{ "Event": { "published": true, "date": "2025-07-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-07-19", "timestamp": 1752969781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "92e65ef1-cd03-4114-a329-f4dd75a7bfa3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7189e864-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919763, "uuid": "242d6d92-5701-476f-af26-00faee218e46", "comment": "Malware payload (Mirai)", "value": "11b00ec7ad1aa0048335972bbdabd409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919763, "uuid": "166a9fcc-cb25-4275-a3fc-7a71cbe863d9", "comment": "Malware payload (Mirai)", "value": "0094dff2449bb1fc1cb19ef9428952eb93a8bb41cda45f185ef1ed7a5e856208", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919763, "uuid": "e30ffb04-0c1f-47db-a7a1-3bb9090daecb", "comment": "Malware payload (Mirai)", "value": "5d853a68c03baede53a87be1677530b8739b5138", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919763, "uuid": "c2bf8839-d19c-4c73-9e30-3b92a736cc57", "comment": "Malware payload (Mirai)", "value": "4be85b7cfaf4009424c8e986830b37ebc3532e738167625f8f2f410aacd0cd809fa207e58cabe80c43e2d729ab52c860", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919763, "uuid": "891a128d-1f1c-4b63-a836-39fa148816d7", "value": "T178A3C516BF310FF7E8ABCD3719A51705198C650A22F97B35BA34D818F64B25F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919763, "uuid": "a7d2a81d-cd65-4e67-a713-98adb766e3b8", "value": "1536:RvMKs9oRHbfZT7EQYEWi+NCvBqe1Cs2ooKfALVZPpzKAW:RvMKs9oRHbfJ7fWBNsBfVILV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919763, "uuid": "e748f96b-fe22-49d0-9352-b7de98c8ab97", "value": 105116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919763, "uuid": "06e1bed8-43e7-44a8-8603-68e6bdcef245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919763, "uuid": "343e396d-9421-45ea-90fe-cc3931ec3e38", "value": "UnHAnaAW.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1755123f-64ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752935503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935503, "uuid": "4f74be60-dbe3-410f-9f4f-255ec8453c55", "comment": "Malware payload (Mirai)", "value": "1c374f2cb39270898853ff200213e013", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935503, "uuid": "6c845476-88b4-4f49-bec1-0c9598ddf13f", "comment": "Malware payload (Mirai)", "value": "01394c1bc79c6855e01e85a6f31843ac1b60a6f16b4f79af23d115a5652d9a3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935503, "uuid": "51dd127f-565e-4e07-be0d-808932dad6ca", "comment": "Malware payload (Mirai)", "value": "8aa8db6c6223f23bf8ebee64842c0d8ab4e5b986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935503, "uuid": "1c8425c9-7dcb-463f-adf3-bb9142003c5a", "comment": "Malware payload (Mirai)", "value": "71643db562eef8cdad00408089f7c67957dad11e1298d2b58e8d42060b2702a8bdad90c7b3017cc9193a356af14a705b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935503, "uuid": "18560d07-21a1-4506-825d-d7000c8fc49a", "value": "T1A7534A32FA762A27C0E5A47A21F78B15B5E117DE21A4C65E3DB30E4BFF606406502EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935503, "uuid": "645c5358-54d6-49f3-879a-9f02823e11b4", "value": "1536:wwkfZJxFtojQlvnrj/Byzn7dke4tuItYZ6w8+BwQ6z0XYIfiV0/:BkfZJxFtojQlvnrj/a4LYZ75YN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752935503, "uuid": "feaa0b41-d182-4965-80d1-55e4884bfda6", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752935503, "uuid": "2ea72e03-04da-41f3-919c-b50f9576c9fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935503, "uuid": "d6f8995a-4ddb-49d9-8b7d-063f2e030972", "value": "uYtea.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94f65bc-64f7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752967665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967665, "uuid": "c788bde6-3186-40bd-a866-6650f2ced026", "comment": "Malware payload", "value": "19987113a4a82a5be4787fac7622c7c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967665, "uuid": "6f65d446-b54f-46df-85c1-47a30be4944e", "comment": "Malware payload", "value": "01bb5d6941aca39097ef72515886104989bd42b825163cd2ec852da434c719f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967665, "uuid": "dff6c723-8441-420e-8570-2eb3ea000448", "comment": "Malware payload", "value": "0d758ace365d321cc24c3da6f427ed2a59fbe254", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967665, "uuid": "770f4bd5-38fe-459b-b6e8-b79854e84a4b", "comment": "Malware payload", "value": "a3df75f442c3b7586e8835a7eed7adfb17cb7ea1289e4baa0fd5a85dc8fdddc081361b88328b864313d8ce73e850f266", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967665, "uuid": "1106e013-608a-4a1e-8617-dc3fa56b4f10", "value": "T19D730744F742D6BBCA430FF50157D8AB5634A92989298D9EF75D2C78F33388432197A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967665, "uuid": "cb99e041-89ae-47a0-a509-ab197f36ed5a", "value": "1536:wrgHKbFQ717BsilqRNFUZ0xr81n7pthttcTnl:wrgAFQ74HNFjxwp1t+Tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752967665, "uuid": "f6dd8bbe-6297-47c8-98d5-c312bbdea21e", "value": 74404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752967665, "uuid": "53462df4-97f3-4a6c-a344-4179c7387249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967665, "uuid": "6919885b-8bed-4918-9904-f7684dbebf4e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4041e0-64ee-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752963593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963593, "uuid": "6b91bbec-b884-4a4b-aca8-a3963d1402a0", "comment": "Malware payload", "value": "1dd86ff47ea589fa748832a007e52645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963593, "uuid": "e5798668-0441-4b50-9465-67f029d0c8e9", "comment": "Malware payload", "value": "0254abb7ce025ac844429589e0fec98a84ccefae38e8e9807203438e2f387950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963593, "uuid": "4659ca64-b807-4792-b706-ac7d0aaf4da3", "comment": "Malware payload", "value": "fe612df1ae5fba63ca4eaeb880e9f14b1061636b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963593, "uuid": "6a2ccb3f-d609-422f-bd9e-e7aeb4620625", "comment": "Malware payload", "value": "249d255d5a4943565a6535fb8d5754422eb742ab4374386f8e108a4a5431d9663cd26d58526877ea77405aa12b6beeaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963593, "uuid": "9621f2fc-4d4e-4d0e-a159-c407c2ff2ce2", "value": "T1A3652946D6BD00E8D5BAC138C6035727FA71385D4334B7EB57D98B922B22BE4A63E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963593, "uuid": "ba88a659-2935-4ae2-a13f-99ecc23d94cf", "value": "7dfaafb6717c0c025ae207a32e8ca712", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963593, "uuid": "4e3faa50-db05-46c2-9076-87e042443e28", "value": "24576:QoJIvaU+ZkBLNSl7UiGR93BFE3+AzujrZ31aYSe8SeIF2RbybWmSkZDHN:QoJIvaUykloRUiGb3u+AzuPZ31aYSe8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752963593, "uuid": "cd5f4bf8-ed81-483b-9444-e988fece1695", "value": 1468416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752963593, "uuid": "b57d222f-7e4a-4cb9-bc2c-55191d441b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963593, "uuid": "2a2cc685-455c-42c6-b9f3-a10055d17344", "value": "0254abb7ce025ac844429589e0fec98a84ccefae38e8e9807203438e2f387950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de09a6be-64a6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752932830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932830, "uuid": "544bb5cf-5a1c-497e-ba6d-7d924c0a841f", "comment": "Malware payload (LummaStealer)", "value": "3c1b9e4e02d350ad9cc0db8f1d1b8bff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932830, "uuid": "4ea6eb1b-2780-4491-901a-b41b76872201", "comment": "Malware payload (LummaStealer)", "value": "030341b8ce7dfcd95d3918808fbc8b6f3b540457c2c02a916afe012c4a4fd76f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932830, "uuid": "76c6a7ed-49b4-4770-aa9c-89ee3878af6c", "comment": "Malware payload (LummaStealer)", "value": "854b6fc46b312c7ad1fe8d47bb24da07dca39bd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932830, "uuid": "21bd2d6e-ece8-4756-9b9f-3527a72be7f4", "comment": "Malware payload (LummaStealer)", "value": "3ad785ebd453fb5321b5b1c550b8f55c38182991b9912784c50fb0fa6407b7fd49a055dc7e783b0cd512f7a601c2ab8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932830, "uuid": "a9dee640-2cc5-4cbd-bf08-ac11b4863547", "value": "T154E5331377EAC2F6E09229365A319F735AFDFAB25B1598DB87840E011D68AD04B7D0C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932830, "uuid": "d159a871-7b55-433a-983e-d541e21d5e79", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932830, "uuid": "79eac9a7-9f4a-4523-abd9-6012960f142d", "value": "49152:b/5RO6VU4Cr4oJlwUgybOpLjEUDNKM7R6AWHM7ySfPi6qRF0ONKOE24xTcNkgEDk:b/5IVzlwNyaaUD0M7knQyqPi6qf0ONKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932830, "uuid": "14d2c2ec-a5da-47e8-a4a6-8630cc36c51d", "value": 3094765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932830, "uuid": "e130b128-535b-4fd6-b33e-c20ce7674ac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932830, "uuid": "9f93da19-99bb-4a40-866a-adead1824107", "value": "3c1b9e4e02d350ad9cc0db8f1d1b8bff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9910f92f-64cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752949464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949464, "uuid": "0ee92990-2c70-4917-9b8b-e5a6cf719d29", "comment": "Malware payload (Mirai)", "value": "f82fbe8e253a0717f4805e2044499fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949464, "uuid": "ab272ad7-2c64-42e1-9bcc-21b4c365df24", "comment": "Malware payload (Mirai)", "value": "0390b4659213bb77fdc1c9df8a81db88962d6e0ae2203078ec7b80436bc8cfa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949464, "uuid": "4ffd402b-006e-4c8c-a8e1-eea401d2aa12", "comment": "Malware payload (Mirai)", "value": "de65eb3002f6e52bec0cf53928f459cc5388713c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949464, "uuid": "f47e675e-cf98-4ac0-adb0-8fc6af03331c", "comment": "Malware payload (Mirai)", "value": "7df9e128e5ebf91bc7c97a66471793746eab86cb398f1bf78b60ca4477ab837927354b5d0d2b7b09022caf90596e8777", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949464, "uuid": "85f6d987-1c11-44df-8fae-ce7089ff71d3", "value": "T19443D75A2E319FEDF668863047B74A21A3AD23D527E0CBC5E69CD5001F7034E585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949464, "uuid": "5a0903b8-72a5-4d09-b1cd-d5330023854c", "value": "768:/LmQTJIHdhrTsqZ0pVZ+cM5Q5dJt0MhnFr2PZy9Heekz8rIvq:zmhT+MG5vHxOlek8r1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752949464, "uuid": "2ce12e6b-7bf4-44a0-b584-4e021727f2d9", "value": 59876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752949464, "uuid": "ff6116fc-8f39-4a6f-871c-77cd06e862e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949464, "uuid": "23fd6e7b-f89c-4f64-9612-d6f22d0d292d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a415db-649e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752929076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929076, "uuid": "f0526e48-71d7-4f1b-8d87-86d7f647a03b", "comment": "Malware payload (Mirai)", "value": "a71b711a9aaa5962816dbf72e40df67e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929076, "uuid": "7132f3e7-f4c0-4e77-80a2-0d41b0a972a3", "comment": "Malware payload (Mirai)", "value": "03e95dd682d96c01e1c6e93ed45531c38b71e644b837a71044146d7abce4abaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929076, "uuid": "8c7f6019-8ef1-4240-a20a-0bb958eb3821", "comment": "Malware payload (Mirai)", "value": "4d8da544a31f11e84aada750b436972892d18ca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929076, "uuid": "a66f2396-3ede-4d2f-bc35-a31114af24b9", "comment": "Malware payload (Mirai)", "value": "eb1bb2baca29382e3257b90ddcb0dbf44bdbe324197d766b85d376420083aa408c883a1d1210eff05be51044bbdfb5e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929076, "uuid": "f1c3daf3-1afd-4125-acb5-c997b995bbcb", "value": "T1FB834B02B30C0E83D1675DF02A3F27D2D3EE95E121F4FA88691F9B8591B5E365586EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929076, "uuid": "c762626a-51b0-478d-89a1-dde7cdb68777", "value": "1536:LQDjLsmlclT7Lr5Xf64FPFoqGIRnqURGSH8GxYpgwZD0Z:LQbFST9XXcfUvH8uhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752929076, "uuid": "e93f9401-2818-48bb-881c-f22d21e14598", "value": 83760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752929076, "uuid": "b665092e-e1c2-4548-af14-5998c931c3f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929076, "uuid": "dcfcd49d-7359-4bd5-97c1-cbc654bf8b2c", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4da87c9-649a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752927580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927580, "uuid": "34ac1cd7-32c0-4b92-b96b-ad8c503e928b", "comment": "Malware payload", "value": "175dd5ff802961e6696d074b042fcfcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927580, "uuid": "e0905d95-a1ce-4bb4-9135-f456d991b0b0", "comment": "Malware payload", "value": "0499b1c6f49cc2329236675e10866f301bb600796b3ed15010816f6c687583b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927580, "uuid": "8aa2bb01-4bef-4a00-b2eb-0c162b29e65b", "comment": "Malware payload", "value": "0d4131997f5f340aac4b38b0eaa31c3e0e9bd340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927580, "uuid": "69fb4344-defe-4789-8521-6070b9ae9955", "comment": "Malware payload", "value": "36753fafc27ce431b6138247c2a54f45c01974fc1f9fb5fbe84f1533f349bf4cdf9c117ddb341bf63a88d127f3a1b6b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927580, "uuid": "2e27267d-4036-454d-838f-5fafc0677a88", "value": "T10595394BA8D085BDC06A5331CCB2A1A17BA1FC098F3127D73A90BB793FB66D05935B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927580, "uuid": "25d42ea5-54eb-46f6-aaf6-57d31b025b9e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927580, "uuid": "ee7eb5be-3d66-443b-8599-60c5384f42dc", "value": "24576:iKlXv+EjoIy2wxXOntr8fzS8MDIp6ZcJvTI4PRW8yCASGlG:iKl/xUrCtr8fzpMDIpGcJcuysQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752927580, "uuid": "2f698b86-c3b3-4186-b1b1-6622d5c85f95", "value": 1981176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752927580, "uuid": "73714825-1057-412b-87ce-4b1632fecbbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927580, "uuid": "bf4542d3-912b-4f37-8d25-24b5b0cce980", "value": "SecuriteInfo.com.Win64.Malware-gen.22983.10662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b0d5a3-647d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915258, "uuid": "be961118-d857-4e76-afdb-be930cbab165", "comment": "Malware payload (Mirai)", "value": "a8034d5963dd404537cee08629c84703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915258, "uuid": "0ff1487d-8366-4947-a210-698a78b09ced", "comment": "Malware payload (Mirai)", "value": "0557ac7ac16a90cc04c999d28b434efdf321704294b49610486f81d5ab111b20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915258, "uuid": "b9b1878c-3aef-4ac9-8747-14b8a0990e24", "comment": "Malware payload (Mirai)", "value": "452047ec7e621ce08b149ede57aee4445221e372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915258, "uuid": "a08d8119-4c82-4e62-a97e-451751496ab0", "comment": "Malware payload (Mirai)", "value": "7c44880b81109a347fee377b6432e9757e7ea1c309072a1e53f28725bfc0f8c97e29eb6584361b1d8ad80208ffffcdc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915258, "uuid": "49fd8002-1601-46a5-bf82-20a15dc82a84", "value": "T1A5B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915258, "uuid": "c1bdda31-d2a3-4fb4-9fc4-665ac555bfdf", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1w/LWy:c9sSyzz36YaWWgg1wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915258, "uuid": "e09448c0-9f7e-4116-9b20-4167e6572bf4", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915258, "uuid": "deadbf30-aeec-416c-8b9c-a797fd9b6f3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915258, "uuid": "701a8c6b-e32d-4ccf-9bad-c5b250b8c582", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1436a9-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919784, "uuid": "af64ee13-7834-44a3-a726-17644539e3ac", "comment": "Malware payload (Mirai)", "value": "4f8d670814263a53404ec78a706ea245", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919784, "uuid": "754b0004-222a-4727-ab05-1d4dc4cf7bbd", "comment": "Malware payload (Mirai)", "value": "05cd3c29dae225b00faa410516748c6e60da0eabbda8c0a23f8cc22a56680ab1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919784, "uuid": "3f5b8cf2-2748-4be0-9552-72b27546a184", "comment": "Malware payload (Mirai)", "value": "af22985ee4ce2f9556587e9dff726c093cdc247c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919784, "uuid": "b02d797d-3579-470f-87de-4396950fdcac", "comment": "Malware payload (Mirai)", "value": "2dac594940da198384f64027c8ca69b313c4b1ef7d88e5ba25674252e249a142612f88d50a7053308762a1cb03c50d17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919784, "uuid": "b840e47f-c206-4f29-af59-df14bf0aab80", "value": "T19E53E9627C926A2AC5E063BAF6BE418D332167B8D1DF3217CC212B057BC551F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919784, "uuid": "befd9419-f1c4-42d3-b568-4af822d8d574", "value": "1536:wmHfUXVywKHMIeVOeKSs2KlkaLFgiZuiKjoh+tTnm:wmHfUl1IFMiKEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919784, "uuid": "a760da54-ec5f-4bf2-864b-bef35a673b64", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919784, "uuid": "6586ca90-562c-43e3-8614-9abbe986f141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919784, "uuid": "09bbd766-09b5-431d-9bbf-9245f46e3c29", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec73b51-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925046, "uuid": "84856c5f-b244-44f7-8421-a4bbd41a108b", "comment": "Malware payload (Mirai)", "value": "c9a494799e8984e1296cb2d44b8cb422", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925046, "uuid": "0f4a166b-3ef7-4011-b13c-97dea429ba1f", "comment": "Malware payload (Mirai)", "value": "05f80e5eb2d42104ef6ca0657102c26b61262a397d0c9d5902e5f96f1f3f6951", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925046, "uuid": "b052b0c7-edb1-48a6-8f57-e42f25bc94d4", "comment": "Malware payload (Mirai)", "value": "f74a305eeea2f3b32e759bb69bef265cf42564c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925046, "uuid": "79cdeaf2-35b1-421a-bf0c-846dc4841ab5", "comment": "Malware payload (Mirai)", "value": "c537995f7083d939df3f7f0f58a2c1c92a30ed0b4d7ae586a40607c3dcdcf4c7aacb813341b863c3a564fce39b9578e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925046, "uuid": "ce05fc48-a91d-4763-a9fa-696a7f6a79a4", "value": "T1291533269C1FD4511BB80CA181A15B2DF84ADD3D4EEFF7CC3D4EF969004E6E2A58452B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925046, "uuid": "290db9e5-c657-4cac-90d9-eaf6b61c37ad", "value": "24576:fun4MW4v7BzaogfYu+1KXleCWmZ28wTXPIFpVU7FJ8E9:fLRm7BPEX0RXPgVU7r8E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925046, "uuid": "23866d50-d703-43b6-9d2d-d3ea09bfb06c", "value": 935920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925046, "uuid": "dff54bcf-33b2-4dfc-9d24-9bbd9fd158cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925046, "uuid": "84151f01-fa43-4feb-b6a2-c64a644cb560", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b0dd06-64ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752935418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935418, "uuid": "e2043f26-f12c-4cbd-9836-958a6eea959a", "comment": "Malware payload (XWorm)", "value": "404f56acbcd6510dc940c901ada7cf43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935418, "uuid": "59f13472-0aa2-4a31-8ca0-350b244c630c", "comment": "Malware payload (XWorm)", "value": "06b26f32c217a2fe343b0eec3fa9ba7b9a355d24ac9bbdb4a09a437aa6f66eff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935418, "uuid": "91ac9c22-80ad-4597-83f5-95d1e50f7665", "comment": "Malware payload (XWorm)", "value": "799e843d23f931b73bf341a6a7fa972f7151dc60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935418, "uuid": "6bfffd28-7497-4302-946f-3bbc8626b44e", "comment": "Malware payload (XWorm)", "value": "54b4ffca16d5366fd1efc9cf5f0e109f0159eddce005e8a31c0766a8f98eb54c80fc1f5a95e2ad1f514247cb7c0583fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935418, "uuid": "e65af325-99ad-402a-8759-d97d52b1fd22", "value": "T1E7257A6878BB90595477FF913DECB9EBDDDE2A636509A41B1085030B8E12F80EE4393D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935418, "uuid": "9a29e9f4-990f-4849-b232-6d66b8d279f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935418, "uuid": "3d5209e0-bce6-4b2c-95ca-35dc6a47f296", "value": "12288:kGuCBU9KEgK3s73RWtzDjHIs2p0PGOGx8rCGuxdY6GKB5gz7ATl0LfcRKCbJDxS4:LUbj+NEoon+tWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752935418, "uuid": "c77c8934-0967-48d2-a716-b018f8bf79ce", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752935418, "uuid": "65415b52-159b-46f2-a91e-bde04bc75e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935418, "uuid": "63e290fc-c246-489c-9ed2-65fca34ae519", "value": "404F56ACBCD6510DC940C901ADA7CF43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a848362-64e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752957439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752957439, "uuid": "44c6edbe-e336-4137-ba24-932fdecc1c2a", "comment": "Malware payload", "value": "c94652a3d694efb0f8407e642853269f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752957439, "uuid": "b56a4561-b3f3-4faa-94a0-2de9144c41ef", "comment": "Malware payload", "value": "0745cf7e493a36cd8dc250043a9669160b86e8e1357edd34426193dfe0c5ee4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752957439, "uuid": "f1d01075-4b94-4217-9fb8-eb6a602be86a", "comment": "Malware payload", "value": "7ca26a3d9eccf31c79291aeecc2fea108db1de4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752957439, "uuid": "dbb2aba6-923e-4a82-b1ff-fb37f9523bf3", "comment": "Malware payload", "value": "916b57c28c6e2b192c4145ff273979da419848feaf74ead795019a31cd26c999c9d1325301c60d6c8fb77e71faaa1850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752957439, "uuid": "d9bf3ab6-ced6-4f00-bfac-7422e4b1e1e4", "value": "T19535F116A62211FAE87741BA8523A645F5B779268734EFEF03D8D3321E137D01E2DB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752957439, "uuid": "79233b3b-14af-43cd-b635-4d121f83deba", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752957439, "uuid": "857f2f74-bec5-4112-899a-a0096e03a8c3", "value": "24576:dagOdyCGcoTMukP9bxGf5CaRVGSn/QkvbxGf5CaRVGSn/Qkp:cgORP9bclVGQ//bclVGQ/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752957439, "uuid": "b0f21ef5-c9ed-4f25-b756-98e793bee126", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752957439, "uuid": "87590d58-846f-4b87-bac5-74fbfded41bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752957439, "uuid": "82417f76-19d7-4dd5-bf1e-6a0711bf3c97", "value": "LauncherV8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a4dfad-64ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752934913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934913, "uuid": "7e1fb35d-a30e-439c-873b-98dcc6cd1df0", "comment": "Malware payload", "value": "3c3f45a14768fc966e9be9923f96984f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934913, "uuid": "bb157275-ae93-4d2c-91bc-4b3bbf18fd08", "comment": "Malware payload", "value": "0bf59e060f23d52d4f274caeb2bae6b73b0ba56d8eb553fcc5970eaefa368135", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934913, "uuid": "d89b16ba-5df6-4018-8af3-8e910d6c1943", "comment": "Malware payload", "value": "38c5fc9175cd4bdaeaafa254eb91be8d5a04c8c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934913, "uuid": "2fc3156a-b045-4d3d-aded-eede8b8d82fa", "comment": "Malware payload", "value": "6d34438f19d8b099ef764fd5a82683431b8c2fce08c6576712ffa0b2d293833fa1a11d5cb2ef389f8d1715900e3459c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934913, "uuid": "498bba4c-354e-4426-bfbe-21e502e3b88e", "value": "T1DEE3546627A94FBAA3627C1DF31CA67C900F1E315B1575B42A2DBF64F12C422D4DE28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934913, "uuid": "616b17e9-2f0a-4620-859c-602e06835a6f", "value": "384:je/QSty3S8nZ8aEDtUNXlt9HETFo6fqa3/nC8/6Dwo9kojTVGxn3i8yXxkyCxC6d:yQJXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752934913, "uuid": "0db51b41-1e8e-4e21-9f98-e2dd5783a484", "value": 155668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752934913, "uuid": "2da48a7b-1a65-4d00-b224-31654241dcde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934913, "uuid": "75dbc4b8-ebed-40b5-a648-db95692d9dfc", "value": "Quote.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1cb667-64c6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946545, "uuid": "0a3314e2-a857-4f17-9137-6d0d2acef6af", "comment": "Malware payload (Mirai)", "value": "963a483cf1e0ae5e27d78dce174a3864", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946545, "uuid": "a25a2bfa-ad8f-4140-bbd7-3e54eeca7d27", "comment": "Malware payload (Mirai)", "value": "0c2b04b470ca01ace526e3b1ae62518836ad9b3a7b2f7cae0cd8b002aeb1db0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946545, "uuid": "f9eb6709-c628-4275-ab4b-5ab0e24b924c", "comment": "Malware payload (Mirai)", "value": "5f66b970d88339641367c59a1685b70d9bef3dcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946545, "uuid": "06dd3f70-37da-43e6-9ee6-333b520b62b3", "comment": "Malware payload (Mirai)", "value": "4e51ac0e3fbc45b3b727c15748ab38dc66bd6c4807b561b414dfab56a2b10cf93b346deb989b386d5c1d1166a4cad99b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946545, "uuid": "355a87ff-03f7-43ef-92cd-db3bc932f094", "value": "T1CBC37C73D8252F58D62491B8B074CFB92B93899082874FBE1677C2794443DCEF609BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946545, "uuid": "aa76c1ad-d0a2-4820-a28e-f9cdd11d0f7d", "value": "3072:Dv4nKf8tX9TK3JjcwNTvEWs82m6FqsWC39c:DvEKf8tX9TyJjcUTvEWsypFCtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946545, "uuid": "f513adef-422a-4066-a043-a543c15600ff", "value": 125760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946545, "uuid": "f47b74d1-c610-48f0-a4c6-f6795ebe17e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946545, "uuid": "216e4e2a-3a9b-4352-8124-64d55b8f0e6f", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69e243e-647d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915261, "uuid": "87ea1b1a-401b-4f0a-bfe2-72b79f17b67c", "comment": "Malware payload (Mirai)", "value": "874f1b7aa05d5bb7290834092fae61dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915261, "uuid": "16bc3251-7e8c-4997-945a-552ccc86dfcf", "comment": "Malware payload (Mirai)", "value": "0c37a14caa0cde51e9e4a03fcea1837ca1ffcc9bcd644da8b16eb00994800d66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915261, "uuid": "39dee4ee-49ad-4e32-b783-6dce1005085b", "comment": "Malware payload (Mirai)", "value": "793f5eeb46b24659e95aa0a93f529808aa74b18c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915261, "uuid": "d0d8cb97-8843-43da-bb55-0d8d459bb7a7", "comment": "Malware payload (Mirai)", "value": "45e78c8f90f8a6e7816609a14170e5c10eb5fd8d5e58daebc64d325b2d2fcc46d640fbae81a795ff16356d8e7986f8da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915261, "uuid": "18c3748e-3160-4a09-af29-8bd551152fec", "value": "T10A432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915261, "uuid": "9f54050c-f880-4b3e-8cef-18ec99b7e48a", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwR:RqtmZPuutfbltZFBSJsBcfDSTFI+BER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915261, "uuid": "a0fd6910-1993-4c7d-a511-5be139d39fba", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915261, "uuid": "7817afdf-10c7-46c0-bbe5-a73bfb28f546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915261, "uuid": "7793db17-3b35-41a9-92ae-be5cd2587dc9", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4071e872-64c6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946309, "uuid": "642db5ff-54b1-4432-8f9d-7cc83e02f9f2", "comment": "Malware payload (Mirai)", "value": "beb7f06b5c8cfab6580ebd4f0e228812", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946309, "uuid": "01b130e8-9af0-4143-838c-adcca4a8c923", "comment": "Malware payload (Mirai)", "value": "0cf5ce01200f92a72824467093c44474492e01f09f0023a2e49f87b232512253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946309, "uuid": "64866a3f-db09-49e2-975d-a015afab4c37", "comment": "Malware payload (Mirai)", "value": "f8149759b2d016841fb9a18b0c6939b19846965c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946309, "uuid": "1bf2a212-8537-47c1-a35a-a711fdb4d28a", "comment": "Malware payload (Mirai)", "value": "4159e1e36b3838b9aaebecfa8e684fc295178ef4b257e8404d2d777eaa9bfe70e99cf6120419925d8d1bac81252f8575", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946309, "uuid": "70cedf9e-c3b6-459e-903d-0958455c8e68", "value": "T1980339CAEB82D0B0F86709B650776B339731F52D1065DF8AC7349A31EC96A10A72779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946309, "uuid": "f853b58c-c37e-40d2-9d78-64165ce107ac", "value": "768:4lHn4QCmlK8WSH5ekOlTj2Lh/xo2H+K4AZSm3W8vkgIB:4tnP5e58/xov10SMkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946309, "uuid": "3e72ef27-6962-45b9-8176-9e686448f715", "value": 38580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946309, "uuid": "7d12fe08-a3c1-49fc-8a3a-809d713716d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946309, "uuid": "12525ecd-8be2-4e4b-b905-8de99bd021f9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5241db7f-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752933025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933025, "uuid": "6b99c9b4-3789-42b6-9bbf-6730062b65b4", "comment": "Malware payload (LummaStealer)", "value": "664b8e13036df645bbaf0451349c421d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933025, "uuid": "37e4d7c8-a4e6-4ca5-ae28-4230980d0023", "comment": "Malware payload (LummaStealer)", "value": "0e107a908db1e106b1226dc83269894b370fb5c96de63d7d9f28003686a860bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933025, "uuid": "f38f553a-e30a-44a8-aac1-c4c12dac332a", "comment": "Malware payload (LummaStealer)", "value": "687af16276148217f67ac117d5b1464b93ec8da1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933025, "uuid": "4e36f5a6-e0a4-487b-a48f-bcbac2655b1f", "comment": "Malware payload (LummaStealer)", "value": "d6e1bce9ca292fc8b196bb4bd0cfd188695d2036705f4b9ffeb95df49af81410a7bb825fe87465b83f9a0d7ffe5b5991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933025, "uuid": "56035c49-7354-459c-84d3-645c08984425", "value": "T1B48533D669FC8179EF8880F7C8FA63D856A061D48F82397E351C581F4F0B426C56E8B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933025, "uuid": "a1843bf7-476f-43ab-a61f-75a8e753d1a6", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933025, "uuid": "e35a1ff2-9162-4a6c-879b-b60cc30280eb", "value": "49152:zedCfb4oqc1AbNKUBNYAj5cloEffE7KiFy3/Rjb96:aAfb9AbPLYAto31I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933025, "uuid": "95d837c1-97df-4b75-86c2-73ba0b90eb2f", "value": 1839616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933025, "uuid": "1a3d7482-209a-4e08-b02f-816336001faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933025, "uuid": "a9f14c26-ffc3-4961-abb0-aed840a38d08", "value": "664b8e13036df645bbaf0451349c421d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c54e68d-64f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968153, "uuid": "efac0bce-4bd5-444b-ba89-813f3d07a639", "comment": "Malware payload (Mirai)", "value": "e376a6c43c38c5ccb6f2ac723b0321fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968153, "uuid": "f0f6f4b5-4a28-430e-ad1c-93707c38cce1", "comment": "Malware payload (Mirai)", "value": "0f33ab142044a4d48853d92c9e7c714ec32b3dfd639dbe15d7ec97022bc868b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968153, "uuid": "7a13d9be-58b2-42a7-914e-45b2d7963537", "comment": "Malware payload (Mirai)", "value": "3e8f1325f8e2ec6f4695c42ea847f563d5b81278", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968153, "uuid": "354c658d-c44c-4b7c-849e-d4e5aafba5b3", "comment": "Malware payload (Mirai)", "value": "e120c4c60ce76fc4e6df274bffb8d63840cf687bf196d1dcaa1ed17dfb1e4050a4cdd514968535cdbdd2654b77afea03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968153, "uuid": "2986bdcd-9960-44bd-9d36-4443a9325f8a", "value": "T1D8C3E506FF600EFBD8AFDE3705AA0A4524CC555722A93F36B674C928FA4A50F09D3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968153, "uuid": "e3650dd0-5197-4f9f-b909-8dc32e3bed3c", "value": "1536:8osCO3iU2NGKU17JCPFbLqF6C9rqF3VdnWUzCgD9Z56Xx/Aijw+z7bNzmWQV6:8mNGh1br6l8UX9GqIFNz9QV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968153, "uuid": "ff233b91-2ea4-4c6f-9f20-dabb45b5a3fd", "value": 126736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968153, "uuid": "696d2bf8-047b-4fc4-a970-8170e1008f02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968153, "uuid": "b70a8604-faf9-43fb-84ed-9c7c413399c3", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f32a87-6449-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752892583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752892583, "uuid": "a9ef8e9d-87bd-4357-a605-9cffdcaa6198", "comment": "Malware payload", "value": "02aca3042d4e0724c65cc27170dbd3a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752892583, "uuid": "962aae99-7882-41c9-a715-11670f888ad1", "comment": "Malware payload", "value": "1061ad8566d2c27a4a32567a5b683843b6a136825c0c714c00e317b9c16be23e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752892583, "uuid": "b398bc6e-d8a8-405f-8f01-dfa64f7ef629", "comment": "Malware payload", "value": "2fff1ccdf090dfd31f6c57161300e12413a03fd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752892583, "uuid": "5e769be0-211c-441a-84d6-1915f9b55af9", "comment": "Malware payload", "value": "9c412185605badf6e2fc7ae780984880370809a2b1d471d6a57dbf0bcd8d23912f6ba1640a3b257ce7b7361cb4c2367a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752892583, "uuid": "ebb6abd8-c32e-4ea3-99f5-d8b3dfa66b24", "value": "T14837F193F143D500C8564E368E52EA9517317C5AFF1A562B3084BF1EAEF33C27A217A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752892583, "uuid": "6715999b-755d-4293-ad8c-6c44b5cbce46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752892583, "uuid": "f1588737-1508-4299-8a09-cec4cd67cbbc", "value": "393216:zJNkyZcYfwF+w1PkxkfFBOZIWHezQ/oF3VAl3:zzk6wMUE8SOqoFFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752892583, "uuid": "667c08c3-1eb3-4d0e-af59-25422cdb3655", "value": 22866944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752892583, "uuid": "5e14f776-e36b-4f66-9d19-0c361cfbe046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752892583, "uuid": "dde9bcc6-9ad1-4b7b-ad5b-883a634cd947", "value": "1061ad8566d2c27a4a32567a5b683843b6a136825c0c714c00e317b9c16be23e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86d991f-647e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1752915613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915613, "uuid": "7a5ad825-4a4e-4b7c-9f1e-2c36f9f30743", "comment": "Malware payload (DCRat)", "value": "8f5ea11261122e563df25b1c4e031083", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915613, "uuid": "54614ff2-7fc5-4d98-8481-e7d57e08ddbe", "comment": "Malware payload (DCRat)", "value": "1110bbb4f9ffdfda6352d875a371fefeaee87a15af44d5ac9ac37d1a1baf0f19", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915613, "uuid": "41b7369e-cc25-4863-a8be-d48efb4a2645", "comment": "Malware payload (DCRat)", "value": "2d897d6e4b85fd967bf242dc5a517887f34f598d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915613, "uuid": "1abc8f5d-b8f6-4670-84d7-96971c08a169", "comment": "Malware payload (DCRat)", "value": "d0d2943d210e65a0ac761965bb90b253b825d6e1aa2c4d376eaf302193ed1f6ae97c8ccce926a77641a8b59fc75814d9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915613, "uuid": "0e18f043-f437-416f-8b41-6677e47255b2", "value": "T17805F602BE44CE51F0195233C2EF495887B4AC5166E6E32B7DBA376E15123AB7C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915613, "uuid": "4e166c6e-d326-4d7e-9018-1f4dbca4eb6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915613, "uuid": "fffb55c1-6fdc-455f-b381-8671e3dcd4c4", "value": "12288:T7dh6vpz7PAzuta0htITqam/roQuSV8xSWap016DbxISlKt:t+pfPA0a0wTqN/rebM016DdISUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915613, "uuid": "2f1633c8-cda6-4ee3-83a4-c5388830ad19", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915613, "uuid": "30d3216f-f840-4bf7-91bd-4c648730e106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915613, "uuid": "a70a3cc8-afe7-45e5-9596-7160f33142d4", "value": "8F5EA11261122E563DF25B1C4E031083.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e4672f-6495-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925171, "uuid": "b62324d0-1df9-4d4a-8328-571c2672ed36", "comment": "Malware payload (Mirai)", "value": "8265da6c21737c2dca49aafdeceb79c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925171, "uuid": "549c063c-6499-49a4-870f-0404efcd7c1a", "comment": "Malware payload (Mirai)", "value": "1262106837e73c0dda5cc0fa1bdcca3f4f51804dd2eb013420a646377d4effc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925171, "uuid": "9cf1be1a-a4a4-456b-8345-2ec32df1581c", "comment": "Malware payload (Mirai)", "value": "e460a22751e3280c69971463d5acc30ecd948984", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925171, "uuid": "10358044-4600-4ebd-aa1d-3d46201ffbb6", "comment": "Malware payload (Mirai)", "value": "72631f0eb71f2f24bc46f08a62bbc2a7eb362ea19829e3f338765b44110d74888fe0913c86f564ab074ec864d57093b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925171, "uuid": "e8300ee6-e639-4ec9-9050-55252dfc5a6b", "value": "T1EF431917F94685FDC089C234177EBA3AE92331FE1229B26A67D4FB263DC6D611E09D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925171, "uuid": "aa7ade60-df96-4825-b721-691fbedc073e", "value": "1536:1XIY73si3qEToSRhINMQ/K6C8u50pfEHwNLW:2Y7H6ETRhIp/Kn5qEHw1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925171, "uuid": "96eea38e-ab66-45ae-8ea8-4ad13f107450", "value": 58480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925171, "uuid": "3eba2301-02bc-4deb-bae0-5976a0b229f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925171, "uuid": "4617d111-0180-4c06-be69-9eac257b26c2", "value": "uYtea.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc7bdd3-6493-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752924585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924585, "uuid": "2b68fd75-87fc-4b08-acbc-a871e862e54c", "comment": "Malware payload (Mirai)", "value": "e7ff76ce2609bbad02215c9a449981a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924585, "uuid": "c2452a26-226b-4da2-bd3d-66e84dc819ca", "comment": "Malware payload (Mirai)", "value": "1300cd29c7a66747ca48110e9c2ad516487f7bf6e130220bf95a5c406f9b0af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924585, "uuid": "7ef76805-541a-4823-b6ec-7b62b718a4d7", "comment": "Malware payload (Mirai)", "value": "3654e63a982e9b5f897f9b434337123577cb5989", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924585, "uuid": "7b0a9c79-8e86-4453-87eb-71dd3f214306", "comment": "Malware payload (Mirai)", "value": "2f40164508fd05df876d09fccf67c609fdceb22d3d10a8f87c5ee81cbf25c7f258d7ce9ab6b4ba6183cf545e168426ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924585, "uuid": "a814e9c6-44b8-49c4-9e61-195a087745f8", "value": "T1E573D715FF550FB7DCABCD3705A9170239CC558A22E47B3A7934D828B65B20B49E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924585, "uuid": "303fa4a6-d9f8-41c3-8ae5-f24c8da3558b", "value": "768:sD7fxbOUB+goKPsJtNNhCeF56eYOiKfrwwuaYbZdkWFXi2U7n/eYYTEOCwnHIk:snxbB08Y56vO82wZdn+n/nYTvnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752924585, "uuid": "39671590-3f84-4dd4-8f18-7c1d51b1c46f", "value": 76384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752924585, "uuid": "89235694-d696-4bb0-bd49-88b5f30cef6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924585, "uuid": "06471be4-27b2-4e16-8cdb-9cf50e671e60", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ffb607-647e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915287, "uuid": "49e96647-6bac-4ad6-8dd1-f6987816f28c", "comment": "Malware payload (Mirai)", "value": "6b76feae7ff4b1171bf9b3f65fd82eee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915287, "uuid": "46a93d1d-c3ed-4aca-b7f4-9c794b6fe6af", "comment": "Malware payload (Mirai)", "value": "13272af8c4367ae5d0daa5deb9635e781b4079e316d07e579c0e7b070e2683de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915287, "uuid": "0860ea76-7638-4b6d-b1b6-d37a8cd6efb5", "comment": "Malware payload (Mirai)", "value": "54771ba4744497f3671e87177368f3f63b263087", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915287, "uuid": "1704d200-ed22-4f0b-b569-7ee26f942902", "comment": "Malware payload (Mirai)", "value": "18b2384f77f037a7b20fe7714a6ae9a345c2e361f019548fc553d618421e246c58192da5bd262745140311fb3262cdc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915287, "uuid": "8a6f5941-8e95-4b28-82a3-6f18c3ba95e8", "value": "T137230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915287, "uuid": "80d717dc-209d-48ba-b801-f6041505c904", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THY:5DmKF7Gxyk8cqoHAmWurAufsG5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915287, "uuid": "c1294bee-edac-419e-b872-1903a42e77c1", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915287, "uuid": "22dda061-73f9-4718-a812-5ba9f7319e3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915287, "uuid": "69b820f9-340d-4de0-9375-f7e5728b5748", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3474a53-64c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752947388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947388, "uuid": "e41740c1-b4b6-4d47-ac1c-3823710003ba", "comment": "Malware payload (Mirai)", "value": "b3ea115fceb255c5f741ad58ab1afd86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947388, "uuid": "faa3a47d-ea9c-4c34-b04a-413601504e7c", "comment": "Malware payload (Mirai)", "value": "14cb9b319d24866dcd5f14aced6538344d02d3ab3ad825f28bbcd777d65adf8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947388, "uuid": "f78ce65f-2434-4395-aa02-163802a4981d", "comment": "Malware payload (Mirai)", "value": "f1613995341e06e8eb6d21d35eb6f36bdc8b1b75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947388, "uuid": "6ccadf11-d03f-4091-bd05-1ca13f438f5f", "comment": "Malware payload (Mirai)", "value": "e0ee25dd07bc825242e65477da1250e82d7ff471a9f2f655c2c9392c278e64db9505fce1af56b513164c97b1e28d88b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947388, "uuid": "f13087a0-a91d-4c34-8236-64ee94551b4e", "value": "T14713E1BD31E6ECCCC86D4D3E658F41B28DA0B1D612FACF6997AB09D4719655AB0C403C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947388, "uuid": "701030ad-e455-45db-92f3-f9f9d2b393bc", "value": "768:C8xkkPxBnaC1MAxMDoSofJ3q7e+gWo6eqPW4Wk1u2yH6YJFVcU06mls+RTwHWw:CY7PxBnbAkJ3qa+vo6eOWhnHJx7Qs+RU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947388, "uuid": "2fcbd34a-ffb2-4c11-86fd-d1cbecbad2e0", "value": 41784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947388, "uuid": "5e5b6bf6-ce3c-4e86-b9c9-408ddc7b8ece", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947388, "uuid": "72451fde-9368-4e35-8641-d445e55cf817", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464b9aba-64dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752955768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752955768, "uuid": "69b43aba-ec55-4704-9b9f-1cf89df7dda9", "comment": "Malware payload", "value": "8a4cd14cf51f2e0be689ddbe94347140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752955768, "uuid": "023df042-190f-4e7f-a7ca-2e6e54bb9ae3", "comment": "Malware payload", "value": "16166d11c390691a5d4f458d85b85c68ce5cbacfa143f4f3b90ce811534f68c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752955768, "uuid": "08ea091f-b76f-435b-9147-6edd70a7f59f", "comment": "Malware payload", "value": "79ed66b6405485804c5c7bb05b6a7f8ee0a39a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752955768, "uuid": "6fa68587-43cc-4a52-a542-3006162f7e94", "comment": "Malware payload", "value": "c5e5490e823eddd5fcabe185a1efce63698676b78af367bedcdd722ea2e7f159c351da4197b967ab4ee3e31eb13ac9a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752955768, "uuid": "b9cc99ad-bead-4c93-8531-49554e49670a", "value": "T1EF969D07EC9159A9D1EAA230C9729253BA71BC441B3623D72F50F7396FB3BD06A79340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752955768, "uuid": "09ff2f11-3098-4a9b-9e83-9e4307704c0f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752955768, "uuid": "ce625dfe-9c5f-4a3c-a1bc-9ed99ce59ab9", "value": "98304:IAL8Fn+dQ1zud0p657uEq1mwS2NedOkCscABdkPzeN:IAgFn+G1z5c6S2NoPcY4ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752955768, "uuid": "c74bd6d0-03db-468b-b512-348f3d61f0b4", "value": 8947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752955768, "uuid": "ff170f51-7590-461f-9b30-b07de4348d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752955768, "uuid": "3a343407-c3a4-4e86-a8e8-97c5f443da26", "value": "Aeternus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2388ab-64c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752947622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947622, "uuid": "0ae6587f-ee1a-4f4d-9b5e-e35734efc457", "comment": "Malware payload (Mirai)", "value": "d3329b5f4d40ea233b9ed9e2dd302509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947622, "uuid": "7aa3107d-e641-42f2-b41d-85079ab97fb7", "comment": "Malware payload (Mirai)", "value": "192d179440b99f91358be81e5fa390ced3332443ea3eeb07ae88caaa672403cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947622, "uuid": "ecbd1aa0-d0d1-43ba-a72a-477f7481252b", "comment": "Malware payload (Mirai)", "value": "ca433432a3c99054176ff9c2066f8d8215151a48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947622, "uuid": "05a96cdb-f0d4-4852-ae72-91538319f0c4", "comment": "Malware payload (Mirai)", "value": "c4c5308d4a0aad04f490a1e6ac890169f51a29a0194267ef01bb49c57f5028f13fdd55bc2e3d6823436534b023327230", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947622, "uuid": "1dcccfec-f4ba-4674-8044-4c12e6adc220", "value": "T13BD32A05B31C0947D2A32EF43B3F2BE193EF9A8121E4E644655FEB899272D321589DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947622, "uuid": "8c427b51-d4df-418b-8525-f6286f78e9cf", "value": "1536:TBjx9fVJpVqbFBIV+dtb0rn8BPB5xv3xdW91UZ24eGOaaaPYVBP6vAWD8ezfGDm6:9dXVonInuB5xO94OaaaKBrW8pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947622, "uuid": "1e4f9bcf-5952-4e95-8c1a-a41b51930379", "value": 138580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947622, "uuid": "6ef5e50a-c976-494e-8613-4705b98d4a19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947622, "uuid": "5dfac5ab-b027-4c65-b76c-28d424bcd4a2", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc6b9e1-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933289, "uuid": "24e8a8d7-8273-40dc-b129-12a434526328", "comment": "Malware payload", "value": "91902c4c879f8da9508dde06608370f3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933289, "uuid": "92ea47dc-5033-4eb5-8d78-3e326c1a91f0", "comment": "Malware payload", "value": "1a3bbf5b864c1c7e5790eab35b98b93279982c707e62ad6d36495fca59a21707", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933289, "uuid": "5104cb7e-1fba-4a12-9e79-84d526fdf5b3", "comment": "Malware payload", "value": "0d2f5134630e86ee746fb15d0a60b6c041342332", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933289, "uuid": "989a92d1-5225-4aba-9312-1ab655e1916f", "comment": "Malware payload", "value": "0c254fe4988b3f9f4dfee7bd751670a3b31776e02910b2ee031d3b502f43fa6d81f6c33f7368070a668cff3365a8cda2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933289, "uuid": "bfe74a51-4292-471f-b5f7-20d89dd125e2", "value": "T18321CD0167F94B18F2F70A36587BA3654977BC45FA26CB6D5095014C1C76A00C475F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933289, "uuid": "0ac96f8c-3661-49ce-86c2-e9a49064970d", "value": "24:8pXgJTmUHUwgkAVA+/cdpLxf+5s3uCgbDgYYqVaIMyn7mLb:88mKU9zOdK+sDlBn7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933289, "uuid": "18f1216f-4580-4589-8510-9854ce3f67f1", "value": 1441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933289, "uuid": "fc4b7ca7-26b3-4b04-b64b-12c9bf893aa4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933289, "uuid": "23a61dae-01b8-45da-9cd6-101f3b1d7b47", "value": "Office License.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53132a3a-64ee-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752963520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963520, "uuid": "f016eb3f-83d3-47bc-8795-8337f37501a1", "comment": "Malware payload", "value": "53f2dcb0bdfcdcd9ac868e6737ea5d5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963520, "uuid": "3e4b546c-9ec9-43db-9624-ad4823ee4e27", "comment": "Malware payload", "value": "1aeab6b568c22d11258fb002ff230f439908ec376eb87ed8e24d102252c83a6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963520, "uuid": "58adb551-acdd-4891-bdc4-a4744622c442", "comment": "Malware payload", "value": "dcf9a4a81ec24b8d171fb2c6b5a6f374253748e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963520, "uuid": "7bc6a9fd-7544-4665-a593-0be639ffe642", "comment": "Malware payload", "value": "606f392502091f34cabc6eedb01e1573007dc125a7375dbdae686811bd63103466b92c1cf8b56fd866b4511091048f6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963520, "uuid": "93115ddb-c463-4c3f-b9ab-16c5c8646329", "value": "T178652856D6BD10E9D1BAC138C2036727FA71385D8334B7EB57D58B522B22BE0A63E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963520, "uuid": "247c0c2a-08b3-4c67-bb41-cc514cd6e2b6", "value": "9f275c19d30c47348ce51eedc513a575", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963520, "uuid": "71f45f7d-ba1b-4b05-82a9-bdc5456ce2de", "value": "24576:zoPDp37lf5fm5GjMhtGGrHpXpxwS1r08O0BBwA1rUCBjCl0YuRCN3fyLA+v06vEG:zoPDp37lf5fyFLpXpSSxS0BBwA5UCBjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752963520, "uuid": "b2b21826-9ee0-4069-8ebb-d77005844488", "value": 1437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752963520, "uuid": "bd1de190-c3d2-4364-8469-f17db1deeec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963520, "uuid": "ef01a365-04dd-4568-a46b-ac1be58ff59c", "value": "1aeab6b568c22d11258fb002ff230f439908ec376eb87ed8e24d102252c83a6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee61070-64cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752949635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949635, "uuid": "0ac78c4b-df73-40b9-8804-63b58e88948a", "comment": "Malware payload", "value": "4c5861e3de9c9d82dbf979cdcaea7bcf", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949635, "uuid": "21d6558e-9d35-4dee-ba8b-f5aefc4c63f9", "comment": "Malware payload", "value": "1b438c4511268dfb5b12c00584b33dc9aa65a440837f6f059b68c54594cbb350", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949635, "uuid": "cb8348dc-29c6-470c-8da7-b202742f9e2d", "comment": "Malware payload", "value": "6312f17886b6401fec3b27b7f0080a938c53c8b3", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949635, "uuid": "deac1817-3e36-4dca-b369-b3d3128ea2c7", "comment": "Malware payload", "value": "f610dbf305881c3173eec2b88df427d0a9160f01ec5f4a291a7171157e084a5daf6db2b931c98afb075a18aed72023e1", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949635, "uuid": "05a50571-a7e7-4c80-a5cc-9059f08db70b", "value": "T122C4291D1252A5FAEB09007EF87D0CC8E59E9C18CA06CF5ED55373382AF26D48BA53E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949635, "uuid": "bf4583ba-9016-4a3c-a65d-adfe04b1b18f", "value": "af0a6317538ab73c2050439fac6730ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949635, "uuid": "030c6eff-4374-4388-b59b-4511f287c447", "value": "12288:3JyDxAVQzJS358xiumTIqNCJRsj6J59At8JS:3JyDxyMv8sGCfsjXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752949635, "uuid": "9ac8a266-4b17-4738-987e-b5c25885ca71", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752949635, "uuid": "56312b36-df88-42b3-a002-8c5733421e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949635, "uuid": "2db67ec9-53f0-4ded-a996-de21dde72f30", "value": "1b438c4511268dfb5b12c00584b33dc9aa65a440837f6f059b68c54594cbb350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1753afd-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925051, "uuid": "3b352eab-f7bb-401c-82f2-d6236dbfec11", "comment": "Malware payload (Mirai)", "value": "e296b447e1042ba9ae4de383e5cd711b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925051, "uuid": "b8412216-b7e6-451f-b657-4d5fc3df99f6", "comment": "Malware payload (Mirai)", "value": "1b8fe8e23a22abe25ba0345ca14a926affad78b41277fe3e3c4a1678d8770701", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925051, "uuid": "402458ed-921d-41e9-bbb7-38d44db9262d", "comment": "Malware payload (Mirai)", "value": "9ba1c0566acaddeccabdb3288140f8371564164d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925051, "uuid": "2a616a11-c207-4722-8422-66e577cdbb6a", "comment": "Malware payload (Mirai)", "value": "919ee66896f767756dc2b3fbdb2b096d797ac3fbaed05df37e0f95a5af4c0f1aebfe9925a17a126722562d4055a47b3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925051, "uuid": "d21ae005-f12b-4d48-95b9-168318a10d2a", "value": "T143B39DABF2071591C8A346F007CB4FDE6E1722C29F57C4E36C6E253E58750DB1A0AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925051, "uuid": "fadf6dde-cfd1-4ecb-8de5-5d2cde553419", "value": "1536:Rg4uLcytbI96wfY2aye7tcOiyRLqlqOgb3a10S/LWmoo:e4uLcytU96+Y2JatcwRLqlqOgbWTqmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925051, "uuid": "2487dee8-9780-4ecf-ab66-60744c07ddf7", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925051, "uuid": "c0b7fafd-969e-4341-bf4f-b40f54e7a825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925051, "uuid": "5bdd277e-2d61-482b-adae-70a93a161928", "value": "uYtea.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e629d7-64c6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946422, "uuid": "6b003587-97d3-4db4-b7fd-f1f7ddba412b", "comment": "Malware payload (Mirai)", "value": "0fba77f3711aafcbf22fc94bc18891b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946422, "uuid": "58bdf4de-1dd0-4fb2-87c3-1f254f07d5a9", "comment": "Malware payload (Mirai)", "value": "1c83c5dde7bf0d8dcc110ce66ba9bcbc095d3c617bf456b894c383535d95c1f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946422, "uuid": "e7e662ce-3202-4b9d-b9a4-93d9748d619e", "comment": "Malware payload (Mirai)", "value": "6031635e4a3fb6743cec7530f4261cad6dc32e6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946422, "uuid": "61624878-7640-4a6a-85a8-3e2535680de6", "comment": "Malware payload (Mirai)", "value": "a178f379ab27bb743b9623d35b99a81805326c1a5d0c3772b0066352df5d113bd2b971d17f8b7841886226a8b2e943d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946422, "uuid": "a6b038f1-e131-4485-9ef5-9d83decac51e", "value": "T156142B46FA414B13C0D627BAFADF424533239B94D3E77305A528ABB43F8679E4F12906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946422, "uuid": "ccdcc2db-a91a-4d63-8ad9-241470bb2617", "value": "3072:KCiU3LUfo2Q9sW9VdFa9feYSSTXOfwOMSHkxcowM/RaMobuI:KCyfQ9sKbFa9feYSST+MSHGhwM/RWbuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946422, "uuid": "73c74cad-ea4c-440f-93b3-8b26cf3e9e70", "value": 191246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946422, "uuid": "29009064-baf3-43bc-9473-4e3970305860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946422, "uuid": "48c7223a-cc37-48e8-857d-f241f84777a6", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23ea494-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907926, "uuid": "49e00838-6e61-45f8-a10f-9cafc013f30d", "comment": "Malware payload (Mirai)", "value": "dfa3d452fad94cd248c287820ec2e885", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907926, "uuid": "6969aca3-7b81-445a-b1dc-5f63ea684125", "comment": "Malware payload (Mirai)", "value": "1e6f73937753f2f89f7c7a00ee8bc2f522cd493a8092253416260d9decf8e64b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907926, "uuid": "e49309e5-cc07-4191-9195-8fc9b21d6a54", "comment": "Malware payload (Mirai)", "value": "831066408fb6a6308e0c9ac14b5745ebef5eb8dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907926, "uuid": "d507222e-16f1-4c60-bdaf-db9209ad486b", "comment": "Malware payload (Mirai)", "value": "4714305c1f4b32ec6cfe39f7a4a81aa8aad74d99b803fb177c83f23993591a4e41a539c7217c759daf4b7063a667a033", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907926, "uuid": "e53d907c-7fb0-4f17-a429-d2106d85ab2b", "value": "T1A8A3723F1B231F63C0DE213105975276FCBED74834BC9B9798E0686D6E1A9A830552EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907926, "uuid": "a7a19568-7927-4f8c-b8a0-2f611dcbec4d", "value": "1536:Cc8JSD7gXN9xMviPnqiEtCg80ngWzwZzK:Cc836qvUtCgwWzwZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907926, "uuid": "70a52a9b-ef74-4053-adac-d06cd21dc724", "value": 107089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907926, "uuid": "a8896423-8b91-4e3a-93a5-d3a21f90ff1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907926, "uuid": "cb816bb8-1041-484d-b17a-0efbb2b26bce", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7f0f6f-646f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752908914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908914, "uuid": "28a23879-4fab-4ffa-a460-172aabe0263d", "comment": "Malware payload", "value": "2b7572d393fed06b820c286a0daeb5ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908914, "uuid": "5e588ea9-3c42-4369-b16b-5106e5669842", "comment": "Malware payload", "value": "1f0b61453a8e01df8aaf0d47c10300c7bac002ec2a6d62f6f727cd09a2c3f08a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908914, "uuid": "feaab0ff-d835-496f-8ed7-c4f0bf5e3546", "comment": "Malware payload", "value": "b93605d126e0d51f8b98f6ae0107309f6f964afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908914, "uuid": "ed710030-b850-49a5-953e-1d1183fd6810", "comment": "Malware payload", "value": "13eef142bb73c575f9b72f935af5b401717b1a2d940130c038d65e82892430427d9b7bfe98ac372475c835c072fa63da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908914, "uuid": "f64b1cad-f4ac-4a29-9176-41802d11e7c2", "value": "T1BC13F18123988DEBC0B219759DAED81377B3349581239F6ABB62E092947C3E1FC09196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908914, "uuid": "462db086-6648-4278-81ce-a0b44a202a0f", "value": "ca1af6e29c8416994b8f3449563d4bac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908914, "uuid": "60c9d4e2-4f91-4069-9350-682e8bbd23b2", "value": "768:/0Pbgd6yH/8Goelo7Da9dRL7ZkjnThnoWD19pN2uG4Obc7bKjxdmmClD:/sgd6yO7MrZkjnT5oQbpZG4tWimClD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752908914, "uuid": "b37c0be1-c951-4fb7-b956-c70a7414f27f", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752908914, "uuid": "4a0993d4-efd0-4b69-bcfa-141c59560d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908914, "uuid": "a967df80-6b99-46ae-bfc0-c9cc58982776", "value": "2b7572d393fed06b820c286a0daeb5ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d4fbd0-64a6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752932823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932823, "uuid": "2f95127a-e13d-40c9-81f5-095a9e04ef99", "comment": "Malware payload", "value": "fdc4e449c94e5f153ecb3369e1536117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932823, "uuid": "e39d5ce8-d02e-448d-b47e-1aed29f4d935", "comment": "Malware payload", "value": "1fbb7cc796ed31d975e436f3e164633914fccdaaeb5da6075862d87e3601dc33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932823, "uuid": "cc5331ca-378b-46ae-9bf0-8cbc0a3ce7fa", "comment": "Malware payload", "value": "5ae82c94d3c31f7641676701f57f6c985f2ce1ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932823, "uuid": "5c2839fc-f936-4065-86b5-1cf5797b06af", "comment": "Malware payload", "value": "1ac3030f1209ddcf9a63456773a8f060714164b792be276946e1377ade05fc4d4611ef80987fe6a1588a2c7fb351fb2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932823, "uuid": "61baede7-240b-4863-aec6-24aa2e9ac42f", "value": "T1A1E533A137C25670D3E322389DE0A3F666BDE5356B0188D3E9C01C256F62ACB677B5C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932823, "uuid": "ee226c79-d077-4b5f-a325-22ef23fea336", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932823, "uuid": "2859ee3a-8920-4596-bb1d-54dbba36d5e2", "value": "49152:aP5e/0rMFu55yjEGjXEb6UpUmpuDBCU+zD6IANbtZ50XK13Eksm+Og3d4CVRfo6k:aP5C02u5wbj02+yX+zDLAF/yTO8d7VRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932823, "uuid": "6c54a494-058b-423a-aeed-8e1b94e912b3", "value": 3088237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932823, "uuid": "466f2f6b-246f-4dbc-b86b-393aae79971c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932823, "uuid": "c641e10a-dd38-41d9-aad7-6dd08c3d08ae", "value": "fdc4e449c94e5f153ecb3369e1536117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b1635e-64c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946959, "uuid": "cb7aa2d2-e46a-45f1-8de5-668096c3320e", "comment": "Malware payload (Mirai)", "value": "b7ff07951bbc6f6efa9b052d3372d742", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946959, "uuid": "77576f31-4223-435d-a4ed-f52cac01dcb6", "comment": "Malware payload (Mirai)", "value": "2134ae0edd7fe1b18f2999fde32b4d133a66d00129cb97704a2bb07d3968cda5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946959, "uuid": "17103f39-d126-48a7-83f8-9c7c037d0f9a", "comment": "Malware payload (Mirai)", "value": "8ab8a6d5f41fb2bc6d1632da0d07a3d659d410e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946959, "uuid": "bfc86c1e-21a1-408b-849a-e0e8ddfc79df", "comment": "Malware payload (Mirai)", "value": "7c07f3c4cce173846e0a03425b51c1ddc7a1369b02b6fc4cd74fc909097cef985e38ca19e944eff9e859d9301eef3f4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946959, "uuid": "f16afbcf-59db-43d0-824a-28272d75bbdd", "value": "T18CA3C80E6E219FBDF768873447B34E30A39823D626E1D685D26DD6105F7024E246FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946959, "uuid": "e2cdb7b3-6eed-424c-8a82-3614d32610ae", "value": "1536:m4JWrHFrE78gfM05XiKHtW0wiilm/KvkXjXKFAefNVbHg4sYeV8:OzFY86XdhLwiilm/K0z+bgseV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946959, "uuid": "243bd5c5-1111-4504-94d1-63eb38e44ddc", "value": 103308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946959, "uuid": "8276f731-449b-4278-b0df-a774546d4bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946959, "uuid": "57aae417-50ed-4917-8996-59baa77e4921", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d50b93-64b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752940438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940438, "uuid": "94c7915b-4830-41c3-98a9-c932b9424953", "comment": "Malware payload", "value": "7a4c3514abca9505d16cfb411da1603a", "object_relation": "md5", "Tag": [ { "name": "178-130-47-243", "colour": "#B12F43", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940438, "uuid": "4ac45ca1-83b2-4208-a68d-18940037df6b", "comment": "Malware payload", "value": "219f784544d3c54253a4a76e4b02a437c3456772330528047009529e4e564b51", "object_relation": "sha256", "Tag": [ { "name": "178-130-47-243", "colour": "#B12F43", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940438, "uuid": "ddbb504e-9725-4c07-a243-5f9d7e23643c", "comment": "Malware payload", "value": "196430c70325778b7607e56c878dcbac318d2c69", "object_relation": "sha1", "Tag": [ { "name": "178-130-47-243", "colour": "#B12F43", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940438, "uuid": "6e6cf3cc-9c26-4725-9fb2-643bcc881da1", "comment": "Malware payload", "value": "3d687a16282c20c58a5ca372abada0a7f44ec26b06ec8217399efa043a040bbd2ae919ba0939ff8a0b73affb7d0941e7", "object_relation": "sha3-384", "Tag": [ { "name": "178-130-47-243", "colour": "#B12F43", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940438, "uuid": "8369c3d3-523b-4a91-9449-1dccdeab9840", "value": "T1A316337DA5BEBD195D2403D493270D88F08525EDFB599CA43CF3A885BD613A70802FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940438, "uuid": "d93d6c8d-cf1c-465c-b1af-5b9bb6974b28", "value": "98304:kdw7bO+F4lmoi1sJbgN1oZ+DBlMwLmfBDnr5/:IXpZiSJy1oc+w2BrF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752940438, "uuid": "bf052b75-f270-49d5-abe4-4cf121611467", "value": 4186642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752940438, "uuid": "85e47619-5a73-4fd6-bbfd-1dedc39166d5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940438, "uuid": "84ed9fbd-5c8b-4f44-b865-4c2edd3f1d90", "value": "\ud835\ude3f\u2a7d\ud835\ude3f\u2a7e Inst0ll \ud835\udc11\ud835\udc04\ud835\udc0f\ud835\udc00\ud835\udc02\ud835\udc0a \ud835\udc05\ud835\udc14\ud835\udc0b\ud835\udc0b.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d645af-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752933057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933057, "uuid": "3237465a-a7c6-4a69-a383-dcf7be7ae44a", "comment": "Malware payload (LummaStealer)", "value": "e296fef4f52b909a14e9696ff9aff138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933057, "uuid": "aa52c485-97f7-4b45-917a-02cfa3a003bf", "comment": "Malware payload (LummaStealer)", "value": "21be34122cdc4d173da4d143dd3d1930307086feabd72f6285f453d33e564337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933057, "uuid": "6f7ad4df-e72f-4d2a-9e65-4d6f0ae16836", "comment": "Malware payload (LummaStealer)", "value": "b876f5b34f55710be213606a090c14f47b016025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933057, "uuid": "a8b2f926-ad7b-4a29-8b07-9193eca76a16", "comment": "Malware payload (LummaStealer)", "value": "23eba77e0a2f1c4faa4089754da34b227e2a306dbcda5ec678c696cbcf58d45e8dcf390ec7fc09be40a5f6ceb9bb661e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933057, "uuid": "dbf7719e-31cf-4af3-8cff-60ab2c7a8e2e", "value": "T1B735F106E26155EAE87701B98562A546F877B8228730AFDF03D4E7320F177E06E3DB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933057, "uuid": "d263b446-7f6f-4430-8272-3244ff5e5a09", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933057, "uuid": "54d0d7f7-de87-4d67-98e6-ae2d066d58b2", "value": "24576:bagOdyCGcoTMukPM0XnAd9MpSHQCfneL0XnAd9MpSHQCfneM:2gORPM0wgpSXGL0wgpSXGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933057, "uuid": "14a9f3e0-7587-4313-a34d-a5b82c80defc", "value": 1131008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933057, "uuid": "624ec655-8c6c-4fe2-b2e5-ef6e90634b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933057, "uuid": "34140053-468d-45c3-878b-67e362554310", "value": "CrystalUpd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41c04d8-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925055, "uuid": "261832f8-4f35-4995-beb9-509cba4315a5", "comment": "Malware payload (Mirai)", "value": "baa0ee00ad7b5f4525f6f26878452ff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925055, "uuid": "14c271eb-f4a2-4fe6-b3c9-bee41cd18c44", "comment": "Malware payload (Mirai)", "value": "21de5f5e109b9bd1aa2a2572019457430e750772f72fbdd6fd7ae41183c80472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925055, "uuid": "ff1b5245-d884-4685-833f-a162603ee8a3", "comment": "Malware payload (Mirai)", "value": "d4155eba2ee6cdc2883cb6fe3d4b091140172a4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925055, "uuid": "55998f99-b954-45ac-921d-fd25eec18aec", "comment": "Malware payload (Mirai)", "value": "212d8a8d26f68712a703ab72694ad0e76c8290b69f4f053577529e64ea6bad69a0074fe370b8c0a43d97e50de383c407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925055, "uuid": "e448324d-f726-4811-b347-2b6d2b5d3702", "value": "T196533A51B8819613C5D4137BF5BE428D3B2523E8E2DF3217AD222F413B8A82F1D67A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925055, "uuid": "3c7ab3f0-2d8a-4ce2-abc9-448ffb8a6e4f", "value": "768:lniaia+vgGqxsOvlG/idybxA3fUBAVz0LSE9Bz62ocNMsaz+SychwJZY10UPZvBO:sai5v+tkRFgfUBez0LSoBJY6zJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925055, "uuid": "1f346f49-ebf7-42c1-bfc9-5e5c53867a41", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925055, "uuid": "bca53276-6461-436a-9653-8bdfc846e601", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925055, "uuid": "9d6c6382-2717-4001-a490-dacb73d24b56", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb18d64-64f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752968152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968152, "uuid": "a3b4ee03-9a21-4c7c-9617-387d9daa82e7", "comment": "Malware payload", "value": "dad368e0c03dece4ac98e47012c55c57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968152, "uuid": "2d1419b2-f115-4124-866b-16b1387d9a3d", "comment": "Malware payload", "value": "21e17fcb2baaf716c40a83100ce95ea573c5f6f9c7c9de7f70af2e9f45b4566f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968152, "uuid": "700969b9-c278-44ea-a47c-7e0fddf0f883", "comment": "Malware payload", "value": "73b54fc51a48f570d514bff8912787b74550c021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968152, "uuid": "177bc365-d5c9-4e73-8dc5-2a0286652fc9", "comment": "Malware payload", "value": "7a00d7e3587b6f4f4ee1a44caef69f2aa822b8773b81355ff2899dc98b89b79d2383ba1296a1fc04d59abc7cd861ac57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968152, "uuid": "ac9928a5-6c3c-40e9-b97e-da17aabad24c", "value": "T15DA38289F924937EC6E17BFEF75906CE7B390A68B79333159A3549603BC8B10AD39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968152, "uuid": "b3124006-ccc6-4d26-89f2-b41bdf729d7b", "value": "1536:BrS2LvQc5NtN9cFImev3HQvziUXZrhqWxcnxE6TYe1cCnsO5:BrScfNb9zmev3HQvziTZE6TY6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968152, "uuid": "50103476-180d-47e4-878a-9b0c490dbe80", "value": 105676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968152, "uuid": "1d93f495-9370-4523-b962-2445c1da2590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968152, "uuid": "a2f5b9a4-8ffe-4f13-8bcd-ff511910816a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7e8b5f-648d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752921880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752921880, "uuid": "8ab390a2-d41e-462a-a86a-0241120dd923", "comment": "Malware payload (Mirai)", "value": "3f39cdaa8a3e704687cab221c328162f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752921880, "uuid": "05455815-05d1-4fac-a726-be662e04716a", "comment": "Malware payload (Mirai)", "value": "22696f7b8a217f411646f6855e1ed9c9e13994754f64ed54dbae4ace04e8b61c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752921880, "uuid": "8dadaa48-93ac-4bfa-a105-3441ba16c27d", "comment": "Malware payload (Mirai)", "value": "a6a848267dbb77674bef91f43b92fa0eeb8e8aca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752921880, "uuid": "8f98298e-b032-4cd0-b646-c70c1d8e84f3", "comment": "Malware payload (Mirai)", "value": "0747402a4269ebf447e9b8d833d851070e842c556d4c42011ee30571a6c17f93ace41534282fb72eb1aac0e8ee85a231", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752921880, "uuid": "83bc1b1c-1367-4659-861a-bb1a9be9204c", "value": "T1A073951A6E628FADF759833447B78E21AB5833D627D1D641E26CD6002F7034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752921880, "uuid": "88fab1ea-fea6-4556-a5d2-ddd045766c60", "value": "768:uOHdEN88rdOdkr06mC/ddIgGg/vPQKTQCQqzck7XDSWbT2tAjUv5yzmRef8yWRwl:aL5f5gLqzT7vLU5e/W6nP9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752921880, "uuid": "419ea4bf-f6c6-4ff9-84e1-d4353fad46d6", "value": 76384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752921880, "uuid": "0edb95e7-e464-43f7-872f-5459a4fa8e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752921880, "uuid": "50511c67-6572-4546-8362-2fcd649ee74e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641a0ce3-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Stealc)", "timestamp": 1752933055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933055, "uuid": "05837fa3-6cee-47ea-a0e4-cd2aa171f770", "comment": "Malware payload (Stealc)", "value": "d2f38fedbdbca2ed909366838e51b0f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933055, "uuid": "6950f606-7c44-4ad3-8106-18608bf4419f", "comment": "Malware payload (Stealc)", "value": "228bfc289ec99763fb0d45f2be8a7e9c193abd6c7e9b57642458d4341f0e1c7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933055, "uuid": "a087bd1e-2e6c-4b12-8354-65011f6d9aea", "comment": "Malware payload (Stealc)", "value": "33b681623f82c9ea0ff8ea5ebb966577dd461bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933055, "uuid": "37481fda-3b22-42e5-831f-93100d968eda", "comment": "Malware payload (Stealc)", "value": "7eb16b7857a183e78dd2ca50e830fe5a2b6aa1e492ce2e3379dcb1d9bbc6e943cdd4b8d9d495d46b67e0b7803789b876", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933055, "uuid": "85e7d721-f2c8-43ae-ab56-f2c0e7da3566", "value": "T17575F15E965260DEFA5D10BA82939100F037783682359FFB27E4E7B30E136D56E6C728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933055, "uuid": "c9c12536-9fb8-4414-b24d-ba7174475681", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933055, "uuid": "93dd4705-a7e3-470c-a48d-21db2f91d10a", "value": "24576:q+2C0CnMJ5k/Y81mUJO65HBaf+WeSY81mUJO65HBaf+WeU:qM/nSkgOmq0pedOmq0peU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933055, "uuid": "7ce476cf-df12-4016-b376-62c923b439e1", "value": 1629184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933055, "uuid": "225aa2c2-ad62-49d2-8d52-45b9f976bb29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933055, "uuid": "eacca05b-cc17-4cc6-93f1-defbee84ca80", "value": "228bfc289ec99763fb0d45f2be8a7e9c193abd6c7e9b57642458d4341f0e1c7f.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdd1673-649a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752927459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927459, "uuid": "7653e3d1-4bc9-4662-bbc3-27201802a471", "comment": "Malware payload", "value": "3722b6f797279166f6e078659845e7b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927459, "uuid": "9e92246e-c397-4113-ae9c-d98716e7e810", "comment": "Malware payload", "value": "24abbb9ed5db5e94f20cda6771a3caf12fc2b552a72af5124c7ae192f906354e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927459, "uuid": "c7fa33dc-d9c7-402b-853f-4d5d839ac32d", "comment": "Malware payload", "value": "158e6104b12d285fcec37abfd0b8d1f6615d2110", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927459, "uuid": "6e6bfc77-1109-4136-8892-3d224f1f5468", "comment": "Malware payload", "value": "4f95f5d464a1d71628263b05eef40167bd38d9e4606a4257264aac6d298be565d660072ae0d82067d363d969d42ed691", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927459, "uuid": "e98f6243-2e9d-4824-940b-a6b7abf2ce06", "value": "T1B7D2F1B54A74C068CA907833ECD3D9419AEE1D7850DDB1B13901E3A93DD635B22FDE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927459, "uuid": "1551ea2a-e2e0-44e2-abd6-dc22500111ae", "value": "768:g6Py3Rj7WL+E/a7Qq/DMIx4r8vf/3EIsnJq3UirjP:g1Rj7G/acqLxg8v0IsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752927459, "uuid": "075b6c40-8396-4ed5-a2ca-c354a2deaab0", "value": 29488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752927459, "uuid": "fee49ac7-d26b-4390-9daf-68f4342d1b7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927459, "uuid": "f891996a-5bab-4ab0-b0f2-26636556c2d2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a44c7b-649f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752929676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929676, "uuid": "1ac8fbef-12fb-4017-bbe3-074737095548", "comment": "Malware payload (Gafgyt)", "value": "158078054783f7ba88a5d323db439bbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929676, "uuid": "bf24324b-b2ed-4d98-ae45-17f77f69ce8d", "comment": "Malware payload (Gafgyt)", "value": "24c2da8f4cc60c16b0782ba259f5e88a50d3dad06b04f06f8859cf36867fe8f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929676, "uuid": "b1cced0b-f5e0-403e-8cc8-60974e2886d4", "comment": "Malware payload (Gafgyt)", "value": "709a957cf923358bdcaf13f114c1e9b6e8348585", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929676, "uuid": "44502193-7093-4cbf-b6ee-96c8c3d800eb", "comment": "Malware payload (Gafgyt)", "value": "aec2d2a0ea438646247a4138bb2db9ce25fe986a31b034d929799b015e64d93d83f4a1930618bb461b1e61b4c671c5a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929676, "uuid": "e62b2e62-ee2a-491c-a842-63b0388a85c1", "value": "T1AD037BA3C9662E58D318C6B17420CF765363E464958B5FFE117AC229A043ECCF61A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929676, "uuid": "84848e2d-fff9-441d-9da9-551e08f9c4a2", "value": "768:QfOShJT/J7x7hc5VTKjTdn2a2oTV/CgOB9sfR9O5IV:QGShJW3KjTdxJZ/CgJ9e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752929676, "uuid": "3d38de4e-2f34-4f9b-b562-1795052caa0d", "value": 40776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752929676, "uuid": "1582c505-7e74-42ee-a5bd-76a5c695f656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929676, "uuid": "779f2bda-3dc1-4896-b3e3-50f3e273174f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19c2a7f-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907925, "uuid": "710b545a-6a65-4a41-bbda-775d10b6a2d6", "comment": "Malware payload (Mirai)", "value": "6ee1e3ba912623feeb235bbd62e65d1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907925, "uuid": "30aa5f37-e45a-4aa6-9a4e-6a3d4bf36cec", "comment": "Malware payload (Mirai)", "value": "24ec6a67b03b9e2a7050d6ef43a964451af8600c6d5f468441ae014d11d53d5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907925, "uuid": "fc985eae-0e43-45b9-a68b-04d185e5ad80", "comment": "Malware payload (Mirai)", "value": "b9ea3a3742a759e5fe938a397f508fc747c609ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907925, "uuid": "9d64a5dc-5f54-4b0d-ab18-3b86a5e5a5a0", "comment": "Malware payload (Mirai)", "value": "59a1854ade517537a8bc2d07be7f9dbc8d3390a00b5ac6163645ee9d870db303907552a538ef248dcc5361f2c16623c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907925, "uuid": "c06e5b25-13eb-4ff6-a985-8a2ed27665bd", "value": "T124A38389E924937EC7E1BBFEF75906CE3B390A68B79333155A3559A037C8B50AD39010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907925, "uuid": "c4feea5d-a6e1-43f1-9c46-0200f3564a87", "value": "1536:J8sO241vyU+vfTpWtm+vgy5EqB9UJ0ZrhfxcnQ7Dv9TGD1a6JJNT55:J8sc1aUofwm+vgy5EqnMWfv9TGQ6JDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907925, "uuid": "3ea6c188-634e-453a-a079-2e8d284fb2bb", "value": 105708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907925, "uuid": "b24d3e24-b145-405e-950f-dec9e2850312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907925, "uuid": "e29bf5ea-3616-41c4-bc56-96149398f15e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486bfd61-64ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ACRStealer)", "timestamp": 1752941169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941169, "uuid": "4e6f7cf9-1c3f-4c88-9dca-6a6544bc3f7c", "comment": "Malware payload (ACRStealer)", "value": "7f6c79a75b382b8e2c6f4e1ec6b5cbf5", "object_relation": "md5", "Tag": [ { "name": "77-83-245-64", "colour": "#5B4F00", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941169, "uuid": "00dabf4b-56df-4548-b677-87e4337293dd", "comment": "Malware payload (ACRStealer)", "value": "2600078eba39bab316e8f8feddbb642257698ecb3faab3b00ae613b4829f0a1e", "object_relation": "sha256", "Tag": [ { "name": "77-83-245-64", "colour": "#5B4F00", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941169, "uuid": "da11e18a-6ce8-4cfb-8d50-c5c3b56b273e", "comment": "Malware payload (ACRStealer)", "value": "9916edcc2b9e67eee6f2e0aa5735a0ae07b0ce16", "object_relation": "sha1", "Tag": [ { "name": "77-83-245-64", "colour": "#5B4F00", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941169, "uuid": "46cf7436-b41a-4ed6-933d-07cdea21c018", "comment": "Malware payload (ACRStealer)", "value": "15512bf274bb66f8dc3a388ea733339485303fa5aede113bc566790ca0406f47424417a4c52fb17d6f98c2aa87a648f3", "object_relation": "sha3-384", "Tag": [ { "name": "77-83-245-64", "colour": "#5B4F00", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941169, "uuid": "0f54a122-8e5f-41d0-b272-b551612dbf51", "value": "T1876633083EB6C3C3DCBF92796D725CBB4E7021DFD48B9576663A811C6B898E35A0D046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941169, "uuid": "2ffefe8d-ea56-4a49-aef1-543858487486", "value": "196608:DTwKAeglexRIpSRvOCBWVceOB/txQPRuF7IZ7THyNCfy0n:DUagIxWphVcjB/jQPRuZm2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752941169, "uuid": "399f19a1-97f4-457a-a3c0-68a72fdeb96d", "value": 7108837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752941169, "uuid": "185d24bf-cbb8-4a93-8d0b-5b1212463ca4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941169, "uuid": "0ef3f84e-d3d4-4473-86de-dd831197e64b", "value": "#0p!EN__H\u00e9r\u0190.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8d0cab-64af-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752936449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936449, "uuid": "11b0f019-fc26-41ca-a38d-f504ddb2d9e8", "comment": "Malware payload", "value": "82e02275571939980be495b0c06be632", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lomejordesalamanca-es", "colour": "#58072F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936449, "uuid": "52cfaf8d-96c5-47cf-b502-845dde79e5d7", "comment": "Malware payload", "value": "26540cc1594edfd9a077cef6a50010f1f0669c75d1895cfd2dd8a547b45aff27", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lomejordesalamanca-es", "colour": "#58072F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936449, "uuid": "04a5b1e5-aebe-4b95-bb94-ef344ec6ee11", "comment": "Malware payload", "value": "a1dc105408b14b6593c5532ad0288097cdc7a83a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lomejordesalamanca-es", "colour": "#58072F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936449, "uuid": "05a3e1a8-b104-4388-9f82-d7a973e511e3", "comment": "Malware payload", "value": "94e32f1945ceff7ffdca2cfae85869c55f3e1b42a9d3061fbae135c2865883d682fe05aa3594325ae17ec442350bbd73", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lomejordesalamanca-es", "colour": "#58072F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936449, "uuid": "6534149b-2af0-4b9b-bd04-bc9e9fea4125", "value": "T13A8633BE21E35E56EC3290F870C082BD2DBF95594D17DC893105CA6ED2F6DA3A4CA46C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936449, "uuid": "febe2632-239a-4f6f-99ba-798079637491", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936449, "uuid": "46c4d5e4-48e1-481a-949e-1197a089543c", "value": "196608:OXdQohjTAU+AvXt14pZ93igjLS1iu/dd+pYQvS:OXpTZFo9ygi1D+pY+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752936449, "uuid": "df157290-8b92-4688-84b9-be85e1770b3e", "value": 8561048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752936449, "uuid": "6ad38dd3-77ef-4d03-bcfa-05b0b63d31e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936449, "uuid": "2362ca43-8984-47d4-8be5-8954b3a1be7d", "value": "chrome_134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757c20bd-649c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752928359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928359, "uuid": "0253dd9a-c376-4c91-91b5-f8160a8ccca5", "comment": "Malware payload", "value": "5c6947298d3abe1704d96be6d5390079", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928359, "uuid": "e7d7ba61-2f41-4fa1-90f2-d0e514862278", "comment": "Malware payload", "value": "2839830b8b30f833e79146469466a2d247dd74363b2584aea9e785290c583631", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928359, "uuid": "1592266e-ef14-4c49-87e2-101f800bd7ac", "comment": "Malware payload", "value": "4dd6cbe4a81cd3e867d82ae2caa7c71d33cb4f7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928359, "uuid": "41bd4430-3d1a-4dba-ad77-f058c3a7c656", "comment": "Malware payload", "value": "ba89f5dc1074208ca26c442c353f18a2e04294927f795ebec0da24165412b6d77e806d0a620445d743454b609a70f096", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928359, "uuid": "7539c602-4387-42b7-955d-aeeb322e0954", "value": "T107234C02B70C0947C2636EF03A3B67D1E3DFE99122F0A648664EEB45D1B5E315686ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928359, "uuid": "a9d5f11b-fdf9-4787-94ee-68f41bf7cd97", "value": "768:XWgX9gkl4dmAoHShrwfy9XXEDj3BSx+w0azSwFGut4p193vI4:GgDl4LoHS9wfsXU/Bnwr4uWpf/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752928359, "uuid": "88619a4f-9417-4f8a-ad0b-915e62384592", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752928359, "uuid": "85166d69-f933-4731-bb85-53edcb264cc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928359, "uuid": "ea2c2cb7-9bef-472a-b987-3a98956167de", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d80b35-647d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915264, "uuid": "d098bc76-3ea6-4cc0-b18f-692d823c9f2d", "comment": "Malware payload (Mirai)", "value": "a7a1c4f4700cd74ff2031c825bb003f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915264, "uuid": "f34934f7-08fe-4359-a4d2-82f5e7774be9", "comment": "Malware payload (Mirai)", "value": "28a1218a3635015d3ccc5abf88333784f9b2ea4cdef4c442e19ec95b8537b892", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915264, "uuid": "b614f1d3-bb93-43d3-b68c-59b8d6cb4345", "comment": "Malware payload (Mirai)", "value": "7f6ef9ab8f63ea2ce5f2d282de2b4295a0142c2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915264, "uuid": "44ac0f25-766a-4def-9629-de20c38fe63a", "comment": "Malware payload (Mirai)", "value": "656d0727958c51bb3c8db3263038070b7cd9b4cdd7f96cddae724b6b41bab55db05991541cccff850238545d054ae474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915264, "uuid": "1ec88dff-100d-4bd3-92fe-c57e74fbe7d4", "value": "T10E82DF3061AB35E5DBE14430EAAD8EC6A75B0BF8D1FC36D317586B7C894210225F96CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915264, "uuid": "632409ac-71f5-4dcd-bb5b-d3e244a1a00d", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaezhymdGUop5h5lm:6GV0P6+kom0tVAoNvm+to1es3Uoznlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915264, "uuid": "325a4e02-5adc-49cd-915f-a094bef9f410", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915264, "uuid": "cdb219d9-5933-402e-942d-e4a5c4d6bdae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915264, "uuid": "fee11c6f-e845-46ea-a3f9-c8bd4d8c7b42", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc84ace-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752932933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932933, "uuid": "ad98ad72-eadb-453d-bc08-00697ec8f8df", "comment": "Malware payload", "value": "5aa75db7cd03363f32a7665155313cf9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932933, "uuid": "d6f79d63-6dec-44b8-9442-160704cb5302", "comment": "Malware payload", "value": "28a5d75b5f95e0f37b7e8a0283363063bcb97f91c36be65fa4cad48558840600", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932933, "uuid": "bc117864-96f9-4d03-b223-95853494f3da", "comment": "Malware payload", "value": "b66591fe7b80347556ea6020bad2215a60b39bae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932933, "uuid": "c5e82466-e18e-49fa-a808-93108c523995", "comment": "Malware payload", "value": "bcd51e39e863ca277e6e0dad7fcbcf5d2ccac0adec416f752dd73767bf80f47178a91ab6232a79125ae3d0b73ad069b9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932933, "uuid": "c204bc96-7783-4b9d-9692-c343d79cff6f", "value": "T1E3283322C418159FD916D4F99F2F934276DE0A606C6F7D4AAA44FE68381B0C37B3398D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932933, "uuid": "0cd4f984-0830-419b-a8db-41dad43ad8a4", "value": "1572864:wUo3t9Ebj6u9kEB5Gm0ZrbyzBOuo9wdS49iP8Pp9e5VdqOwKIrblc67i:ZASnCtb4Ofwd5Zp9enwHKIr77i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932933, "uuid": "01ed85da-92ba-473f-9b74-a2a7a6140793", "value": 93551549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932933, "uuid": "88495dd3-dbc4-49ac-91a5-6574052ed35c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932933, "uuid": "a95b285c-0927-4dcd-9b84-f16dd4e81afb", "value": "kiiya_mrpd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e3492c-64d0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752950746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950746, "uuid": "ced7e7dc-0e52-46d7-bcb3-d82f70e636f5", "comment": "Malware payload (Mirai)", "value": "7bb060043155062abf7e5d2673641f08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950746, "uuid": "7d514ee4-4124-4238-889c-6db29719a64a", "comment": "Malware payload (Mirai)", "value": "293ffeef80554730fe570021eaa5c8707269c33ec897d7ca2a77d66452a95fe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950746, "uuid": "925e4023-303e-4867-98ad-17573e0978af", "comment": "Malware payload (Mirai)", "value": "b6294c2ede67507cf29b7421c84e8f74a824e87d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950746, "uuid": "3d9f4556-e831-4eed-983a-708f00a504d7", "comment": "Malware payload (Mirai)", "value": "b513c2139729962b59d0e166d70c486f59ddca1cd99f0ce65fab21aa951cf0bed6f480f339cc41e481952cccd05d11b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950746, "uuid": "541ead22-5c97-42e1-8904-b1b7d7771985", "value": "T159937CC5EB47D0F1ED5641B1583BE7365333E43E5029EA86E32CA932DC92950DB2A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950746, "uuid": "1c78c0d3-0414-4240-940c-817c41141c3e", "value": "1536:XJcXRwTyjif44VwsZKODzJ7Gje0kq+/BmgjSVnC:5Ew+jidVw7ODliq0kF/Fu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752950746, "uuid": "83b10e60-2a0a-40f5-8331-f151605e249d", "value": 96648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752950746, "uuid": "fd5a9eda-0f49-498b-81cd-7001be894847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950746, "uuid": "bee4b608-fbcf-4f00-92b3-4749b470cf34", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19348c48-6470-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1752909307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909307, "uuid": "31e6d61d-39e6-4188-a29d-979c8ca756dc", "comment": "Malware payload (Amadey)", "value": "5af97758c2ec691e2e843dbcdf07af39", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909307, "uuid": "d60390f3-29d1-472a-9ae7-5eae152764b3", "comment": "Malware payload (Amadey)", "value": "299fb737bdd2808097fc60407ca7ea9f76b277f2b7e8156e44f347365469405d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909307, "uuid": "e3247eb7-8e75-4e8f-981a-868da3c2d4cc", "comment": "Malware payload (Amadey)", "value": "be75f4910d5d0e96c1e6f57b39bccdf9ef56402e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909307, "uuid": "241af586-0226-4818-aa43-cd7594c6efa6", "comment": "Malware payload (Amadey)", "value": "3cd9f62d6504d5667bc83ddc67c0916b2a634a02837c7348ef5ca23dc50ac480212e13e719dd2a2cfc5fd6df86dc5171", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909307, "uuid": "110c02ca-623b-48aa-a210-fa2163d8aeb0", "value": "T102945B217813D032D66291721F79FFF585ADA8259B7109DB7BC00F769E202E26A31F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909307, "uuid": "79fe7b89-7952-4f1f-b6a6-1fbaac0fed78", "value": "1e7280afbf80c2800b272220ce0718da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909307, "uuid": "79ab702e-ec70-47f2-bf43-3a2f0940cb0c", "value": "6144:LPUIrO0NCh31Alxujw54YsnLiO1ptnvT0lAkuW8GUi/83FrPKoTIf504AO3n2/jd:LPUIrO0NChSlMw4vn7T0lAnW8BKgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909307, "uuid": "4cac4d77-cc94-43ca-a30f-fbd00115c726", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909307, "uuid": "1420f0fa-cb30-440a-8196-be8d45bb71b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909307, "uuid": "a6b3cf03-6489-48ce-ae05-a3f055183862", "value": "SecuriteInfo.com.Trojan.DownLoader48.44171.1680.24750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5b5370-64c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1752945012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752945012, "uuid": "16909c83-65fb-4794-8673-83a03cca47a1", "comment": "Malware payload (DCRat)", "value": "cbdc63e5f79cd2eab9b6e0edc51dad5e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752945012, "uuid": "b4424a83-fed3-42cb-afa6-9c79a08065dd", "comment": "Malware payload (DCRat)", "value": "2b2431e573b21859215ef274be6597132161163a62bd1036fac6f29eef3077d5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752945012, "uuid": "0bff66ec-6b55-4d3e-9f68-cd358dabe5b9", "comment": "Malware payload (DCRat)", "value": "7f451c27434342289aa673ea6d5b033ef7082bb3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752945012, "uuid": "ef61f5c9-6828-410c-b0ab-1dbcde498d81", "comment": "Malware payload (DCRat)", "value": "ae5808c2f2c833189cb803b796553f5d14385fa50b814ec6e76bdf32d79eebfd33a0ed42d3c0eed2cc8f37e207ef8ac0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752945012, "uuid": "7c3119e0-3df6-41d6-82d6-2f28b44c6139", "value": "T185253802BE44CE11F0191633C2EF455887B4AD516AE6E32B7DBA336E54163AB7C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752945012, "uuid": "7c874b5d-f097-4b31-9d86-ae6a10b5800e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752945012, "uuid": "d56ee840-ef1d-4f75-9b98-702b8abed27a", "value": "12288:r/XDJUO4FciBu0cMTw72EF6VE6He/P/uPr4tn23nkq5R166254TJsJMC6ZanDwF2:bNUO4FTk/F6V8P2PW233H1665EyanUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752945012, "uuid": "ae57ec5b-72fa-410f-9fdd-01db0ca1191f", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752945012, "uuid": "269fa69e-eda1-4669-9825-b7946bd82b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752945012, "uuid": "c95fbe51-1970-47b6-973d-f56b61e15c4d", "value": "cbdc63e5f79cd2eab9b6e0edc51dad5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79048a8-64f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968386, "uuid": "d7f4d63f-9138-4b49-aae4-a908f43f4178", "comment": "Malware payload (Mirai)", "value": "0425fd45c35be2f15a555fc6d37a403c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968386, "uuid": "98b5cd1e-7701-4301-a5f1-1d45c8570d89", "comment": "Malware payload (Mirai)", "value": "2c1ac6222e6d16276be68861c7b4e944866436e5408b26cbca2396fa0ccf79a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968386, "uuid": "7bea4eb4-0721-4ae8-abcf-f3f7e502cfc1", "comment": "Malware payload (Mirai)", "value": "c3de6581f9a97decd4ad5caf2c372f6a7981743a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968386, "uuid": "e1c73164-ffce-4b8e-bde2-1809825e5918", "comment": "Malware payload (Mirai)", "value": "3b62d2bc12342d213e79000c67bbaa2f292b52d0a7cade87c4e736967c95eaa3e347d9632c18f417be990949f817aae2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968386, "uuid": "cb1ee82a-96cd-4dc5-8277-068156b1e48e", "value": "T1669307EB6A3D17A7C4EB06B23C5737F48B6DF92102E411C89245AFC90776A786031F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968386, "uuid": "1e26b757-4123-476d-bdbd-513afff559c6", "value": "1536:LLsipa0nPJO9TxZe9S99Dh1918N1+UgGk89e3LRFvcBhKCDDkS9IaUSDgrE7fKLv:LL0/waUgGBDISDYeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968386, "uuid": "c9adf88e-1280-445f-a70d-271fe9c84dad", "value": 90738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968386, "uuid": "17c7130b-97e0-4582-86b9-207eb5de4294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968386, "uuid": "aa7cee9a-e963-41a9-8dbb-eebba5cd3e3e", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47568214-647e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915397, "uuid": "837c08a7-75d1-480d-a17e-5bfc3429b7fd", "comment": "Malware payload (Mirai)", "value": "59f2cb2f1fa2d8e2a1677c676f6257d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915397, "uuid": "4e6ba4e8-d7df-4707-99bc-d38168abc1ed", "comment": "Malware payload (Mirai)", "value": "2cb958c5b420e8cdd9a3d75c2d2e38375429560200ea35be029fa68189d43e87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915397, "uuid": "e600e749-3c24-4467-b957-37c2505dbfae", "comment": "Malware payload (Mirai)", "value": "fb07777f5a4493d4a9320cd065653025dd2be538", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915397, "uuid": "8e05a661-65b6-42e6-8852-0bf410413763", "comment": "Malware payload (Mirai)", "value": "f125b00e3ed3997c29c6179abfd5fdb02f6103bec9e059e75d8af43255b9b5ce8a4a229e81b54fcb2a0908dbc4f711e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915397, "uuid": "f7d6d779-e94d-4bc6-8983-4e5f8ec309c9", "value": "T17373A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915397, "uuid": "93249eb5-1180-463c-9c96-cad0a5e2467e", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStH:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915397, "uuid": "101d1372-e56c-40db-be34-c5d478be7dab", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915397, "uuid": "c7519863-2b38-48bf-a81d-087b64868f9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915397, "uuid": "5b9b12fa-3ca0-437d-bece-9a67801cb660", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe4c275-645c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1752900916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752900916, "uuid": "69dc0b00-2427-40ce-b9fd-07383237ae1f", "comment": "Malware payload (ValleyRAT)", "value": "ebf6d76ce8cdeabc30307ef42ae54a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752900916, "uuid": "8c4b6995-93f3-49e7-96e5-0699be6d2a6a", "comment": "Malware payload (ValleyRAT)", "value": "2dc17b293356d33e0d9ea9941faced57258b44e888e7b286477422bdd6429d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752900916, "uuid": "4935023b-fc54-4bf4-8944-9c5cad3056eb", "comment": "Malware payload (ValleyRAT)", "value": "584c73b99922badb5b0ea0b635885f6edc9e368d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752900916, "uuid": "85e55551-c23c-4e8e-9f1d-191793341f7a", "comment": "Malware payload (ValleyRAT)", "value": "731f8a1643a643d3002ea8a3b1006eba5b07a4cefa1331e35c264af21b2f7a4f6812ef0857a9ea2b952e94a6711e9219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752900916, "uuid": "38a69d42-a18a-4b82-8f95-8e28854bbcfb", "value": "T160F36C4733A450F5D5A78275C8A29A06E7B3746A0731A7CF17608AA62F237D0BE39371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752900916, "uuid": "90202f42-7496-48b7-8742-9dde2248d7bd", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752900916, "uuid": "1146c46d-3cdb-4acb-9940-efdf43037264", "value": "3072:0O55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6o0AcS7DZW6yFOBk:0O5n5d56TYZQnB+DpekyyqmxX7I6ysBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752900916, "uuid": "41f0edc7-f5d5-4e7f-9617-3656b74979a8", "value": 167155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752900916, "uuid": "23938ea8-0aad-4b62-9669-3db882a1e417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752900916, "uuid": "0e63eda1-f6cd-4779-a129-f4ba1aa7f7c6", "value": "peinshellcode.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb324770-646f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909256, "uuid": "9d50734f-980d-4529-910f-773c9801967e", "comment": "Malware payload (Mirai)", "value": "520e2ae26f1060e3463a876b70379641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909256, "uuid": "b5f5ad6b-c668-40dd-8197-9efdf83193af", "comment": "Malware payload (Mirai)", "value": "2e5b8979f722038f9929c0f8a15806777ab118cac57acb2382db353afd0995c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909256, "uuid": "82fb8faf-582b-4704-be5c-514cc79aa4b2", "comment": "Malware payload (Mirai)", "value": "68a9946a2695e0cdfe32355e33f3a1dae0ae877e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909256, "uuid": "9f0a6f41-ee85-42cd-ae5a-68da4387446d", "comment": "Malware payload (Mirai)", "value": "160ca67d5a0ad162b40c6fc8c5dfe9ee9c6eadffa41c563cecda76a20ffd7a6abed93da126652f5a36ea76406a9ef67f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909256, "uuid": "0473f496-68e0-435a-a9a4-86e3d11fdcbc", "value": "T14E235AC8F543D9FDEC5B09F01576F7B35E72E1E51218DA82D3749532A892602AA0BF8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909256, "uuid": "195cf470-8a9b-4faa-973e-52b6d75657b4", "value": "768:C48ZAcqqDe+bCz/KMC8Z+0TiLGEOXfNXIlwy883ho4hfA2+CbI9ZYH8m8YLmqKIp:Qycq5+bCDKz8Z+cbhNXCwynxvA2+Cbev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909256, "uuid": "6e9ca605-8b06-4da3-88dc-d64f216370bd", "value": 46384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909256, "uuid": "3ff2f588-9a60-4e88-8b0c-9edace3c043a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909256, "uuid": "b30c4d81-ce1e-4fd7-b0fa-8781b47213d2", "value": "nexusnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30dda2a-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CryptoWall)", "timestamp": 1752933294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933294, "uuid": "fc1ace50-6e44-4126-b950-0a529a8bda93", "comment": "Malware payload (CryptoWall)", "value": "588ce959e3a45a3498b9cfa975cef7f4", "object_relation": "md5", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933294, "uuid": "78ebfbbc-264b-4a0e-a711-b568ebbe1426", "comment": "Malware payload (CryptoWall)", "value": "2f2e6c6de16bafef0be0926679622222db50429af7517cecd82fb19403a83fbc", "object_relation": "sha256", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933294, "uuid": "bd3d2f33-5b4b-4e1c-bf9e-5e9670c15a48", "comment": "Malware payload (CryptoWall)", "value": "0beba6e6fda80fad4d8de0aded45930456c5bea3", "object_relation": "sha1", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933294, "uuid": "9563f2a5-e5a0-497b-8282-a1a6b7c3ba5b", "comment": "Malware payload (CryptoWall)", "value": "dcbdfda0bfb85c00debe9b27a584343083a7444a7522584742bd1505059d4a794176d5d1408b4c4de24f1c59e600e241", "object_relation": "sha3-384", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933294, "uuid": "736c7e64-71a2-44d8-9b5d-95d30f7efea8", "value": "T1DF23262929EA201DB1B3EF507EE438D9DDCFBA737925546B1085070B4B12E44EE9273E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933294, "uuid": "b25492f8-bbf8-4936-b690-cc18083660a5", "value": "768:tNkK8vwMw7RcJHVvfJfeCVTGyUu0smy7gNKsNC6rmPPkLn/LLd4fgWHmLxbA+3cm:DhDMwdYF/oNbAGtFGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933294, "uuid": "e93bd3c8-d81b-4d79-bcda-af1b15ecabd5", "value": 48045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933294, "uuid": "6e2a4330-652b-4734-a647-51a944c341ed", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933294, "uuid": "5b2880ba-8d32-4d3f-b6d1-5608c4f43a25", "value": "Project_Workshop_7th_Minutes.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3a81c9-64cc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752948802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948802, "uuid": "430c78d6-628c-4082-bedd-8632a8a1fd71", "comment": "Malware payload", "value": "1bccfb1701b4230b859cfdfbaacdfeda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948802, "uuid": "57e748b4-7620-46d6-8119-d2b6f7c2e667", "comment": "Malware payload", "value": "30521a22cab7940fbdd84dca150d4aac7db2fe69998806aeb6d7bb537d1e013f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948802, "uuid": "fafeeb0e-4791-4a51-8c9a-a39871742421", "comment": "Malware payload", "value": "c72dbb60cb6b0c65427cacf65889a5504eeed5a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948802, "uuid": "650cc810-1f29-4897-b97a-3dfa1f9e7c38", "comment": "Malware payload", "value": "19b77b7eabd6dbde363ffb0e5fff983dc787b02c37a00aec793be79d184741e2250b8f6c69b643099879b21997bdfb5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948802, "uuid": "05cfaf23-e523-4591-a107-2da17a31e77a", "value": "T1E2C33B56EB819B03C0D61775BBDB424533239B64D7EB23065A28BFF43F8279A4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948802, "uuid": "a34dbac1-f901-4e48-8764-f82b69b141b3", "value": "3072:UCAm0aazaCLE5VBP6jETaoo8AjS/6M/94ojy:GmpazaCLE5PP6vjxjSSM/94o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752948802, "uuid": "11429765-21e0-4886-af71-d1ed74c0bc72", "value": 125270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752948802, "uuid": "ae1f30a5-106a-42f4-942a-a2fb4ae531c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948802, "uuid": "b4ff904a-4254-4747-83ec-0240a261ad86", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b8cd91-647e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915341, "uuid": "6bd2eb58-5b08-467c-9864-e9b662b0653d", "comment": "Malware payload (Mirai)", "value": "2318bd4cbee020ac3acd2bb5b83cb71b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915341, "uuid": "6a25f79f-0ae8-41d2-9f90-7a381e935266", "comment": "Malware payload (Mirai)", "value": "30718261eb747bf7cd33787fc39954d8958f8b6562a1e36fd05d1f9407632cb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915341, "uuid": "ee3d5a1c-0c1c-4c71-b9b9-583cf0e6b882", "comment": "Malware payload (Mirai)", "value": "63d16334477be9924eafb8404bcc36b7c42d6d53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915341, "uuid": "25684c8c-1c2f-44d5-ad2b-c5ed28377960", "comment": "Malware payload (Mirai)", "value": "df9a08aafcb5c78e3fcba4a2733e7c257c76097e8bf5d5f25ff4d57f423abf3f1b9f73bdf2c42238c3fbb56ed3f7d12a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915341, "uuid": "dadd8c64-13db-41fe-a9fb-99fa33a8884e", "value": "T19B336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915341, "uuid": "cf09c179-171a-4ac9-aa88-1b1f6f0dd671", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915341, "uuid": "b24b9cc5-e779-4477-8eb7-f32a1c18c728", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915341, "uuid": "a9eaa7c8-5e38-431e-bacf-50e653094a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915341, "uuid": "3ff43884-782e-44b1-aa86-4b82cd36aa27", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df02df1b-6489-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920376, "uuid": "6d2600a4-2f4e-4477-99b2-be48faa76c76", "comment": "Malware payload (Mirai)", "value": "42259d0951706ba0ed055c11504efd57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920376, "uuid": "5e5c33a5-090e-43b2-8e17-a8eab8485748", "comment": "Malware payload (Mirai)", "value": "311cdbc1475ebbbe586bfb4ffbbc4726f9a63db29f3e0e016bcb90ba433f61a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920376, "uuid": "3ea54774-6572-41ef-ba9a-cab25f494684", "comment": "Malware payload (Mirai)", "value": "2873b8c3dcf354d955c9e66364822a50e7f8e943", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920376, "uuid": "e1cf8af8-61a4-477d-8dbe-0ed369e6e13b", "comment": "Malware payload (Mirai)", "value": "eaeecd4f074bb6bd09ec0273824d02f926a846fdd100caaf8b87cdc806b2c1d6ce965166f9555aaee73d974d39f0e61c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920376, "uuid": "1b64b842-c18d-48ea-b26b-2762ad7e2695", "value": "T19A041A46EB404B13C0D727B9F6DF424633239BA497EB73069528AFB43F8679E4E12905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920376, "uuid": "d7704e05-b4a0-4d45-a711-612b46432450", "value": "3072:YCArroBW+mUZeiazRqeABYlnMpMLjec3Gj9oWM/ROyK0RLn:jAyW+bUiazRqeABmPLjec3yKWM/RvRLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920376, "uuid": "9a62096e-a0af-4e5c-b124-570183d76210", "value": 183491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920376, "uuid": "ecaf611f-bf58-41ae-bed2-93444bffa7ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920376, "uuid": "8510321a-78b3-49ad-8ac8-c0751a2a7517", "value": "iotmirai_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8742b492-649f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752929678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929678, "uuid": "978b44fd-d6e2-47a1-ab08-1a9540320649", "comment": "Malware payload", "value": "19bed1d804cf897f4865db7a98754857", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929678, "uuid": "5d50ad08-f793-414e-8708-8260e7c2d999", "comment": "Malware payload", "value": "31634c4474561da7783a19b9146ac8a2c851562bb06f2a37047114f81518c898", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929678, "uuid": "b56a351e-1f78-4265-a662-906807dbe910", "comment": "Malware payload", "value": "b2f78452fc6f6e7a7fff53cbe4eb8fff46f2d6c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929678, "uuid": "4a00c67b-c781-4094-93c7-7b7714e895a1", "comment": "Malware payload", "value": "a85808cae7611215d5e41fa5206b671b6e829805e41ae991887a1b2270361304c060e8467797b9b156122f4fad1ed567", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929678, "uuid": "51f260c5-c7ad-48c2-b02c-84cafda514d5", "value": "T19851B7854DC380BAAC759F33F96986A4399DE0C7B8D0AD6654EC3CF5404EE046C5AE93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929678, "uuid": "b1615915-93c5-4d9b-91e9-8fd3579e87ef", "value": "48:U1dAdOP1deMdelX1dydY1dFdS1dYudYntr1deRde2S1dvcvdvMf1dvBdv11i1dvT:UrkOPre4elXr2YrbSrv2rre/e2SrvcVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752929678, "uuid": "0663b3de-778e-43e4-b3fa-2e72b6a655e7", "value": 2712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752929678, "uuid": "903da67f-82be-4092-be5d-57d6a1b1e9c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929678, "uuid": "d4cc6f8b-f231-450e-9ff3-711d5c01e062", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd8f185-64a6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752932881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932881, "uuid": "53104769-8255-4ae7-90fc-0626f9461f98", "comment": "Malware payload", "value": "1093af50d86fce821d80ffe2ad3ada06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932881, "uuid": "3002aaa0-71d5-4251-81e2-0518f7417034", "comment": "Malware payload", "value": "31f55837a4148cf4d06a9f0e8556819770aeaa3b52e94e36a65d0e2cabfd0b08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932881, "uuid": "388ebde0-4f08-43e0-a9e7-c6f7368f7ded", "comment": "Malware payload", "value": "f1e7c9efe78721e4a64fd3aec1479f1066f035be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932881, "uuid": "2f4d066d-14dc-4e44-899c-53024cc7135b", "comment": "Malware payload", "value": "0c0d1c0605652707db674001bfa3be6e09e54a8a627ea0813e1680ac3f55b6dff35ecb60af1917f07b8a6207a52b3639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932881, "uuid": "9fbf14b5-98db-4cfc-bf8b-fcf74725dbb8", "value": "T1D2A131B55EAAB7D4FC7700BD40E6095FB119393288BAD3EBC2519176E83E6C04D41B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932881, "uuid": "b9de423b-3911-4b19-9e8c-7d39cc5dee8d", "value": "48:vpgOuhvCCnG9LkmMjcWosAdLCbMqn5m3QOClRaaih4X7+RwdNjFtj69Gk:Bh8G9LojjAmMR3O3fjFtj6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932881, "uuid": "f4fc115c-3e70-4dcf-87ea-9042fcf03a3d", "value": 4751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932881, "uuid": "31e888e2-ab5f-42a6-aa9c-8fd9fb3f33d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932881, "uuid": "0d72b5d0-a986-4a98-af34-924a442d433e", "value": "1093af50d86fce821d80ffe2ad3ada06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31f1d82-64fb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752969238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752969238, "uuid": "63bab2b5-c100-4dee-b314-2d9ce5c1491c", "comment": "Malware payload (Mirai)", "value": "f97b5ac11d2faaf80687a37c3187334d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752969238, "uuid": "0c769759-13c6-42da-9cb7-01ef477d33d2", "comment": "Malware payload (Mirai)", "value": "32065009ee57bacb5e144ccb87a8179cc8b7b0ad9892e08d7dadee5ba13a979f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752969238, "uuid": "2e4d761a-7d2f-47b2-b455-e0873fb4b356", "comment": "Malware payload (Mirai)", "value": "d949ab3d84ed70d461a12f3c5a7b3938295b252f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752969238, "uuid": "0b0013ea-344b-4d2a-be6b-4fa8e1312b18", "comment": "Malware payload (Mirai)", "value": "8bbbbcab6d239840cb3aabcd251d37f865a53a09edb7dee926c1f3daafa0bcbcdd5e7bb40d6057cb96e9662a2cfd09a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752969238, "uuid": "1c5b33bf-e7b3-4f7d-94b9-b48a0aed730c", "value": "T1FA939D52DA340D58C91849F070B4DA34DB5350AA81A72EFAB192C7F99C43DDDF529BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752969238, "uuid": "dba77302-f6b0-4efa-8404-d650ddebcc47", "value": "1536:z2TQwrivjdQZb6ry0WCOA1rwzk3Z/Ka7JWILq0CNgbRjHo8Wzl:zTwWvjBy0DOdgiadLq0B1oTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752969238, "uuid": "e5425cf6-e500-466f-bf4b-de24a65139cb", "value": 91600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752969238, "uuid": "d1c0c562-18c2-4152-8cae-a2c15d0cfdb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752969238, "uuid": "b18400db-b37f-4727-9e4c-b58a8b563dab", "value": "system", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f425caa4-64ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1752936303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936303, "uuid": "f3b38e46-4dda-4562-a9e5-05586f2c3506", "comment": "Malware payload (CoinMiner)", "value": "60676cc6812494e5730f9b6bb6d981dc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936303, "uuid": "1d9f6bb8-72db-404c-ae35-9cc931f0d3a2", "comment": "Malware payload (CoinMiner)", "value": "320774b6d6eb45b349c716d3995a1442f919db3f9144ac88ff950d40c0816713", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936303, "uuid": "3037eb85-7e73-47f8-b064-595a2901f236", "comment": "Malware payload (CoinMiner)", "value": "abec275950ee38c0f160c9e4b4f091018dfad356", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936303, "uuid": "abf2196b-8992-442a-9e54-9cd781ac593c", "comment": "Malware payload (CoinMiner)", "value": "106d0de65febd390cfb45ff7c37aea2b2703544c6e07f753589432e6e58ff88593a7d38a15c9b77170950c5dd3ba1da4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936303, "uuid": "a1b22682-39f5-4c5f-81a2-d8f486d903c7", "value": "T15D4633AFCDCCCE61C1482F3585BAA5661873E65C9624F3CB07863B68301059EB5FA91F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936303, "uuid": "4d9d472e-792a-4526-87c4-0a4d05f36bad", "value": "c25bd4d478e25b10b573efdb39409b37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936303, "uuid": "fa9591e8-5ddd-40a8-9851-0441576a4701", "value": "98304:RhtiJGVuQBJPtrgejjijowP8pNu93jc0RDo04CqNWppxvQHTyGp1lfa:RhtiJGf1Gefij6Nu93jc0jqNWrOH2m1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752936303, "uuid": "ec124d15-a00f-40ad-9f89-c3ee1f22f95f", "value": 5425680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752936303, "uuid": "b287f684-c49a-47e5-86a7-34010a63e9c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936303, "uuid": "c6b20141-ad29-4631-9497-c2517b4a89b6", "value": "addon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f7e4fa-64fa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968632, "uuid": "034b3cd0-f5fa-47ce-bf91-4036de3cf4a9", "comment": "Malware payload (Mirai)", "value": "807775647a6e73c5d4d63378fa5aea76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968632, "uuid": "3bf50d0f-7651-4e52-859a-a89ac2d594b1", "comment": "Malware payload (Mirai)", "value": "332029799bba13b4aef2095d475e5a23c7a9e4b949d4cd43c722ae4d0542bee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968632, "uuid": "89c574e2-3bc7-4f16-8a6f-ef6ebe91185a", "comment": "Malware payload (Mirai)", "value": "abc79bcb941246c06ec8133957cf17219ae22445", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968632, "uuid": "369777d8-427e-4dd7-916f-8ad148e7a61a", "comment": "Malware payload (Mirai)", "value": "39329af6127314bb09a8c56a229ed23f9ea2b419a5ef8d1d6ad7aa2f4e2f8ff371823ae29f8173b781a373f5969c863e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968632, "uuid": "f2ca0cea-e8ed-415b-8a71-9c2578474c63", "value": "T1B9B34DC7F800EEBEF449D777445B0906B230A3A50D521A3772176967FD3A1A8187BF8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968632, "uuid": "76b06d97-7571-4526-bc42-d11dcd576b36", "value": "3072:8Sgs0GSpLFb98lmNsS/rjq0fyiCMyEW547keSA9AgjV+N:8SgsaLFeq6uyEG47k7AVh+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968632, "uuid": "f357b4d6-58c0-43f9-bce3-1512b8f11487", "value": 107828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968632, "uuid": "f13de6fc-d1c9-4f53-b475-bde856bbc993", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968632, "uuid": "b89099a7-419e-4161-89c0-058de69d8869", "value": "katrina", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac362cd8-64c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946060, "uuid": "75de118f-82b9-4ae4-b7b7-b9311a6be0cc", "comment": "Malware payload (Mirai)", "value": "9c479fd2aa1e6486f5b810e98ee489af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946060, "uuid": "9ea36482-6826-4a7f-b764-e48cb11d96dc", "comment": "Malware payload (Mirai)", "value": "337b7f9bbc209aa0963eab896d1fef704f4f8c664fb8ea77b1483a8690c1dcaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946060, "uuid": "10aa2e46-058e-43c1-8834-041d127178fe", "comment": "Malware payload (Mirai)", "value": "1b287d92e63bf2adde1b81381eceb7cf4654c6ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946060, "uuid": "1323e406-cf6d-41cf-ab7c-17a4046ae88f", "comment": "Malware payload (Mirai)", "value": "1018b4fb69e9eb89f976eed99ecd9a13f95efc4d4cc1174475c20cf0559d38a5db712160df2e7bfbab7e2c541579a6ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946060, "uuid": "1a50f275-2123-4701-abb9-233b2dde7d18", "value": "T149A2D1287054E8B2DB346F71DB2885529BA34FF4D2F939A55700C2585A8508BB67C3EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946060, "uuid": "e81148f6-9e02-47dd-90c1-fddd661c0c56", "value": "384:SRLFgbGCsTeZSGOnFqJIg7myLmI95mfPiAvVO6iQrTPs2xkDhymdGUop5hL71u:ggyCHzgqIgSpiGPiO0QrTPhgs3Uozfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946060, "uuid": "5fd364ce-1ffd-43ff-aa9c-f91b6c8bfa59", "value": 22284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946060, "uuid": "a329c371-6ef8-492e-91e4-180195803890", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946060, "uuid": "a67f8966-40bb-4f12-bbf2-2b89037fb7cc", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b04187-6483-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752917535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917535, "uuid": "8efd4eed-466a-49b1-9dcf-ad5ee30d9ab5", "comment": "Malware payload (Mirai)", "value": "aa575e917df74e926b48a7a4fb8c7a24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917535, "uuid": "2bbc1ae3-168d-44f8-a7a7-6d623fe8ad18", "comment": "Malware payload (Mirai)", "value": "33a6f20085ccee2f138076d19681c70bc51e85de8a9a9feff8244cb8e781a53b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917535, "uuid": "41293cba-e6e6-4d67-9389-58f3be21b389", "comment": "Malware payload (Mirai)", "value": "5e4e68bb74d11539aa14b25ad6937dad02be537e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917535, "uuid": "fd48b8a2-4bc4-4645-9d8e-300ae3e1a273", "comment": "Malware payload (Mirai)", "value": "50e42d84beaa8db4c2b42a3505836fd041eed4fcbc2520e4b8acc06bef562d6c3c277feb9830791c1f971260af50fce7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752917535, "uuid": "15db05c1-d68a-40bd-9d7d-8810db1d5a0e", "value": "T1A123F7A2FD928AAAC5C067B6772F5689336363E5C2CF3353C8184B1027C661F4D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752917535, "uuid": "4071c8bf-a97e-4ea4-a07e-b2409e1c12fa", "value": "768:V/soXWOTp5iWxhLYVHmQ2++x5imzlbvVprGxbiTsQKsYjoN3MK6RNzyFGgnZz:V/yWiWfMHmTimzlbVprUAs5sYe6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752917535, "uuid": "44ebe2a9-264b-4877-a132-d35a9591377c", "value": 47700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752917535, "uuid": "a6e651c5-3594-465d-887f-638aab72d2ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752917535, "uuid": "c2d38041-6dcc-4bc5-9824-43a1a4b935a0", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f739e22c-647d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915262, "uuid": "4e87472d-8f1a-495b-95d2-c55f5886a226", "comment": "Malware payload (Mirai)", "value": "e2697652560710fd8c7d4158b1117fb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915262, "uuid": "4d2939e1-67da-4cd9-ad50-f01c38f31f34", "comment": "Malware payload (Mirai)", "value": "35d137e078d3eb474065bed1b0fd2bcafd0ec0aabb0b8a5b2c79f90a26e7364f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915262, "uuid": "f81e8abe-2a44-4186-8a7a-87e0f4f40d5e", "comment": "Malware payload (Mirai)", "value": "f30c040c9ff63295d34415483fc5468a06a4168c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915262, "uuid": "de4fccc5-45be-4ed5-8c63-1923d08eba96", "comment": "Malware payload (Mirai)", "value": "a945c049ceb8478f9d69298e1b000e09cc86dc4b1dab94c716cb54b246f47e79a0a4a534eae5f1e9204346f8ee2d23f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915262, "uuid": "99c4e15c-9512-487d-a45d-4975e7c930fb", "value": "T1E8A2D029D3456EF4DFAF9D9452C1C2C27BE543C72386D8E240EEAF016616046B789D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915262, "uuid": "57142a77-30f6-46d6-a3a8-af7386cd977d", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5d8M4uVcqgw05VxJZ:9RxsSVsMD6xiJJE5zRWNHj4uVcqgw097", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915262, "uuid": "e2ef37fc-0f95-4511-be5a-dfd609fc116e", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915262, "uuid": "f33ff206-877b-47d3-836e-efc161c3eda2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915262, "uuid": "fc955780-1518-4ca9-8bdb-a30e034da5cb", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2c5928-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907917, "uuid": "b36e9c31-5e8c-4017-8c50-8845f551bc4c", "comment": "Malware payload (Mirai)", "value": "26100e4fb309504a572bf96e78bfbe67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907917, "uuid": "e82cfd8d-628b-4e2c-81c8-10d3fe1198b7", "comment": "Malware payload (Mirai)", "value": "35d76441420ed9ace96dddbe52062b4b513c7a6ead4ae17c82281a741dc181a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907917, "uuid": "e06b6f32-ebd7-47cf-8f0e-88f4bbaa8198", "comment": "Malware payload (Mirai)", "value": "9d3a4054f051d1c839159544d9ec88f99f94fec2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907917, "uuid": "a7f1463c-1253-4462-8391-340461a82b05", "comment": "Malware payload (Mirai)", "value": "a41b6ca58f91d7a129d98de36b33c64c4968fef1f37970ff897e93c40c5c8b46208ed9c9cc9060abcc82a3b8a53f2b46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907917, "uuid": "6b5831a2-78e9-4dac-930d-2b248fb76cf8", "value": "T105D321397E217F7ED3B882320BFA2FB0C356619266D19341E2BDCA585EB424C4C9E754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907917, "uuid": "de00cffd-17eb-4661-92b6-cfbb7753707d", "value": "3072:/0Ikgk5CF1LB+LM5cd6Ez6RrwirrdIFntQEO8fq:4cRcRaEDfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907917, "uuid": "bf01b1b7-74fc-47c8-b41b-41da286549b3", "value": 130950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907917, "uuid": "abc000e1-aa8e-4c13-8c9d-362f2f50f49c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907917, "uuid": "efd87a21-0023-41ac-9db3-98ad15cdfae1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63bad0c-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933273, "uuid": "316e96ae-0a7e-4249-a941-8a599f9e5899", "comment": "Malware payload", "value": "fe4112dce925709491dcb569f33814d3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933273, "uuid": "312faac2-e74b-4533-9f12-09f7dba8dd96", "comment": "Malware payload", "value": "36160a5229c86f3c49bfd574f7ccddc40c4c82c9eff1aab979d9eddec28a4986", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933273, "uuid": "88a08b5f-a4f5-4587-a148-ab70557036e5", "comment": "Malware payload", "value": "104859a40ff6e0475fcef75425c1c559e397c5c1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933273, "uuid": "cf1fc54d-848f-474c-947e-f7569942d41a", "comment": "Malware payload", "value": "3ebc731fea2b5156ba90e88fa7e3f9212a54523b42ffdb1f649021902432102e7923f8fb8b1ad1f8b809303bcd3daa5f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933273, "uuid": "2deabd32-f893-49b4-a196-e1926c516aff", "value": "T1D5663360AE6A5DBD867C826B703F1F1E1FA05F82848D65D347A178C31FAEB01451BDCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933273, "uuid": "9ba375e0-599c-4644-b7dc-efd3766ea622", "value": "49152:juA+0VdOGvZBUvcQsdBW8Smczcfs03FwqSTDxD8eaXMWasyvU8z7jsN2Ad2PNDOS:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933273, "uuid": "fa0626fd-c62a-4766-b6e2-d09348500018", "value": 6597994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933273, "uuid": "6a04055d-590b-42db-bbd2-6f54319c2be4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933273, "uuid": "ee3ef691-9b27-49b1-b386-267268c7fc4d", "value": "18072025_0252_Verify.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e2da8a-646d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907989, "uuid": "fd4a3fa8-8874-463a-964b-0ea8c5ea489b", "comment": "Malware payload (Mirai)", "value": "94f480cd9ef110fa7674ac5a0ef30899", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907989, "uuid": "000745cd-ed9c-466d-a199-5f50e4b20602", "comment": "Malware payload (Mirai)", "value": "36dc4e188b1794dca67c2767cd6ca8903a8881f6c9d8597226be591cb88f52bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907989, "uuid": "1a816b2d-e5e5-44e6-818b-26edc9d9999e", "comment": "Malware payload (Mirai)", "value": "7fa17cdc28d821a75de3958df53c3368084f18f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907989, "uuid": "09cdbc0a-2292-4d9c-b47d-75c02a0da1c8", "comment": "Malware payload (Mirai)", "value": "27d1947c64e57437fb3a1a62d01e9b58bfa7354bdc88219843478a83cb8f916210392c8a0852c4c20937a58ffaf9bd2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907989, "uuid": "2aef65fe-5cfd-4239-bc05-1cdcebe5e4e9", "value": "T184F3084DEA24632EC6E13BFEF79A428E33364B48B79733198A3946B53BC5B149D31105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907989, "uuid": "39e20478-a766-42a2-b71a-ff68c0fae5c2", "value": "3072:esJeVjX6B75nYiCwqp+TS53EMKsVmk25A0HvJRvM/9vo7:zJelWq1EMKsp2LHh9M/9vA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907989, "uuid": "0d96e0f5-72ab-4612-9809-2656fbd4a8f2", "value": 159319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907989, "uuid": "3321c808-b65b-4125-892d-3af578c9867b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907989, "uuid": "dec87c0a-e202-4dd3-bd3e-f6f3b4961204", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da87d473-6474-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752911349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752911349, "uuid": "3576c9c6-9625-4889-bd65-a6403cbd26ca", "comment": "Malware payload (Mirai)", "value": "6ff2691d14b32b0e55a05251be29ea01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752911349, "uuid": "19047686-d204-43cd-a8d5-f2a5aaf289cc", "comment": "Malware payload (Mirai)", "value": "37b31a8a7af525faa6844d1ec39f33fe234c9e76a5dd995c38762ee5093550be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752911349, "uuid": "9abd0ab3-f0e6-4fde-826d-17235dde8e8c", "comment": "Malware payload (Mirai)", "value": "fba589a2dcdd81dd418aac24a4e916d7ba415f67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752911349, "uuid": "5ee99a63-cfa1-44b2-9fee-4f3dd5a79a98", "comment": "Malware payload (Mirai)", "value": "d765726d1210602245192e1f1229d494aa53c31e8117f3e2e63384adc575022a67d9243b6c756bd4711422e0685d2eb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752911349, "uuid": "206e1cb6-14c6-4ae8-b724-da26f3c5701e", "value": "T13F738CC6AA43C0F1FC9205722277F7724A77E63E0069DA42D36AD836FD12642D26739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752911349, "uuid": "da5fe42a-2752-4401-af57-7ab7f9ab5538", "value": "1536:9N8QCwrNiFXIwA2bpR3JTYtfRiwyIcn37/7rBta0:pCwrNKXNRpR3VY1kJ//HBta0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752911349, "uuid": "fe50df13-da65-41fc-8f69-663985f97aaa", "value": 75312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752911349, "uuid": "286e6de4-9448-4a5f-9525-3bb9d700a835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752911349, "uuid": "cad870d6-1dd5-4638-a3c5-97c91f28374d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b869fc-649a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752927363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927363, "uuid": "e872520a-9a9b-4b66-953d-38e144376307", "comment": "Malware payload (Mirai)", "value": "b7738513477ab36393c2abd81e320ab4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927363, "uuid": "eb1a05ab-6955-4433-b03d-8b4664044a89", "comment": "Malware payload (Mirai)", "value": "386ed38648148fb805047a802ac6c25485bee146667b0a7f0940b388630a0285", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927363, "uuid": "940c3253-302a-4abb-a924-954e62dba6bf", "comment": "Malware payload (Mirai)", "value": "e31a37bdf017c2237482916fb91a84de1c2b26ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927363, "uuid": "f7d18831-d32f-45a3-b9f1-8689a18eacf1", "comment": "Malware payload (Mirai)", "value": "93de08c1b80b92d10908659d95f41c62b4ef46729a0297afea45e2ec6e2b1b392d41278180f43864f176ba5423bb44e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927363, "uuid": "c507bc8e-f6ff-43b4-85ca-2eec449c454b", "value": "T12FD35B81B94BC4F2D81348702027B33FCB32953A9027D65EEF9A9E35DE27942561B39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927363, "uuid": "a81cfd18-2e12-4dc7-b910-eaa575d0f6d3", "value": "1536:+cnaIdNjI4b/ZdeVWc9emJpub+lYY+xWuoOpq7gt/n7IutdJ5SGjm1E:rfdNjIa+jemeYJNzuq7gt/n7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752927363, "uuid": "18a25c18-ffc9-4ac4-837b-ef272675d723", "value": 130472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752927363, "uuid": "0ca0d5b3-c459-4dd3-836e-1de0da146a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927363, "uuid": "db4fa74f-1067-41db-8682-41a925d78377", "value": "top1miku.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcad29d-64d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752951110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752951110, "uuid": "1543be78-7ced-4a82-af4b-6ffc56247208", "comment": "Malware payload (Mirai)", "value": "8a66eb83b73d2389e8abde22679a12ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752951110, "uuid": "85ec4142-da91-46f6-a74f-b5dca8cfc25b", "comment": "Malware payload (Mirai)", "value": "38e0152db838eeb847ede08e2d85105764b2c09b4820b9d3758780ed4bb0e514", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752951110, "uuid": "67415509-9d9a-46a5-893c-4cd5da020c1f", "comment": "Malware payload (Mirai)", "value": "b774bedfca12f5fed76f3085b699aa0a6ddd3257", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752951110, "uuid": "91f51ec7-b4db-4339-826a-1a378a8b7e2d", "comment": "Malware payload (Mirai)", "value": "a1fc276d013ec5b912c54ab081f0afa812735eed5a42b288dc898dc810c951a8dbae8a2efee7876f194c877988e386ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752951110, "uuid": "c9774cc6-7c35-49fa-9c22-556590376a3a", "value": "T171732901B650D573E04226F61092CF621131FA3E2BAAD85FF7696C79BB31184B271FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752951110, "uuid": "34c57c90-b4f7-45ab-ace2-d972f8dd2543", "value": "1536:X1v8Pi+BtEEnWd8gy+kYJr4EtCpg+di6RJAhCNl:Nd+8EnWd8qNJrVtCpgqLYwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752951110, "uuid": "3af7a6d3-6ad3-4af0-9b3f-d93344ded7ba", "value": 74404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752951110, "uuid": "f4c47f6b-4370-416e-b83e-8da53f07dd85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752951110, "uuid": "5f46b46c-f51e-479d-bc12-b0a04dbb10ee", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6daa43c8-6462-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752903435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903435, "uuid": "212a779c-1a74-4a70-a329-19c8e039dfb3", "comment": "Malware payload (Mirai)", "value": "1530e6494234aa3e04c7747dcf24b917", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903435, "uuid": "8cfde0b5-10fd-48b7-8c51-6d7e28e6599b", "comment": "Malware payload (Mirai)", "value": "3919343836e5a9b30dea0ee4d97568e7ae6d4fcee4ae023ddfc271063e72d173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903435, "uuid": "f3d75215-8d58-4706-b533-770e053d834c", "comment": "Malware payload (Mirai)", "value": "57c43d2b54faf94c955ca82cd79a30050a1d40f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903435, "uuid": "6b335b5c-d535-4ee9-bfe2-ddb35dfa3a31", "comment": "Malware payload (Mirai)", "value": "5de4096ff69a77f31e7b59a64d19c467f098d9aa5573c82d2f4c74d4ee597ee7f9d0bee6035f8f48e125f9717ef591f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903435, "uuid": "8433f245-867d-476b-b832-1d6fdc9f7921", "value": "T13E732996F9819B11C5C111BAFF1E528E33130B78E3DF72129E246F34278696B0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903435, "uuid": "7bef5275-204b-49c3-8f5c-29390e1acb0b", "value": "1536:Bsn1p8MvCfTn3c+lsafKatiAoqGauXWvMBi/4N8cHr85DYJZ:A8MvCfTn3riafKatRfR4N8cHgZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752903435, "uuid": "5ea3a0ed-2ae7-4e9d-967a-25e2e24a2782", "value": 75156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752903435, "uuid": "15c90c4a-bb9a-480e-81b6-898f6b0aea89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903435, "uuid": "4e1b403e-87a1-4d88-a7e4-a1f397a7bfd0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45885dc-6460-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752902668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902668, "uuid": "bc07ad11-f980-4aa2-83f7-33eae7365404", "comment": "Malware payload (Mirai)", "value": "8b24e9d97512637d8280ccc6674167da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902668, "uuid": "69122aee-78d2-4bc2-804d-8b7116f609fc", "comment": "Malware payload (Mirai)", "value": "3af53e92d980d64385024edd763ec1b45ff9a0b4f36bcdfc20663126cddef56e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902668, "uuid": "dd0613c3-6a7f-4bde-910f-46d13edba6cf", "comment": "Malware payload (Mirai)", "value": "2c778801b1f94a6a533dca9c5c8556836586b51d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902668, "uuid": "1c9a5095-381f-443a-bd8d-0efd6f8ef904", "comment": "Malware payload (Mirai)", "value": "1f735f56fb3305e31d7b6391c20350f54b6cdb9792c4ed50dca4f8ee8ece22c885975f307a1d3d5535d289a57e2baa51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752902668, "uuid": "3c6cb301-abdf-4499-ad70-19305740f27d", "value": "T17D531A95BD819B11C6D1567BFF5E438D371A03A8D3EE32039E259F21378B85A0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752902668, "uuid": "118749f9-8986-4478-893e-9ece3f62890f", "value": "1536:CTed8/6x0HCdTBDRMsGswlqObchCsPyAXV5EVj:CTed8/didTlRMqwAEaywS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752902668, "uuid": "d25d7db0-4195-435f-a0f8-f34aa00a933c", "value": 63960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752902668, "uuid": "0b336120-b842-4537-ab65-fac97f42139c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752902668, "uuid": "96c53143-7e4a-4305-a73c-030754ec37d1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2aece8-64a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1752931218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931218, "uuid": "d7620cae-822b-4234-bf63-eee235c8abf9", "comment": "Malware payload (DCRat)", "value": "be80e4ad31713506dc6c7b27c9399137", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931218, "uuid": "a7944898-b86b-4ed5-ba14-0e55e018d9e6", "comment": "Malware payload (DCRat)", "value": "3b2d418e9f84aa474b761ba5101b7feea4d98e68f55f65eec5b6e04a6cce27e6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931218, "uuid": "c8f6faf3-d98a-4599-8ba0-ba47a88d852d", "comment": "Malware payload (DCRat)", "value": "b09a6dd21fbce30c11eba0d8bc60f8cdeabdb430", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931218, "uuid": "814928ae-7c0a-49a8-aac7-9c28524a834e", "comment": "Malware payload (DCRat)", "value": "315329e9924803d209062c284dc59994718aac9e4eb0fe1d722ae01bdc2cd9a72cbcd941866090a8173acb33e916bef8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931218, "uuid": "70cb261e-48a4-4274-aff4-68ad3d5b4301", "value": "T11495AE56AAE14F32C3745732959B023E9290C7363616EF0B399F54D26C07BF18EB61A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931218, "uuid": "81d5f94d-4f7b-4a8f-ad08-1ef4607e60b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931218, "uuid": "97fc8267-473c-457c-8601-fcb6ecd5ba74", "value": "24576:hhNBYIyi9x5iEPqYd1iFdqQMSX3SKaEy9ZvATjbOKSvLLiOGQ33myUM0fqCEj5/:hGIySivQK3JnaH59YMcqCEj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752931218, "uuid": "9b6a09cc-0102-4476-a4e1-cc57ab6a6e97", "value": 1915904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752931218, "uuid": "47f96bd7-b65e-4b84-8152-987f6dcb260f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931218, "uuid": "a086a1a2-777c-4cad-8c34-31b13f00b863", "value": "be80e4ad31713506dc6c7b27c9399137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73db6d98-6495-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925350, "uuid": "861c113a-c666-4dfb-97de-1c19401dd632", "comment": "Malware payload (Mirai)", "value": "3d2bef97389fc58200fd262a342f03c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925350, "uuid": "883aaadf-2fd2-4291-b07a-c9401199fc4d", "comment": "Malware payload (Mirai)", "value": "3b397fdb55a0165bc695f527ad1cb76d2c641eee396a8b89e7ab2b2608f360eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925350, "uuid": "0eae45bb-2a9e-4fd4-a91a-3ab6dfcc8620", "comment": "Malware payload (Mirai)", "value": "5656464ac9d8c48f86c9979531f0203550a1f76a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925350, "uuid": "0a25249e-bc16-4aa8-bfc0-c234684a6d69", "comment": "Malware payload (Mirai)", "value": "6cf8b80e6197e1452cd3038bcec553035799c8c4fea979fa5f2fa96ee9951fb1f0f90710352624106153b7911e96bdff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925350, "uuid": "fadf6999-d0d6-4ddd-8900-be4a599dc851", "value": "T1DCB58D7389187FDFC529D571A125CEB20793A84052675FB639A2E2B84943EC2F7023F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925350, "uuid": "bb675b14-5002-40eb-a4a3-cc475bae4856", "value": "49152:2bIsRAxubyXbddeaf0D0GIQo/j5S8MfDy+Pb+Wb+ihVc0SJnvPldm:OfIQo/an+ihVmJnld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925350, "uuid": "84d00bd6-dcff-4240-93ce-0ac6c13290f3", "value": 2384768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925350, "uuid": "9c095c4b-cc69-44ea-b177-3457bac4e7f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925350, "uuid": "00706c82-57e1-4b93-be90-0eef1a09db23", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fd4e1a-646a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752906961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906961, "uuid": "ebf0073a-823e-4a44-a342-3cd7f10ebebc", "comment": "Malware payload (Mirai)", "value": "b73fb180457e88c6fb3a6c79a8bc9737", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906961, "uuid": "80cdc53a-e096-4b49-bc92-3dc2b321341d", "comment": "Malware payload (Mirai)", "value": "3c5702e24037afce93b516d952570fd843abf962336a516f11909fa9f341dbd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906961, "uuid": "e56de267-2dbd-4434-9007-bf6540c7d570", "comment": "Malware payload (Mirai)", "value": "0a5e37a3cb972c048c5a2f2a25fb530738bd5e66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906961, "uuid": "181da15e-9f77-471e-9c42-1d0377e68c20", "comment": "Malware payload (Mirai)", "value": "ca2a0e1053c6d9c977c7cfdf6af6065937965c9ab045ec4af78499dd872c7d60bdac7536f0113d3ee4cc914176662805", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906961, "uuid": "533a9cb4-0228-4a9b-a312-b54c0e0612cf", "value": "T195B31846B941AF11C5C325FBFF9F01493303AFA8D3EA3211C9245FA4778A9DB0E66616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906961, "uuid": "4ac985ee-8f56-44f3-b408-975fc40633fe", "value": "3072:Isx645FMT3S7Z21MryKLvZ1jya9v4zCWz5jfF0KRZIihkFan7LG:IW6+FMOSA5BJyaV4zCWz5jfOKYihkwLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752906961, "uuid": "9a81584d-a268-4d25-9403-f491ccb4b7bb", "value": 117900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752906961, "uuid": "f47badb6-ebb3-4164-bc09-abbeea5d02d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906961, "uuid": "ff173e62-b456-4162-9ff3-bb85d13ff860", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554b98b6-64cc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752948921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948921, "uuid": "7e08761a-59eb-4acd-b7e8-64a3d96d69eb", "comment": "Malware payload", "value": "f9f7e9a7947a6750d2e9aa238abad7f5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948921, "uuid": "f90e5ad7-05e8-4fd0-a2b8-cbf0ac980187", "comment": "Malware payload", "value": "3cbe5b835de7b544104ecc48bed27c76c931c8ae1e1fbe1f6f7fb2a5e335eaa0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948921, "uuid": "0f8ba377-7340-439d-8586-3984e0b40a7a", "comment": "Malware payload", "value": "95854081ac7e0861287a158ec6d0961e50c4baf4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948921, "uuid": "f6c54453-8116-42e4-a74c-e66cf6a2dc69", "comment": "Malware payload", "value": "e21b227d86a2a7ff89d9dbe2b6b0c19c17b78272ef1bd0ffda2b106e80bc28f3c3220accb3699da580a765b98b67c24b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948921, "uuid": "95988362-0f97-467b-ae45-5b609540cccd", "value": "T19F21018D4EAAD04B993C8F36F04BC3AC5A9E95C7B5F0AD61A09D4CF3544D700643AA67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948921, "uuid": "2ebca4b6-0a06-495a-92dd-00b2cb3973f3", "value": "24:3J3rd6ENMdCdYV2f7dPdejGtdeABAoArd6unuauFd6uQ9uQkuQrd6u5uQu/d6uYI:hd0dCdYV2f7dPdejGtdeCX2dvuPFdvrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752948921, "uuid": "e24f8d2d-df78-4bef-89ce-fde3913a02f4", "value": 1393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752948921, "uuid": "3f2cb4cf-71fc-479b-b11b-56a9266fc405", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948921, "uuid": "ebae1dba-80ce-4b9a-a8ac-f90ef3eba011", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85dee7a-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933303, "uuid": "f88844ba-4796-43f4-9891-c1d318e24be7", "comment": "Malware payload", "value": "c7d2cf01a7a524e27541400d427b6523", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933303, "uuid": "0ffb3c21-93f4-4490-8958-617f867e7f24", "comment": "Malware payload", "value": "3d1743456c9c38669e7cae15453d79e85d3e46f82660137894cbbeca77c50621", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933303, "uuid": "ffb4855f-7fb6-4fde-8afd-0a98cec63306", "comment": "Malware payload", "value": "63f47454d1967d6a428e43efa093440b44b818a0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933303, "uuid": "b88d385d-aad9-4a10-9db8-cae5b7326afc", "comment": "Malware payload", "value": "2fa6e849d1b5377d5101101d85c960dfed5b9aabe944dee18b1a815daee817edfc259e2393197d22f6b5d36c2fc0a85a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933303, "uuid": "770b60a7-2b76-46bc-aa4e-3283d41aca79", "value": "T1A021FE0167F94B18F2F70E3648BBA3668937BC45FA26CB6E5045024C1C76A00C479F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933303, "uuid": "f73a03a5-a00a-40ce-899e-8be83d455dfe", "value": "24:8pXgJTmUHUwgkAVx+/cd1Lxf+5xGG5CgbDgYYqVaIMyn7mLb:88mKU9z/dOxRcsDlBn7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933303, "uuid": "1d9729d8-55e4-4a19-88ad-8ac2445ac39c", "value": 1427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933303, "uuid": "62827dc0-2eca-497a-9d84-d26c97cb0c38", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933303, "uuid": "28e29320-8050-4a9c-a192-6fd876e9d30b", "value": "Office License.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf6e447-649a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752927511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927511, "uuid": "9dfd743a-b40e-414d-a422-069df648293c", "comment": "Malware payload", "value": "4b97e061f6eeef329a2d575fd15bc6be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927511, "uuid": "f3699e64-7ee9-4ea1-b72f-a9638c43bcab", "comment": "Malware payload", "value": "3e5b4a2e699b92d0f0fab94b0808f4145dbfc6841982b227fce5be577935a03a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927511, "uuid": "f890b194-e1dd-4a2e-8e20-d603a36a4f6a", "comment": "Malware payload", "value": "d8a6f595ce706535f9806ac2e3b9963f27cec68a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927511, "uuid": "ab54bd10-134a-4734-b735-c02b3b89b517", "comment": "Malware payload", "value": "76a825e8e1e2c47d6224ee2b5f9c3505938ad59297fbfcf760fa55bf5de874ec9845c03203e3846c10cc18eec466f0bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927511, "uuid": "3b55b5c4-34b4-4dfc-8c25-ec1d5a9faae7", "value": "T1F2430856B9C19B11D5C101BAFE1E214E7313077CE3EE7313AE24AF24778696B0E7A816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927511, "uuid": "5f7dfb47-eb00-4a91-86a2-fc4692c0e5b9", "value": "1536:tZn9CcLC1UaZPDYja4uXcXaMkiYprVS5PY3N:RCKCBZrYja4AprVSRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752927511, "uuid": "40585346-15d6-4880-892a-f32eed0fa0a8", "value": 55240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752927511, "uuid": "cf0b025a-9f1a-470c-b2d8-25e242dcaaa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927511, "uuid": "5c6dc3a6-4f9a-4501-be1a-fbcb5c210083", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa928d49-646f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909255, "uuid": "b5f08350-66fb-4c7e-98bc-37b10801c032", "comment": "Malware payload (Mirai)", "value": "259c1b96089462496d2f6655c6cad5b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909255, "uuid": "9e9389fa-9bf8-4b80-bc44-f6d0d761841a", "comment": "Malware payload (Mirai)", "value": "3e7728c7347710eebac8a934948bdf5e63d10f3a254aa2c0e336cd268a961ff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909255, "uuid": "0df786a2-767b-49db-b4d8-77c17a890a9f", "comment": "Malware payload (Mirai)", "value": "359f27d44167598dfe140d6036953902979f750e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909255, "uuid": "9a382639-bc98-495e-931d-e8e69d2ad55a", "comment": "Malware payload (Mirai)", "value": "7d38111c188d1d4a940d41d059f42e2ffeff86e846326c3e57126e0579d4afa42ab1f046eb1c8984de96f5ca1a44727d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909255, "uuid": "1779bd39-07ab-4efc-af0f-2eaabfa0cd4b", "value": "T1CAE20B69F892862BC2D22379F99E964E377063F8E2CF3617C8301B553B9615B1C27E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909255, "uuid": "9671e644-3268-4b5c-93e2-1aaa7e82c7fa", "value": "384:bBNS1DCwT+6gChGPs/VyOEfdUd594QfDfaNERz+xW5iQ8MDxU26WMa6tqm839+0p:bjw+g+6gCh8s/VPiOa2yxgHDqj1q92g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909255, "uuid": "9c861130-05f4-4176-89dd-3fde782df64a", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909255, "uuid": "3bf44993-9616-418f-8a56-5b0a673aa4cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909255, "uuid": "fb99a02d-859f-41d1-bb93-26c7b424c5b6", "value": "nexusnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f10ee5-6489-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920382, "uuid": "ef9258cc-0361-47e3-9571-6f6d693f7ac3", "comment": "Malware payload (Mirai)", "value": "503d5e58611e0919a69500431a583a6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920382, "uuid": "63b54c3b-52f9-491c-9059-a7cb0538efc7", "comment": "Malware payload (Mirai)", "value": "3f2656a251e57aae767b9465e15eefb0c0870c04b68d51130674c6f92a814b16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920382, "uuid": "34725268-a363-4267-a808-ba72dfc4f967", "comment": "Malware payload (Mirai)", "value": "02eb37f6bcc8931a6f0829d7632f3e9a0086e27d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920382, "uuid": "8e84e38f-9163-471f-93d9-1649d4982965", "comment": "Malware payload (Mirai)", "value": "010ab221d986e7a6d3e89aa59fd9e36d4bbb742807efe2fb07290fbd1a9ea2259eb4cab77d6b6f5fb378f733e2e2e940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920382, "uuid": "e4254ee4-2aeb-423a-9f88-a649b45de025", "value": "T1D9937DC5F643D0F5E89701B15177E7369B32E1B9201EEB43D7689A32ECA1502DA0AF9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920382, "uuid": "3a78888c-2352-4534-8685-41ed1c459650", "value": "1536:KkUqu4yEbVy8applFfCn7iL9fgRtPfSMizeHJTJRSALJswm:5ju4yEbV5a1FfCn7m9fUxSM0epN4MH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920382, "uuid": "7c04b2e8-6675-4000-8a54-70bbaceececd", "value": 91176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920382, "uuid": "f3aeb7d5-2742-497d-ae85-4ca7fcc6b580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920382, "uuid": "c90d8f7b-837d-414b-b1b2-4507e8bd2a97", "value": "iotmirai_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974535f7-6489-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920255, "uuid": "b6ad2f79-c808-4c52-b58c-64cbb2221c1e", "comment": "Malware payload (Mirai)", "value": "542e4876b298e89b638806e31c357b57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920255, "uuid": "98e19bc3-5dca-49ef-8b88-ebf339db60dd", "comment": "Malware payload (Mirai)", "value": "4112138f60878fe82f646fff365e1c570a0ed4cf77113981611ae7b74a389498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920255, "uuid": "3a461d9b-f618-47e8-a818-8851734a7234", "comment": "Malware payload (Mirai)", "value": "8c20c1273bd40de0ebb3b80c3e5d098732b2a9dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920255, "uuid": "60233f5e-f962-4604-a507-fbba8aced335", "comment": "Malware payload (Mirai)", "value": "33a783b6661df4c3c9faa6167403080e633d550391f30b5ec3ccd228223d358de2685c8655f29a7238edf78d208cd44a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920255, "uuid": "bb6cf4ae-186c-4e4a-8513-fa3ff1df7925", "value": "T160E30A45F8814B12D5D111BAFE1E128E37131BB8E2DF72029D246F647B8A9BF0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920255, "uuid": "b3651508-f04f-4235-b8af-e1ae5bc1988e", "value": "3072:QQDCRU0Jg3VMXDK7NjEarcGMPtwoj1R9Ly:9DCRv2MXO7NIaQzBj1R9Ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920255, "uuid": "c8d2e064-71bf-49a3-b9c2-d64d4902626e", "value": 145276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920255, "uuid": "c8067c47-1935-4208-9264-c49d2c6bc5fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920255, "uuid": "afdbddf8-01a3-48ce-b63f-5d6b6e41c903", "value": "iotmirai_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8da9bd-64b3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1752938441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752938441, "uuid": "6ebc9d37-f319-4b58-848b-f975b6984c9f", "comment": "Malware payload (CoinMiner)", "value": "41010ab472048818ee47131e2a13f02f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752938441, "uuid": "5222e33e-a1e4-4578-a1e7-8ef17723adad", "comment": "Malware payload (CoinMiner)", "value": "41405bc5e882ccbfd4d917e5fb1dc45cb12fe0467446423492b8654ca255f9d2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752938441, "uuid": "afc30020-bc0c-4db4-aae8-40fb75bd24e1", "comment": "Malware payload (CoinMiner)", "value": "ec732f8d7dc1416c127a22def0c90e7fbabcf26e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752938441, "uuid": "7dda2fd7-7c5a-4d7a-a760-1518479d982f", "comment": "Malware payload (CoinMiner)", "value": "515f345c8ead58a980b8564ac3ec148b74b0364bf97a864b6ff49529dd230d3ed9343c357729509b8b2d95bc34f5716f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752938441, "uuid": "2723ced6-a64a-451b-bc05-3ee85b55b0d8", "value": "T15B264AF1B609B2DFD08A4A74D81FCF46A95C03F482184802ED1D79BFAE73ED56186D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752938441, "uuid": "10be3a4c-690f-4687-94df-872672e746dc", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752938441, "uuid": "d8203eb5-5e9f-4567-8748-bf1a88d747fd", "value": "98304:sTYCCYxcl3Ljfrrz9DWRUNwVNZXhmQ0QOjuXnz4JBjbb:s2TwVN9ZDOkz4jT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752938441, "uuid": "4f641996-a025-4be3-8f6d-1de40d9cdb01", "value": 4817288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752938441, "uuid": "9018d99c-f652-4a8b-9b53-0832b929f819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752938441, "uuid": "68d7f481-21b5-4b41-b32d-ca9eb9444a29", "value": "SecuriteInfo.com.Win32.MalwareX-gen.27666.2544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73808ec1-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919766, "uuid": "c13ab904-8d79-4568-a364-00952d5a65ec", "comment": "Malware payload (Mirai)", "value": "e558c531973a6212bbf79ec14a0efb88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919766, "uuid": "f961b734-9a22-4c11-a474-484c2e7829b3", "comment": "Malware payload (Mirai)", "value": "415697559381200d4c8305d840ad43e23377ef515904ae6711d24ff26263263b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919766, "uuid": "a9d6296a-a71b-4866-81ba-5e7f27ebfb0d", "comment": "Malware payload (Mirai)", "value": "2a25b80457801e946ea465a72457ba5f31c42f66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919766, "uuid": "ed075b72-0a4e-468d-a48d-3787c7e4d9d9", "comment": "Malware payload (Mirai)", "value": "4ebe57e5e9c46e0d013a78be7ef5c628e3eab977dfe48e2fcd0885acda80be0e09736b10309075a915b0ba6a11939bc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919766, "uuid": "c25b53ed-e495-44dc-a664-101acca4107c", "value": "T11EE34D56EA818E13C4D527BABAAF01893332A75493DB730689145FB43FC6B6F0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919766, "uuid": "0898db10-b2dc-4086-aa3f-c151cc7a3b50", "value": "3072:YgxYi2gojQeTWKrsRdx4KDVw/YCCaYdS7u+bn5Kxm18Xnu/IM/97JRqh:DxYi2gojvTWK4R4KiaS7u+bnAxxXnII3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919766, "uuid": "db8d2a8a-8221-464b-92a3-23c970955455", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919766, "uuid": "b405a97b-c9b8-4faf-adb8-b1ccbace2fe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919766, "uuid": "9c7f5351-85b2-45fb-a05c-0873d6219a44", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5f5d7d-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752932906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932906, "uuid": "f2b14a31-27a9-4659-9083-6b877968645a", "comment": "Malware payload", "value": "d2f68c8bbd9f3c7050b83a38e1f76eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932906, "uuid": "fe2b2f58-48b0-4017-bfe1-955338ec4675", "comment": "Malware payload", "value": "4346fb1cee18da942c50ca270a4b1f96d8d02ad739be1c191d6c58ff4f4a6eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932906, "uuid": "e2cfa13e-c711-4a53-be51-88e6b8aafca3", "comment": "Malware payload", "value": "e23e5bb24c18bd39eff1ad97ea65a13e56697d41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932906, "uuid": "d0c7cf9c-87ed-479e-9d6f-043ee0cae7d6", "comment": "Malware payload", "value": "2308b69ce509ebd4624100f0f2fdf276df0b1d596c8c60390789635aef2f87943f05076dc71284ceda05c2ea1b66f253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932906, "uuid": "527d4071-ddc8-47c6-9095-7f44f7487222", "value": "T12B42624A77A4509DF503B03E868BE11BE340F473E761E5CB776183154EA3AE76A34A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932906, "uuid": "08d31137-a5f5-4fe1-9e7a-1acaf597fd08", "value": "192:uVRApwyOQ4iWq0zpQjQJxKvK1wr6SAYd4mB9tXRmcI+bte7qUBSxJ:+ypQ606j6Lw5AYd19tXLIMtIHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932906, "uuid": "830d3e6a-ae81-477d-8189-c601d9d004c9", "value": 12186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932906, "uuid": "f6ffe785-e684-485d-bdf3-fe529fe66aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932906, "uuid": "7833fcfe-73e3-49ac-ba14-880a8b050143", "value": "d2f68c8bbd9f3c7050b83a38e1f76eb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8db6d8-6499-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752927114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927114, "uuid": "0cceb8c8-256c-4f97-9495-d9245972b294", "comment": "Malware payload (Mirai)", "value": "cf9a4a7615b4f59ffb947b6c8fcb493a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927114, "uuid": "06205e40-3745-4d61-870e-0ff15e38302d", "comment": "Malware payload (Mirai)", "value": "44b29e5b1e256261f75abbf519531ff3ead66e975f44943dd841f50862435dd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927114, "uuid": "262d9bc8-9727-4db7-98d4-5fe4c2be6bdb", "comment": "Malware payload (Mirai)", "value": "557ae979503f958684dbf8338b520ee8ad66d636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927114, "uuid": "c5cf9d5f-1403-41ae-89dd-48858b14806d", "comment": "Malware payload (Mirai)", "value": "49897e09e092dc9c9887d5a76661177aa00a14783c3ebdf411aadc347bc170bbe199e954cea9ccd9a118d4613fb21996", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927114, "uuid": "115550e4-e70f-4b9c-9bd5-66d01fc5c2c0", "value": "T15F253347E0F2261B43BEF03D6227FB61311C58FB1DF5CC6BD868D6D691495882E6843A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927114, "uuid": "c3108776-d164-444a-b944-e7d969881421", "value": "24576:ixJ/8+7EMKOh+O22006sGgJl9sAwMX92w9WAMzIw:2F7EMKOwByJw298", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752927114, "uuid": "9b553f7e-0c33-40f9-a921-599c8197ea0b", "value": 1008372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752927114, "uuid": "54e2c5e0-ea2b-4afa-a7f6-9af81026fb56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927114, "uuid": "7f2c1f0d-f50f-4364-b074-56750ab28301", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb04470b-64ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752934918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934918, "uuid": "717474dd-097a-41af-9fb0-ce8431467098", "comment": "Malware payload", "value": "8099d9e9c7d9aef2841a2d59a9306a9f", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934918, "uuid": "ba25efd4-3d6b-4d45-83a9-d3ece3eaeafa", "comment": "Malware payload", "value": "44ecaff16d155170f08bbb34bc0f45bbe761c9e86447b690c67e6923ff2c0bf7", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934918, "uuid": "adbb9e5e-8075-4434-bb05-57649dcd989f", "comment": "Malware payload", "value": "7a11e48f107f02d68d495a411b15086f40cafcae", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934918, "uuid": "1a7954c8-388a-4606-ad37-625364a27405", "comment": "Malware payload", "value": "0d9942117f043b405f84b09be792bfdda3ef0bd2086b26db6692b8d92f20b2176f667d06547815338b99a026abea49aa", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934918, "uuid": "0d6d377c-142e-4c76-b832-5be843b32156", "value": "T1CF83363D090C32C06A338728D3D5462999294E03ED233D497F7E697BE7EBE9954312B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934918, "uuid": "5d99ec25-1a08-49c6-b2fe-b82907ba57d4", "value": "384:iSnkg5RUdwxg54sJ6/zHHM+lg+1pxk01293TMu9SKxe930jXoTFpl4lQe:igg/93T/9S2e93uoBp21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752934918, "uuid": "fb934aa5-9182-4843-adfc-e7b348239b35", "value": 81203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752934918, "uuid": "631b4970-b45a-40e5-aaf6-85d4540dd7d4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934918, "uuid": "a5c86565-2974-4280-887b-8ad37dcb5ffd", "value": "HSBC 00020250718.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afe2d87-6470-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909390, "uuid": "dc5105d6-8bf5-48c3-8de3-988c098b0ecb", "comment": "Malware payload (Mirai)", "value": "07da5f5ce9e39524658650e96fecf7bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909390, "uuid": "dc6cd04a-9c9a-4bae-8863-a6d24ad86076", "comment": "Malware payload (Mirai)", "value": "46d55c883ce5ee4734dd7e92fb009f9a719bfd265d1c0cd14324622d853fcc59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909390, "uuid": "cfadc8d2-b7a7-4fed-ab4c-f88ff12e40ff", "comment": "Malware payload (Mirai)", "value": "0810be5fc5881ce505bd24f9436a0f7ea2a959f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909390, "uuid": "c58dc844-b64c-4756-ac3f-ccd2e8628888", "comment": "Malware payload (Mirai)", "value": "ae6c37d4573633b7ae836e6c77da581ae159bb214efb3c8314ceb2fa88beed755f4eb8e1d9a63c50ba45fd6eb275343c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909390, "uuid": "016bff3a-a550-441c-b41b-aa7cbfce9d5f", "value": "T159433895F8828713C6D116BBFA5E828D3B2A03E8D2DE33079D355F21379682B0D2BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909390, "uuid": "d20c6f46-9fca-4a16-8a0e-25e5345c4eca", "value": "768:TqxGaQqtiGZ6Eng3zhWXHDoEPhjNir3igMhN7Z58bukgKsxV0/KvEIXC:had6EnQYDoEPdMchNtbkgj2KvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909390, "uuid": "724d2754-a8a1-41be-aab1-b1b75b012f54", "value": 58672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909390, "uuid": "cef9e811-e7d4-4b89-9a26-896dc1358416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909390, "uuid": "39f1e058-86af-408d-99a8-6e7497c4d6f4", "value": "nexusnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bcdaac-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925056, "uuid": "07abec2a-a94e-4c48-9494-52e5a95592b3", "comment": "Malware payload (Mirai)", "value": "74d2c4ab2aeaa079a590e0a9c3d0db98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925056, "uuid": "d70395e0-7e21-4cc5-b153-10e5350fdef4", "comment": "Malware payload (Mirai)", "value": "48111d82d812a894a8dee1738f323cf8d72c1ff36da7ca6186867d6089d6d50f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925056, "uuid": "233c0e1b-57eb-49e2-b590-1673780de34d", "comment": "Malware payload (Mirai)", "value": "1e53df11b0216198b75034b5ce886c8deb215522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925056, "uuid": "6d84add8-78e7-4fff-a0ff-1c89102ad7e3", "comment": "Malware payload (Mirai)", "value": "9ef0f2243500604e592d36d6a49908dec31ab7af1f98e04ee63f766cdda80673c0410bba4928edee960d68151f9a39fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925056, "uuid": "b3c0b91d-8602-4fe2-883d-f61b0979e1eb", "value": "T118435B52721C0E17C4A31A70263F5BE08BFBEAE021E4B685699F5F968935D331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925056, "uuid": "072a3d67-39eb-4001-80fa-e81d9b10a8f2", "value": "1536:eF6QcATQdskHosl9k1dP9YT0bI666hJa108:tqgtJHk1dPGgbI6x4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925056, "uuid": "60460211-e5bd-4c64-88ac-ced10357bb71", "value": 59764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925056, "uuid": "7de4f6e2-af11-46a2-ba8c-fee46e3e510c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925056, "uuid": "af682589-d468-425d-809e-3e73efc8a99f", "value": "uYtea.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037e9886-6496-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925591, "uuid": "279ee253-3d2f-4390-897e-cfa07f05a119", "comment": "Malware payload (Mirai)", "value": "0828514b004c9a1e0ebdf7ab6ebe1c28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925591, "uuid": "a200d70e-de0d-4e29-953b-8d7375e510b9", "comment": "Malware payload (Mirai)", "value": "486a2a1b5f37d47746781a7e5b43e2971ba665e71a8b34e48e29e10006ad2d0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925591, "uuid": "5d28ac73-2d2e-46d4-a1cb-15ed30987ecf", "comment": "Malware payload (Mirai)", "value": "b48b9a0fe707e9b42f1972add3d2471429840b42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925591, "uuid": "fc6141a9-8944-49aa-a52d-343dd3cb6c3f", "comment": "Malware payload (Mirai)", "value": "407faffdf79229f488e77e077d5a21ef80273a11dd866901025ef025484ed9e29a2b8e997a5f9389611c2e01cb6bd336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925591, "uuid": "644e3684-8f5e-4903-9fed-c70db450e2f8", "value": "T1CBC507475E71CF4CF7A4C2358AF34974D7A823DA06A68585D1FCF6146E20A8F640FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925591, "uuid": "6a796ac8-b5ed-4604-b925-0cdb96afc9cd", "value": "24576:wwBU1Kl7VssHqo6Zf6kgGYUgXEp4tAVnrc/IYwnXIP5j2XJTAOwHsxNn9AKvP01d:5p7SIqd7rl9IITAOniKvP0AHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925591, "uuid": "6ecfe2f3-536c-40f1-8849-8be9db32e707", "value": 2605324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925591, "uuid": "45ac267f-1ffc-433d-b247-e5f0f188d08c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925591, "uuid": "a33e56fd-8001-49a6-a7e6-ee14467da1e3", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722d20c0-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919764, "uuid": "bd0d41e2-93d6-4774-b7ae-f32d74710b02", "comment": "Malware payload (Mirai)", "value": "1d12751e7c3b8b70b7c5e7dda885de46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919764, "uuid": "61d03d69-4e23-4656-bf8d-22f437bc4465", "comment": "Malware payload (Mirai)", "value": "4a068b401d0692cdf58308bc14c64e47993f27ee49223352ab1176c9b4a05102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919764, "uuid": "fcda02f8-69ba-4b41-9b20-09022692981a", "comment": "Malware payload (Mirai)", "value": "74feb39285d33534ab82a02b88f6a1ca73dde46a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919764, "uuid": "010ed9fc-a228-4ef0-8e38-612abf9a7d6b", "comment": "Malware payload (Mirai)", "value": "e010c62086aeffc169aa1a59caf68f03447bf409026d5d40632fe4ab0281678d4ba4bc3253624ae7d85763a7e54e4e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919764, "uuid": "c5185de7-973d-4076-bed0-bac62ad68eb6", "value": "T12D633AC0A593ECF4DD1507B43077EB374A77F136612AE9C7D3A8A923BC82A41950B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919764, "uuid": "9c916010-d936-42ff-8b26-5b3aa3a3a61f", "value": "1536:h4uwwSB8qv117K/Mn9O/Eb/vRkWNZLF/EfNatGWkffal6t3zzcS5KfXQE:hBxEV3Db/vRkWNZLF/EVatGW6aolcSQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919764, "uuid": "540580c6-fd88-4311-9399-aa7ec8c6a5c2", "value": 70672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919764, "uuid": "f14e8d52-ddd9-49e1-97ff-e6dc94fe7767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919764, "uuid": "872b94b0-e918-41d0-82d8-8c60f6d1ca99", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175e746c-64ec-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752962561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962561, "uuid": "eeca015d-d00f-4b3a-aa68-674a8f76d48a", "comment": "Malware payload (Mirai)", "value": "761887dc7a548c5c2d62786b7718b7b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962561, "uuid": "29dc2aa2-a917-4cbb-8dc5-7f031a3465ed", "comment": "Malware payload (Mirai)", "value": "4a0f160a13f031259ae111f874475d79bb914f0196ae0e5ea7d127ab0a4b84db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962561, "uuid": "625f318f-0e53-4b18-abc4-2e65f99115b5", "comment": "Malware payload (Mirai)", "value": "f3e9bfd8fa5a85650a24befce99f105a68ab4f12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962561, "uuid": "96f4f88d-5bd7-4b56-8c5a-ecaf6db8a8bc", "comment": "Malware payload (Mirai)", "value": "ce70b6cd221f27b152b97b3dd2ba1f7e1e264a26d73bfc28ed5f37e8ab6a31931e021ed3817660a3c267faa2b12ce7c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752962561, "uuid": "1a0e7046-232a-49ed-93c0-911f765659bc", "value": "T18EB35D22FA66082BC1D4617A21F34330F1F7538B64BC8A1A7DA30D8DBF646453667BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752962561, "uuid": "5f637f50-525c-446e-a88a-17e70dd58437", "value": "1536:JmZ+1JK+093eTMctMylYaHtial95q7t5A2GEbq:JmZ+DBO3eTMctXlXHkalPq/ANEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752962561, "uuid": "049f2b91-5272-4804-b59c-ce5486d9de05", "value": 109272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752962561, "uuid": "ada075b9-db67-45e5-a86a-bc06e692f6da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752962561, "uuid": "aff37202-7327-4013-be98-87f504d8579e", "value": "agetty", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e86a1bc-6499-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752927113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927113, "uuid": "7476c8ba-4d5a-4240-ab38-d6fc9ac7e9a6", "comment": "Malware payload (Mirai)", "value": "557c618754c2d623dc09ce13e5790193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927113, "uuid": "ae4db796-0193-4efe-96aa-f3b3ab73b7fa", "comment": "Malware payload (Mirai)", "value": "4c04a12961a56ba0230e9c119471c22c4922a91e4057842901d48d1141971ea5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927113, "uuid": "122c6de3-28ce-4822-b092-5eb0fda3037f", "comment": "Malware payload (Mirai)", "value": "cacf5146fabcbd14e6f934a4350c4076122fc0a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927113, "uuid": "a679af08-7312-4833-b31d-233f2cc1a6a0", "comment": "Malware payload (Mirai)", "value": "36d63bc679cf0d29aa44ddd44b22e43c9c2e6468349c804a8cf055e7b0995930b16058ba26eccdab28f9aa4ac9768a9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927113, "uuid": "4a95b9ae-0e45-4d2c-971d-87176fd02fc8", "value": "T172F2E752B8825637C2E4237AA6AE5A8E373073EDD2CB7217E9214B207B8551F1D23F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927113, "uuid": "6519dacf-a81d-47b0-9166-f120c189d089", "value": "768:mHdfwZi2qGsG5C7UdtkIyMw13wuNZCGvg9W6lP+CvSrg6jYSaoD4zMwn:mH1w9qpG5C7kyMoA7m4WdUS06ESOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752927113, "uuid": "4a130aea-bbc4-47f1-85fe-9974607d7b69", "value": 36488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752927113, "uuid": "328fa776-2977-4232-ab49-7c69b8905f77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927113, "uuid": "68a2bc2f-dc53-42b3-ac03-908b1bf65363", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27aa579f-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752932953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932953, "uuid": "e391d0a6-fb8f-4beb-a408-7a1b3b896901", "comment": "Malware payload (LummaStealer)", "value": "7b57018f586dc3dfde77fae529d795df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932953, "uuid": "6d76fde6-f2ac-44f1-96ec-62c0b9d70111", "comment": "Malware payload (LummaStealer)", "value": "4d4f6bab5102a069010195a9c56f272301f383fef8180d6295d6eadee8ae7ba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932953, "uuid": "27b0aae2-47a4-4956-9c79-0645410070f5", "comment": "Malware payload (LummaStealer)", "value": "49554fd18df2cd9bfe2b64f05346b938baf02bb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932953, "uuid": "8e00a40b-df16-451f-b71d-a922ee3bc852", "comment": "Malware payload (LummaStealer)", "value": "8f3ad28fff02e5ff5b1bfc4f5bdcb12c31994f9f2644b0642fcd23275f82b6b03683244112481330f2ee2a8fac7ab993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932953, "uuid": "16935764-94ed-4c38-991e-cd3d6ce91eef", "value": "T1D385333117D6E0EFE78F17BAF6AE57E39D53B2E5A9A808BD821420DE05278191354C33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932953, "uuid": "0b7f5d72-e66e-4684-a1e2-bb01defa4729", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932953, "uuid": "8e8b57b3-b791-49a4-82c8-1660d86fe8be", "value": "49152:4ek2w6zIyGJ2DwhG6nl8BFjb1FvFY8mTtgj3tlDTk:hk2w15J7hNlAFjji8UcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932953, "uuid": "73ffb1b7-84b8-4b0b-b00d-6ec78af06b1f", "value": 1815552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932953, "uuid": "efad1cf2-447e-45e1-acfd-8d4e62e0189b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932953, "uuid": "fb06d363-fe8b-4abd-9488-ac29246bca64", "value": "7b57018f586dc3dfde77fae529d795df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504d6caf-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933021, "uuid": "2ac2acce-10d1-41af-ba6e-722729bead13", "comment": "Malware payload", "value": "a1c41064d27ca70559d18ee81d12abe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933021, "uuid": "a9d3676b-7a88-486f-bd75-82132eafba9f", "comment": "Malware payload", "value": "4e0a2be5b62555d8f19a97a5148397031cbe208474cd44e0e897c0f1655c2761", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933021, "uuid": "cd229fda-24bd-4429-83c6-7705a3f5c6bb", "comment": "Malware payload", "value": "3fe74adfca7a2070e89ab0fc88b79da90ec94878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933021, "uuid": "695474ee-838b-45e6-a467-1327c0f7cf42", "comment": "Malware payload", "value": "876ec9866c4d94c6b80d143e64b3cb5863026a334edd7b5b69085b85121cc9b52ec2b621fd60f38edcd10cca8e5933cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933021, "uuid": "ba77c194-6213-47db-ab0f-b8670cad7c67", "value": "T1E4654A477CD024BBD4BAE23589B61191BB31B8560B3123D72F60F2B92B767D44E363A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933021, "uuid": "2b33f2f1-b795-4bac-806c-99f730694f2b", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933021, "uuid": "6d69b027-9d12-4eab-a7e2-84212f5fe831", "value": "24576:V5+sHytv73EWnrb/TFvO90d7HjmAFd4A64nsfJqYtnseuLFNH+9ugRnEvJdc:V5/ytv7UWnrb/TFvO90d7HjmAFd4A64A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933021, "uuid": "7e7c3b5a-ae2f-414a-b3b6-1058bfb9ec42", "value": 1516040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933021, "uuid": "d5ced746-6164-4b54-a097-1116ecf8b57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933021, "uuid": "baf26ac2-a38f-4afc-84eb-095d46a59ba4", "value": "a1c41064d27ca70559d18ee81d12abe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e1c6bb-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919762, "uuid": "f4399acf-0eda-47a0-830a-d7dc85a6c16e", "comment": "Malware payload (Mirai)", "value": "8e791bd172a4e329ddb3154377d4513a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919762, "uuid": "f48b502b-0b6b-4d0b-b741-25da714f3134", "comment": "Malware payload (Mirai)", "value": "4eb07cfba53e111a81d8c9e3b2c3b537be3d9f7fe5a5bbdafaae739f4af1cd79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919762, "uuid": "dab4c849-4f1e-429a-b33e-8c744bdd92ff", "comment": "Malware payload (Mirai)", "value": "071ffd63735b4b65890784550f57e2f354aed7a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919762, "uuid": "ed9af7bf-6110-4773-baa2-b3519768711e", "comment": "Malware payload (Mirai)", "value": "ca835c8760cd0c28f23c2ececd21d96e281b0aeeffaa863e3c39620c07b32faf0170cb75f5f6c016eef0b6159e05e8be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919762, "uuid": "97c49f0d-8c92-4bc7-84c8-7fa7cd76a76e", "value": "T154733A4331280A47D5930AB4263F57E083FFF99034E4BA89685FEB5A8635E771186F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919762, "uuid": "1affbb7d-2e41-4870-9591-b519185b097e", "value": "1536:5feY9EA/CTxj11EEGFHNdMrCzJYZvDabpIHT0:UBpiFHxzWv0pIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919762, "uuid": "7385e192-89e9-4cbe-bb10-ac9b2bf69a0d", "value": 77056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919762, "uuid": "31bc9b1b-2637-4d42-acdd-2ab57f66a306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919762, "uuid": "5afea117-36f7-4052-8696-7be7614abe9d", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756dca02-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919769, "uuid": "c9f5a6db-d1f6-4849-9d80-b3cbcc18c873", "comment": "Malware payload (Mirai)", "value": "84bad0f1774f7a487d5adcb04daa88a5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919769, "uuid": "3f2afe22-8618-45af-ab12-3d847167b45c", "comment": "Malware payload (Mirai)", "value": "4f77ba133758bb6dffc8ee6119b9723d32d6c8916a2839da6543f64b2e122e42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919769, "uuid": "01f92506-7fe8-46cb-865e-dff5a56b4ee1", "comment": "Malware payload (Mirai)", "value": "3190e9e13759f57bcf2e84bf327752473a0bda0c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919769, "uuid": "1f23ac5c-96ef-4c5a-8ac2-8fd11455970f", "comment": "Malware payload (Mirai)", "value": "2fc19b8fafdcc52f5d52b363a1ddf82eef24c81238e6aa6c400704d6aa047a61b0c7740b782dc07192e998699586d468", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919769, "uuid": "176ff0cf-2f94-49d9-8c9c-12bbf46cfad1", "value": "T13C1114D900209059580C7B20705A09399EEBF7C070361EF895BFD43398DB999771AF3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919769, "uuid": "d57ef78c-7d22-4f25-a3a0-d691e225f1a4", "value": "12:4z+LraL+LnNIQQA+LsvK2H+LaKA+LW+L6+LJ5+LJH+L3cA+L/3A+LUzAUv:4M1nNI7MKzBl37JOJg3c/lUdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919769, "uuid": "ba57b274-f67b-4e88-b189-530fab9c36ed", "value": 1053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919769, "uuid": "05701e24-23f3-4e88-91b8-1db7e75486db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919769, "uuid": "b1a68079-274a-4722-8052-9a99d191c209", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a2cc51-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933305, "uuid": "9c764d54-d23b-4e76-85ab-75c1d47764e8", "comment": "Malware payload", "value": "1052117d1a57f8cb7fae65384174ef4e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933305, "uuid": "2831fdc9-0f69-47e8-b72f-bef163cb1385", "comment": "Malware payload", "value": "4fc567dfa0987ab8819323f3beacf25c860c3944e50b750c88323481143a2c20", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933305, "uuid": "be5fb06f-f97a-48ac-b1a6-673bf088fdc9", "comment": "Malware payload", "value": "022525a3bf1c8724ead5c032a38a97dc75f2007e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933305, "uuid": "83f5a008-53bb-466a-b796-24ebdfde08dc", "comment": "Malware payload", "value": "233e0e33f700370fe81e6f2a16b0309e666d470cbde2601ee3b77206b9c7690790e76ce3f75d58197216ee22fd88f2b3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933305, "uuid": "35a0dc50-22e1-4de4-b4ee-1e506dd0d566", "value": "T14FD359042FE60714F3F3DB7AA8B6B311C97BB846EE518F9D019182486426611F879F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933305, "uuid": "cb625e10-b566-4ed2-a70a-cb52a13e32dd", "value": "24:8Ayw/BHYVKVWO+/CWKmfLDbDvLFfdd79dsrabxJlpl9l:8y5aOmjbBdJ9AadrL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933305, "uuid": "58c70d5b-864f-4bfe-af80-544730533e4a", "value": 130218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933305, "uuid": "2587e214-90ee-4ea0-9f40-f436a3a62c51", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933305, "uuid": "766d1cfb-3e6a-44eb-90d3-f555f96cbbe1", "value": "Report Form.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3666640-647d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915256, "uuid": "364d5277-c961-40b2-a413-ae1bd72864a1", "comment": "Malware payload (Mirai)", "value": "77d4445d5fc4fc7cbbc0b7e63fd68038", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915256, "uuid": "d23a52ef-5568-4ecc-97d6-956eaa14b459", "comment": "Malware payload (Mirai)", "value": "4fca0f1216283ad1e0da7bce4a4d1593583cc3452534a922ed580347546ff8d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915256, "uuid": "aae99a3b-d321-49ca-9845-84e3e59db2de", "comment": "Malware payload (Mirai)", "value": "9733a39053aaa8f3bdda2f43b9d7628aba31d42f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915256, "uuid": "06de4f0c-7724-43be-8f2e-93cb6e24dfe8", "comment": "Malware payload (Mirai)", "value": "db9ea48c54fd55b19304966f6806874006ab269edad4955b66abff1422e0d69d793c385505ae076a3f9d1587f7ea266c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915256, "uuid": "d042a4f5-5758-4cf1-a028-6f7d74ede828", "value": "T1F8C2D1E07726FE31C4206C3DE52A4C893A91067CD1FF393764259C399EC265A67F44B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915256, "uuid": "e9fd2857-a601-47b1-a237-c4e3237be25e", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrf9q3UELuy:OKy4qfqoeJdXWgOLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915256, "uuid": "f368d3b8-afe6-4131-a0a7-6e188a85e910", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915256, "uuid": "a75eb13b-dcef-4f37-8245-d0be978855d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915256, "uuid": "ae802ea8-152d-4ac4-bea4-dff0dc5116b7", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366cd977-64cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752949299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949299, "uuid": "a633535a-950b-4603-bc38-b7e30ae61305", "comment": "Malware payload (Mirai)", "value": "5ce89730bd1ff2d59a14460d60f38867", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949299, "uuid": "61b47a62-1ef4-4c86-ade8-b8a4f0cecd10", "comment": "Malware payload (Mirai)", "value": "5096abd6b347eee2a43ef433d24bc349efc18f608334bfc4f399f8a5ce0936e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949299, "uuid": "5d3db7e0-1b27-4231-bc5d-3d6eef62cc16", "comment": "Malware payload (Mirai)", "value": "7f1bd319cfdecbfdba6c2cc9dc2c5b69a039e4b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949299, "uuid": "5713abe2-7af7-4009-be60-bb72134c0ddd", "comment": "Malware payload (Mirai)", "value": "735ab561c809e19db64cb316d54c62842a1ea4a6be1e2c5378c13f6c10cd749a54ce5d322cda4d89f686f847d054127a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949299, "uuid": "ebbaa155-c2f5-42ec-8e37-fa15842713c3", "value": "T1DDA37289E925937EC7E1BBFEF75902CE3B390A68B79333159A35596037C8B10AD39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949299, "uuid": "b209ea90-de43-47f9-8716-95433fbb9a87", "value": "1536:Zra2LvQc5NtN9cFImev3HQvziU3ZrhqWxcnxE8Tur1Uhi85:ZracfNb9zmev3HQvzijZE8TuO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752949299, "uuid": "a81b12de-7851-4b58-b0a7-18267a8f78aa", "value": 105676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752949299, "uuid": "7c7d591e-9932-432d-ad33-9b5dea1a0f40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949299, "uuid": "1a028227-35b8-4b0b-91da-6f11ab8dceb3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5ff55e-64b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752940697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940697, "uuid": "45dd5052-53da-49ac-8935-2694b4e581a6", "comment": "Malware payload (Mirai)", "value": "fc167c45193dc4ff1957cf90e619f2a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940697, "uuid": "e4ebaf1d-9ab3-4b58-9864-7f46acbd7a08", "comment": "Malware payload (Mirai)", "value": "51e556ef1e08bd3c9f4bea63696fed60542c74e11501bc0920f2e8d2387e69f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940697, "uuid": "aa039fd5-bcb1-49ae-bcbc-34f876da7827", "comment": "Malware payload (Mirai)", "value": "6595de007e3a1b534304f874433b709e1527545d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940697, "uuid": "31b8b7ff-953e-40d7-ac5b-ba25093b59c0", "comment": "Malware payload (Mirai)", "value": "0f1c0ce41a95119b74321d9911c9dad7cd44be440410bcc20b6176c7ed6c9b3b3a7d2ad19b9753d089b4e40ede436105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940697, "uuid": "f41492fd-da19-4ac1-a403-33978265bd05", "value": "T1DCF33A46EB408A13C4D627B9BA9F424533239B64D3EB33059928BFF43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940697, "uuid": "3111e01c-1150-423a-a81c-40f5c2250926", "value": "3072:bpN92c11k0Lvaan9MVPk6uScZWpomgIPDR2W5XM/9EemKwwD/Y:1N9x11ZDaan9MVPkhScwotIbR2WJM/9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752940697, "uuid": "f8f966dd-f028-4e8b-88ca-3a3af913197e", "value": 170416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752940697, "uuid": "fe2912ec-a69c-4319-bc9c-af10d4d69f02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940697, "uuid": "ca9c3c59-e398-4060-940b-9a8f19c1d085", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0cdac5-648a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920722, "uuid": "6c2aad36-965a-4f64-9bd9-098bea22fa72", "comment": "Malware payload (Mirai)", "value": "a7f06194bd907fca1de193847982b316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920722, "uuid": "ecdbeb92-30e4-47d5-96da-17d315e1c404", "comment": "Malware payload (Mirai)", "value": "538cfbb9d336ca284b0e012fed396782b835e532c218364f432440dd560704ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920722, "uuid": "a7814ca0-0a58-412b-87d9-2f751b7a57b2", "comment": "Malware payload (Mirai)", "value": "e71be836f3585dcc75076bbab096f6ab946b75cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920722, "uuid": "f41c2172-2b2f-4baa-a220-226b7fee4853", "comment": "Malware payload (Mirai)", "value": "014c834c1bf09ffa21f0bf2c38f322ad1b7002de708ab0b26825888b265dfbbd6faec536354166273f996da0dcb70190", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920722, "uuid": "ed5a87cf-fa37-4a04-a948-a55a085ac396", "value": "T1D7D32A56E7418B53C0D61775B6EF42453323ABA493DB73069928AFF43F8279A0E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920722, "uuid": "7a6dec71-ef81-4bed-a1aa-67f80f3f80b6", "value": "3072:vIWGv+3mKxazvJJpDYXRn8w5pYipn3eHutbM/9l8:vIWG4vxazvJJpcBn81an3eHuJM/9l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920722, "uuid": "6ab69d73-a9e1-422a-9b8b-da75acfe3215", "value": 141770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920722, "uuid": "a52c4748-997b-4619-bd91-fa7af9125090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920722, "uuid": "9207b897-9145-4dba-a62d-a75862ababe0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6c210f-64a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1752932396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932396, "uuid": "848eeeeb-f995-4134-87b6-fa04861ce67a", "comment": "Malware payload (Rhadamanthys)", "value": "9015be0c6316088830d6397ecd408c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932396, "uuid": "69582e93-cf47-4067-8d7c-1cb512d231ca", "comment": "Malware payload (Rhadamanthys)", "value": "545812664008d0b35cf61c15c79526b1d5d05aef886a3f85c9056570fbf13933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932396, "uuid": "18b8e9b4-0628-45e9-81d1-1ac6eff27353", "comment": "Malware payload (Rhadamanthys)", "value": "bfcbcc7fe783b338ec173eb72fd319971a824dac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932396, "uuid": "da6933f1-e38a-4193-b599-93b90bc329d4", "comment": "Malware payload (Rhadamanthys)", "value": "8b0e6e4e7849b9c930542c6d5f0b61f29f0e694c4ba451db71fe1da9123c969f33d2d12ddf871735aa65119c518ea39f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932396, "uuid": "e086b5e5-0cbf-4227-84c0-d1d73330359f", "value": "T1AC073307DF012A01EE5EEF719B7EE67CBAC1012685E40EB91912BDD2D395CE5A831372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932396, "uuid": "b13d4187-63d7-42ea-99c3-95588adcef45", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932396, "uuid": "5f0a8a9c-2d75-4194-a025-f8aa49915153", "value": "393216:aZlRJ3T5vBuNBRAjQ29EvpCgLyf6SZtkblE9luaje:aZZtJuNBRJ9gGSfkblE9luaje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932396, "uuid": "05404de1-c9d2-4ac7-9270-8ffa133f7e96", "value": 18000408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932396, "uuid": "04bc8bf4-692a-4d81-9882-b0e954e82b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932396, "uuid": "4b44e22e-dbc9-4a04-885e-d87499e0f4f0", "value": "9015be0c6316088830d6397ecd408c44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f70de4-647d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915260, "uuid": "53f178cd-304f-405f-b76d-445ac97c8ed7", "comment": "Malware payload (Mirai)", "value": "5407d197a9fa25ad8b4bd1e38efecd94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915260, "uuid": "cf506975-ccbb-4569-8374-810810d06401", "comment": "Malware payload (Mirai)", "value": "557adbcac4afd76de0417f956757343772f0e0d6a4f8ae7669f94675c9753929", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915260, "uuid": "3c7e6013-ea1f-4eaf-9501-3912d7479b43", "comment": "Malