731f", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387469, "uuid": "5b92f0b4-e31b-476f-ab21-6c9e3f0ac8cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387469, "uuid": "643c6c2a-6b14-41d6-92e6-3296c8dd05aa", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986c1918-df04-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387127, "uuid": "dd33c618-9788-4e04-8c30-f8ff8016f561", "comment": "Malware payload (Mirai)", "value": "66eb997d60688635d76dc64861feaf60", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387127, "uuid": "504ce275-56f4-44e2-b294-3be8ec4264a3", "comment": "Malware payload (Mirai)", "value": "f61a79f3386597ce686202aa195659930893b1fdd186c8ef70a9f429752533fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387127, "uuid": "bda58edb-211e-4a34-91e0-f11fbe653cc8", "comment": "Malware payload (Mirai)", "value": "e88347960169e0c67354e2d4be117bd26452eab4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387127, "uuid": "45944050-2b03-48de-8fa5-a0d899673616", "comment": "Malware payload (Mirai)", "value": "70e5e9f5c2eafe768de3d646bcdd8d6bab157571958b5be632e926a47be00ae3a4c614ddf42743a7a380acec3ceb3e28", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387127, "uuid": "72e1decf-e683-485c-8d70-dc46d695f2f2", "value": "T14C51D5C7230284386CF3992F32BAF014B2EE989E20DC9F8844D879EB455ED045E41A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387127, "uuid": "118be1fa-4277-41e5-9a68-826fcbd0de39", "value": "48:vVsJ0V/o9bVJAJFahV6A6FLhVR6fVtOHVv+D4VglsV9+/VEhWVXA9VLsPV+r+V2O:v40W9bMGm92fiHW4MsK/WWW92PY+ioWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387127, "uuid": "eb2ee489-4beb-473f-afa2-215a099e1bb7", "value": 2505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387127, "uuid": "5f690c83-6c96-429b-8d18-c30062b5626c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387127, "uuid": "6b8dc660-eb01-4e8c-b645-8bdd07e59a65", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec50ffe9-defe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384691, "uuid": "06d7df98-0314-4738-bbd0-5ad0a157ab1c", "comment": "Malware payload (Mirai)", "value": "458e77112013d573f4624fcc08e69aec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384691, "uuid": "c13e36f8-6c5c-460b-bda6-258dca28f7a3", "comment": "Malware payload (Mirai)", "value": "f67929158c5c814df747ab237fb6797b53a1b4e80afc14889be00246250a54d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384691, "uuid": "c05644b2-297b-4578-98d2-7a39defc2e59", "comment": "Malware payload (Mirai)", "value": "9aee52673f57aa916fd8cf867109a4496abdfde9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384691, "uuid": "6f73b8e6-3796-46dc-a8c4-a1874bac4330", "comment": "Malware payload (Mirai)", "value": "166be7d6a27600323cfd36e0020a877eed0b84fb1dbcec7f089ee206bffc4feba04324733e06cd75e84aa0b8877af5b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384691, "uuid": "f16a4849-4064-4bf5-a47a-f9e57161c5f5", "value": "T15593180AB940AB17C8D51B7ABD4F534A33374768D7DB73029A182B746FCAB1E0F26542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384691, "uuid": "35e90364-6fb0-4282-bc01-74ad08e7b849", "value": "1536:4fn7xy133Yt4mu4AgHLRM2lWyhRiJfTZFO9GsPgD+MNUCKpCq:+yNYt24AgHH2fTTtLr1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384691, "uuid": "45a8baad-f76b-45ed-bc24-655934e94228", "value": 89955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384691, "uuid": "2a294fce-7d89-4e71-bd21-c207243f9994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384691, "uuid": "95393185-648a-456b-8900-0307588d9872", "value": "n4t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431fb506-df03-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766386555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386555, "uuid": "036ed5aa-1da4-46cd-8120-83f2abfa7e5b", "comment": "Malware payload", "value": "fd633b74be3d5dcf145b7221615d2ca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386555, "uuid": "2b91f6f5-39fb-409c-b021-fa085d8f3a7a", "comment": "Malware payload", "value": "f680d8af1e391fecc76b482383ca718a3022b79cece2c9fa8fe8ba20171ecd9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386555, "uuid": "fd6f8a42-f0d0-431f-9e52-b31f21c5ea1c", "comment": "Malware payload", "value": "4f28f12968bd693deeeaca7b133bccace1c8bef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766386555, "uuid": "0d1489cc-5180-4e14-ab52-27f298a6eefc", "comment": "Malware payload", "value": "19e1c9ed24e9f71ef4301a68f8c8f362fd2da054e2ed621d29694b4fec69bfddb5149df6c21ed71638b571425cd1a5d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386555, "uuid": "7dfba3e8-9a3a-49cd-a036-8d878c3bb31e", "value": "T1BDB4A456E550F429E89B4834E929B6F6682A2C71E540ED0FFB80BF9A34705C7B4F061F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386555, "uuid": "43bf0979-4133-4fbb-bca4-0d9802f605e2", "value": "3ce6060c62927fe6c3da39eabc644e03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386555, "uuid": "ba2de702-0bb7-4e06-b6ae-196aba006001", "value": "6144:BvvwaeeU3BzxXoQzNRhE3eE3rBU0W6t+NfENM6LKyO20/3yu0NuGs5Hs1pfX:6aeeU3BVX/znhze1IFiu0Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766386555, "uuid": "cc2f45e7-8097-42b1-a779-ee58b07160a0", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766386555, "uuid": "ad10e7a5-e099-48ca-8060-5836339c198b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766386555, "uuid": "d788a41e-d254-41b9-be0b-d217f7e7802d", "value": "frenums.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c0e811-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388866, "uuid": "3a3c8a7b-fda1-419e-816d-3ffc66005fec", "comment": "Malware payload (Mirai)", "value": "10eb390433fd7ef4662c260f65876ea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388866, "uuid": "7f0dbf68-39f9-4ea1-8ad8-da2d4c8f9713", "comment": "Malware payload (Mirai)", "value": "f740f6d53dd5b0e628de33bcf77a19d64a21b28e36b186992a281fd0e7200f18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388866, "uuid": "4ab00f99-061c-4892-8028-f62c1c1374dc", "comment": "Malware payload (Mirai)", "value": "621291c8f8be2fa907c16a1fb67c7c96aad88578", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388866, "uuid": "470a2d8a-bad5-41e0-8fac-f179f002fe0e", "comment": "Malware payload (Mirai)", "value": "ece8a12dfaf71bd2ecab40ff85a89eb1839360a5045737eaad563a1aaff321f48789ceb5f5a7bc9ea8efc54882831ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388866, "uuid": "8d58b96d-b36e-4947-970f-7f3ae5d7512f", "value": "T1F7431891BC819A23C5D4137AF56E56CD372033E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388866, "uuid": "81a61893-d744-4434-855a-9c134310c304", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388866, "uuid": "e6fd4f14-45f5-423b-ae5a-c1959c5ae351", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388866, "uuid": "f22a43c2-39d0-4ef6-9011-068e07495a8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388866, "uuid": "73c6a92a-47e1-4d39-882d-00677124f06f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29246c7b-df89-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1766444064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444064, "uuid": "0523a6e5-6579-4d18-b4d9-0ad57677c2b6", "comment": "Malware payload (SantaStealer)", "value": "80e1be5e0c9a51c2816f69fa6fda7ebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444064, "uuid": "7d49bf42-dc77-43e0-aa17-f54feacde0e0", "comment": "Malware payload (SantaStealer)", "value": "f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444064, "uuid": "389cf19f-7bbf-4d50-ae14-03e1ea101eed", "comment": "Malware payload (SantaStealer)", "value": "b779df0f8313f6ba1e01dd3724a60c31edd75704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766444064, "uuid": "c71939f5-425e-495f-9ad4-c26621095c55", "comment": "Malware payload (SantaStealer)", "value": "be6a91cab18e7829080c21461be310b90e947e3501ab5559353bf67485f3d7210cd155eef7daf723ecf6198075a6c246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444064, "uuid": "5aa50727-158a-48e4-b8fc-175d5a53927e", "value": "T111E69E03E2A358ECC5ABD6B4425B6772F930BC2945387D7F5A98C7302F61E50672EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444064, "uuid": "4d61b2ae-d986-4feb-a8cf-cd3c99aea143", "value": "aade4ee96bc5660163903d5fb7bf63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444064, "uuid": "b962232a-ea7c-4d8e-b7e5-d08014f8499a", "value": "98304:z0eWMZM+pGr6kvCCoa6JHBn9zSajjJztzAANy29XOQz7D1Pfrvc2K7:GjoaS9zScjJztzXNvlD1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766444064, "uuid": "c83c8992-cc83-46cd-9152-4f8d621ad36d", "value": 14897492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766444064, "uuid": "f5bfa22a-eedb-4df1-b332-c594def30f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766444064, "uuid": "4a57629e-6cce-414c-94ac-e22f68128af1", "value": "0faep3v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3592f32f-df64-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766428193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428193, "uuid": "d9de1186-7f5e-4ee9-a57a-0fca6fa6351f", "comment": "Malware payload", "value": "d1e004d46ada9b7e08005c9ee0267a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428193, "uuid": "f9e16372-5da8-4f83-827e-3da32538890c", "comment": "Malware payload", "value": "f8975240775d21940dba3aa46dfe5b971e9484a56281f260b65bf3b08d3ce2de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428193, "uuid": "c27f63ea-9be2-47fa-aaca-cd75a66d8d33", "comment": "Malware payload", "value": "00b443f225c886fbcadaa9bef2fe170eeb39d297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766428193, "uuid": "89b512c3-7433-481f-9d31-4e8c485e80fe", "comment": "Malware payload", "value": "b2033ad0d9085b6ce661ccb3ecf95ba818d14927a664def703bfd401faf0d3e0bd32d51695a9e7a12d3bd63e9c190fe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428193, "uuid": "9f55f45b-6bb8-489c-b1c5-ab993036168e", "value": "T1BE86331427A319B7FDF70234897AD158EAB279E44B30C5DF46B093262F672D01E397A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428193, "uuid": "e2cff4b5-fe80-4d26-873a-7423ccf9c001", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428193, "uuid": "d4591801-82bd-4222-8f4a-9822da4e9ef0", "value": "196608:x0s3svSU394gR+ouATR/S5fAcu3QB9CquMXAju:/ijBIoSAa4qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766428193, "uuid": "40c02dcc-4d83-4964-9c82-90308c0d4f95", "value": 7865654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766428193, "uuid": "7ded5250-d7b3-4553-a175-d242468c4e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766428193, "uuid": "bdcacafe-ebf2-41f3-a635-a8d163c958f2", "value": "PrimeTool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993fb288-df1d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766397866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397866, "uuid": "0473718b-b253-4ab2-94a4-e3b908f4cbb9", "comment": "Malware payload (Mirai)", "value": "7c65a6622132e243df9f72f7306e8bfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397866, "uuid": "23203861-a143-4e94-b20f-7d58af7a91aa", "comment": "Malware payload (Mirai)", "value": "f96460e8b8591a40d21e0b35a73cec74de8bf7fcc68dbf3384c62aaad83114b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397866, "uuid": "c7eade7a-556a-414c-9c07-6453ffc457a8", "comment": "Malware payload (Mirai)", "value": "5c163562a767f8ec80ce22d3da83b08b97d8700d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766397866, "uuid": "4bcc4f04-f32d-487d-b6ed-017669c80d71", "comment": "Malware payload (Mirai)", "value": "a14ab36f87c6c4a542f43f8704a3b8a80468f8c3e7d5937d4e91cdac0c033a85fc681494f917a4b3d5bba27ff4fef1a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397866, "uuid": "513cb18b-f08c-4972-a995-e153f37d3f0f", "value": "T1FFD3AEDB734B0911C46106F01BD39F8E3F6362258E4BD9E72D0DB67B287A5CB191A782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397866, "uuid": "d9809c16-377a-4824-8a88-aab78c17e250", "value": "1536:gzSKoY8uEpi7D5FUQuuLjzW8fSyDmLlAhonxrEiGi5gInX/LWK:g0Y30i7AQXnTSyDmLQoPGi5gInXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766397866, "uuid": "e798b124-d937-46ab-b548-6cbd5242b0dc", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766397866, "uuid": "2c33f9a8-f4de-440d-9901-c2549a3aab76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766397866, "uuid": "50b3cde5-3aa1-4ba7-a9b9-5d79c4772aba", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7669edaf-df8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766446341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446341, "uuid": "44476d0f-ebc4-4dad-860f-dd5d539c2f04", "comment": "Malware payload (Mirai)", "value": "13effa8b4f983d3e7255c1c12366e5ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446341, "uuid": "009b210a-9d41-4e53-bf86-b9f0e927a00e", "comment": "Malware payload (Mirai)", "value": "f9910f7a7fe942b3023faa7b6c2fef0d0b12de98f332cc8dbca8062efc2b9f99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446341, "uuid": "3c5fadc3-88cd-4dcc-b125-35ec41135a8d", "comment": "Malware payload (Mirai)", "value": "7003be97983c41c16d9b85ba83afae9cad92a8f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766446341, "uuid": "9063881c-67cb-4342-86f6-7fa098cbf146", "comment": "Malware payload (Mirai)", "value": "6600a351adc6bcb63177633d890be8c36239e643ff24c31b5a7f4fb495935517485f0b2b9588177bf431e0f41a918d61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446341, "uuid": "854e1d13-c040-481a-b465-823844b4cc48", "value": "T17CD35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446341, "uuid": "ed7361ae-a1ae-4ee8-8d63-9cc7c5b3d27a", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQK:yIRfe3xvvSrlvZZ7UK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766446341, "uuid": "f0c06d41-75c5-47b4-8380-867c4ef706d2", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766446341, "uuid": "dfd79263-7711-4e8f-890d-00ac6948ab7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766446341, "uuid": "e7f03214-d04d-43d8-b552-6e1e73e45e11", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d73d38-df5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766424862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424862, "uuid": "c47f6026-117c-4006-a922-0a3114905265", "comment": "Malware payload (Mirai)", "value": "766719d97aca9a64261fae63a29259dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424862, "uuid": "55c97f72-e09b-480b-bc30-914e96f1b4d0", "comment": "Malware payload (Mirai)", "value": "f9f41471b6dc82dda910695ce502090b81e9f6466c811388f9e03b3e00b5d9dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424862, "uuid": "226be199-9777-4335-b341-beb178109b92", "comment": "Malware payload (Mirai)", "value": "d91b30ff9234a1a6f7a5396d3f037c01dcc720f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766424862, "uuid": "70da1cf2-7785-4122-92e0-80cb0b620332", "comment": "Malware payload (Mirai)", "value": "50a405fafc31a4a5e1c7d54674ffa82a2d0173b82a18846b7eac3b3c6557552bfdee4dbc53bb721751b746a98c7ab222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424862, "uuid": "dd577388-9f79-4f9a-8677-ff3a58f60a13", "value": "T159D3F856F9819B11D5C111BAFE1E128E37231B7CE2DE72029D246F747B8A8BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424862, "uuid": "d80b0b91-d341-4591-a92c-a332bb59fbe5", "value": "3072:hOHUBUfW4ybXRwedruOa3lBCXbh+7xnCVpUaOn:hOYI+bXSeVJab+h+RApUaOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766424862, "uuid": "bed96bd6-d176-4e9b-b530-65e938cc5eee", "value": 141776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766424862, "uuid": "19a1dad8-6f89-4c2a-8a50-b1796e6b252f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766424862, "uuid": "ee8bb911-a84f-4fa7-8cf3-a8aac93885b1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60453401-df05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766387463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387463, "uuid": "c03f9847-3f49-4c00-9744-eba4b421a68b", "comment": "Malware payload (Mirai)", "value": "73d71616472671dac64b5d548f47d21d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387463, "uuid": "fa7f694e-3927-4a47-8e35-eee20faa6816", "comment": "Malware payload (Mirai)", "value": "fa14ecf837984c9b9259d1d9fcf84553c4a728d597bee8d623e1738cc178422a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387463, "uuid": "292577bf-f0f1-4e14-bf12-784576c385cf", "comment": "Malware payload (Mirai)", "value": "095573aa2ac62810ca56f4ccca71ed8b882791bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766387463, "uuid": "5d83d6aa-2b64-485f-84a9-b45bd9788b16", "comment": "Malware payload (Mirai)", "value": "d5a1bab81b1c1816aa59c84692ffb3e5285d57ee4d46a4534dd0b01d410e9e92a8b33e0b090a56835520bb0f8256cb5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387463, "uuid": "07b6a84e-b25b-40e2-83a0-a20bac06f3eb", "value": "T190B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387463, "uuid": "fc3b7776-4643-4ea7-8f79-bcc36ab6e74e", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzk8rSR:t3SrlGWnKTU83AQB5A5Liy36fwUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766387463, "uuid": "fd0e5d6f-ca01-432c-b130-2c19ad756094", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766387463, "uuid": "47859b86-f257-4b75-a9a2-259574e0f277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766387463, "uuid": "ebf27109-acb9-46a1-bb34-b52403484767", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e0d6c4-df6e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766432480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432480, "uuid": "4c82c65d-057c-424d-9a27-c41ddabcd510", "comment": "Malware payload", "value": "5cdad2b75676479441a0f2ac41ac86cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432480, "uuid": "0e7ac6eb-56d5-40f9-a881-2b682419990e", "comment": "Malware payload", "value": "faf3032416ab40d17ca0f169c52c8c7e50dd190b5c762ac7a5dcb626c8bec7a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432480, "uuid": "5ae093fa-316b-4871-9624-b51b265db267", "comment": "Malware payload", "value": "2fb59156276a948c421cbd909b4c16ead6461486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766432480, "uuid": "27e5bfbc-38ea-4592-85fd-d0a4a87e41a5", "comment": "Malware payload", "value": "c49ae7c99e3da87f52b4b0af4cbc43eb7c258d63803e8842e2e4f237ccce50c507a2b7f7b82c60089e6fbec3688df0f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432480, "uuid": "984bc1a1-d01c-4b3e-8a96-1e78dc6dae01", "value": "T1E5B53D27B371E09CC452C4F4B2EAD3B25222B8701271A667B7D18F331D65A85E726F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432480, "uuid": "6eec88e1-1c6e-40c6-a3d0-5175f9143ccf", "value": "12288:51SzJNWfzG4S0H5oOmU+6KLEJAW+YuIlVIyfsiJHm:jSzJNWdZpJAW+YNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766432480, "uuid": "0403b401-de5d-42e2-980f-7061031a33ab", "value": 2426528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766432480, "uuid": "c0dd480c-46f0-4c35-bd40-60d9f247f86f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766432480, "uuid": "dbc9d26e-30c4-49f7-af21-31351f1b430b", "value": "export", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ef1d33-defd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766384248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384248, "uuid": "1d926af4-3a82-49c4-b815-101759ce7e9f", "comment": "Malware payload (Mirai)", "value": "5e844dc48e523e497321c201eb6be420", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384248, "uuid": "29d133da-2366-44cc-b510-ac6652ae9122", "comment": "Malware payload (Mirai)", "value": "fc48390d60758ec26e3a1c1314ce538802079dd154494300fdd281745d9ac090", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384248, "uuid": "d8d8faf8-d80c-4108-a7a1-56e70cbef711", "comment": "Malware payload (Mirai)", "value": "931fba3d421b64b7b999ddc5d3d596f055221ac1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766384248, "uuid": "9c39d639-b88d-4f0b-a0ad-85f8def084a1", "comment": "Malware payload (Mirai)", "value": "e8c1de52c2a14cd02306e6b8dec19c8fec1acca49e5f31bafeb43cab4b5d058a9f21b995a57f09c7254f60d8d8650676", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384248, "uuid": "bca29729-4810-44f3-83c3-c8931fb46026", "value": "T16A936E02B31C0A43E1B36D747B3F27C1D3DAAA9112F0B684245EBB49D1B5A32558BEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384248, "uuid": "0737609f-c709-4ef2-8ed7-f2d34935fc1d", "value": "1536:AyWwrgtP/WlXBWRbNarBYoLyYLR1LfAH2+YyyN0d95vDodaemRc:3hgt8cVNcBYoLyYrz+byMvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766384248, "uuid": "f7a2e6e5-40d4-4d35-bac5-13c3abb8e830", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766384248, "uuid": "11105f08-5f32-4812-8b44-76e44603d030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766384248, "uuid": "7bef37a9-9f44-4197-a2a8-6397e483f946", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47d96fa-df41-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766413454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413454, "uuid": "3395756a-fb7f-40d1-885e-c1a1835411f7", "comment": "Malware payload", "value": "74da149c15f383bfc2e411cc9d886dc6", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413454, "uuid": "e03b2f96-947a-4c9c-942d-361ac51a52c1", "comment": "Malware payload", "value": "fc8fd2e9a4cf0a4c15028d0fdfeeda3e8c887969b7c1a835e509006e21059d37", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413454, "uuid": "e57dd00c-3444-4013-8678-14368c053695", "comment": "Malware payload", "value": "d2e54a7bee3b974dff4bbda58653a6b55443dbe0", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766413454, "uuid": "3742ef88-fc16-4373-8b89-c1f8194bd9c3", "comment": "Malware payload", "value": "d1b5405f6881cd84c0a5500efc1ac581f210df4aca4dd0b3d95bff863d838f2433b76d633d3e0791bdcc3db4b54b3ff4", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413454, "uuid": "fde9cc0c-18d3-4f83-9738-9602f7631452", "value": "T18A36AD4D56B8E4516E7A022D7DE299CF815928709BBE8AF0E3F62D505313DCE2E7108F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413454, "uuid": "9e2ce415-38b4-499d-8d27-7b891d9a3556", "value": "24576:kH5vxYhLXktYlBHt6qpGrHOE0yUUMx2gI0++F2P9U2FszuiUzY67vxxWUKqUUFwJ:kH5vxYhhBhpAn0yUVx2gvoPq2jDxx7B4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766413454, "uuid": "706fe37f-6d48-40e6-99d6-0c9e0ea7ea7f", "value": 4962408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766413454, "uuid": "6b5ce508-e1a8-4d54-834a-b86b8c580bb5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766413454, "uuid": "e4239180-0931-43d9-964a-78ffac932ece", "value": "UStarteX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1835c313-df55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766421701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421701, "uuid": "243d260b-850a-4fb9-b635-435b6997e382", "comment": "Malware payload", "value": "dccd402370e90b4dc6785f802bcc0625", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421701, "uuid": "58c9e926-b094-473c-bd82-e86548bab2cf", "comment": "Malware payload", "value": "fd30a48c9ac5ca6b857c158aefa35eb19a3d2541b4b50e7274b2332dc8632e41", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421701, "uuid": "939a5531-315f-4c69-8b07-c74da1beff85", "comment": "Malware payload", "value": "d6a27535f163d69723362dfbe0f50d0b8b657ee3", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766421701, "uuid": "708f60d7-2878-49a0-9cdb-170caf3fe6f0", "comment": "Malware payload", "value": "4415c38bc62b4f0b353edc7186bfba8fefd223cf7ba8a54205ebb35b844ce1f801cb2ab3e4aa4f9259ef06a09f3e6d91", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421701, "uuid": "140f1d1a-0d37-4852-b5e3-122305cd73dd", "value": "T14F665C53FD5486A9C59FD23EE8A20282B2707848077125D77B5437661E3BBC41A3FB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421701, "uuid": "32139ba4-4cd2-4f72-bf51-075a131817e5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421701, "uuid": "d6fb23f7-1620-4d0d-bdf2-eaeedcaee95f", "value": "24576:yqiLfflS5rp3kgelVdTWkCvq1H/bDHwZVEdMGcMmjeleN48425R/7T/XtuDcZX:yqij9Shp3kgiVpkq1jDtdyTZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766421701, "uuid": "7175188d-b57d-409b-87b1-7e8c2550b7e5", "value": 6985864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766421701, "uuid": "31e5e2da-abbe-4859-976f-8d1f526afe30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766421701, "uuid": "99f1404a-050f-4cae-a223-30139ed55852", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ae054f-dedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766370184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370184, "uuid": "5570be4e-ac7a-4a6f-a7f0-a2a4270ecc7d", "comment": "Malware payload (Mirai)", "value": "001a129d34e6770d6116d2f720c58def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370184, "uuid": "5dae17af-51ff-40fb-8c59-31ae28f435de", "comment": "Malware payload (Mirai)", "value": "fe09065e0d353b829a7fb4b14d3da9a2cc562bdeb239ae89c76dc70db2f49b3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370184, "uuid": "3c3f41a1-505b-4303-90c5-47a4ead1e4a7", "comment": "Malware payload (Mirai)", "value": "7603f107fb60e86a400fb63238f921a23d2919c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766370184, "uuid": "b22fc5cf-f6ce-4471-b169-f1b10f2884a2", "comment": "Malware payload (Mirai)", "value": "d19fb708eb23e2705e775d1d2010ff508760d0188f4a5809f60a2d5f0c2764a851dfb92fe58b16f6fa374660e6d37f73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370184, "uuid": "c1e69765-ffa2-4444-904f-a2a67e0b2001", "value": "T17663B61A6E628FBDFB59833447B78E21AB5823D527D1D641E25CD6002F6034E681FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370184, "uuid": "9220dac9-dc8d-4a34-aba0-81a7d62fcffa", "value": "768:bPWek0n4CjdGQKKWxmg0EhFkFkeYA+Qo+xXyApGqFDjOZ2uyyQ5NeNTP4wnhIZ:bj/hSmmjAo+Jym2Uu6eBPZnhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766370184, "uuid": "4d306082-a828-4fb7-b9d2-9ba2cbb56475", "value": 72628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766370184, "uuid": "fcea1878-ca3d-4c66-9647-4d31354ebde4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766370184, "uuid": "fd695bfd-8fe7-40c6-ae76-47d82745c452", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1834dc76-ded4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766366296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366296, "uuid": "80a9f962-d69a-48a7-ac76-bf0706fea287", "comment": "Malware payload", "value": "ed048010b8cd318b82f3a515a5fe4f25", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366296, "uuid": "9b25bd93-317b-4d24-b73b-3f42cf0e6513", "comment": "Malware payload", "value": "fe185a3ecc4457cb256e5bc96cf83a3df2abe2486e36542c7b84299e14ded4a3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366296, "uuid": "815d3066-427e-4088-b51c-29042f11ca36", "comment": "Malware payload", "value": "5ffd5a4322a00a712c23665ed1c1a66ffb7fa27f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766366296, "uuid": "aa4455ec-bd3f-4808-b0dd-25259bb08833", "comment": "Malware payload", "value": "3d90cc13a6d488e85fa6531e0f8726ebb99c61d459a44990915622f3ef30c65cb99e916773daad9f1b90f26182962b9a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766366296, "uuid": "fcda5b2d-26ff-4939-a7ac-5b857812b71b", "value": "T1335533CAEBC52E35CD9A30F25995C701F2B04DA956A08903344AF47069CF256B8F3ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766366296, "uuid": "eb2d2c78-5fa3-4b80-97ba-a5f24878fbdb", "value": "24576:JoPeSlMU4zKM13/5nYSSfXHeDgsKYSsC/v3X84PlCaM6+4:6Pg1P5YuDg8SsGNlC96n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766366296, "uuid": "ced2b793-6911-4b1f-986c-0f86800e8bd7", "value": 1360797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766366296, "uuid": "d7382c74-c654-4325-84bd-c8518fd78bfd", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766366296, "uuid": "3ea7f7bc-f7d1-4896-90b9-290211ab0e52", "value": "Minicraft.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aca8d2c-df08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766388849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388849, "uuid": "562af40c-ba9a-4f49-96a8-bc7bf8198307", "comment": "Malware payload (Mirai)", "value": "ddd433ec5f102ff6a359b281f6db348b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388849, "uuid": "5f8aeaeb-87a6-4d52-93f1-57526a86e926", "comment": "Malware payload (Mirai)", "value": "fe923c20cd7ea59b47871ecb9578dfd64bb5cf28b3a559ab3a4ea932bef7e3f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388849, "uuid": "519362ca-27df-4998-9784-48b4e76bcfe7", "comment": "Malware payload (Mirai)", "value": "b050b046f68015c3775cf1fe60e5568f1397a9cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766388849, "uuid": "3c8dc69e-61d7-47d7-9c70-e62a48099316", "comment": "Malware payload (Mirai)", "value": "c9ef2f4db3d1e4bddcb0d6e3cd1cc4b9814457edb5379c8b5ae2e217b53c55a87e5884698477dba39b42785a1d42930d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388849, "uuid": "8fde820b-4c89-4c7e-b6e8-ed603deab58e", "value": "T17AA2D025D345AEF4DFAF5C9052C2C2C2BBF542C7268AC8E240EEBF016606056F789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388849, "uuid": "dd723432-ac0f-4640-9c80-fb2420697ba3", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5nM4uVcqgw05VxJl:mRxsSVsMD6xiJJE5zRWN24uVcqgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766388849, "uuid": "2b58791e-cf4b-41b9-89db-4e6be8add5bb", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766388849, "uuid": "948ca39a-a7fd-4e4b-8e2b-d71f9d29d914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766388849, "uuid": "b317aea8-4498-4e3e-9948-ba8cb7d49703", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }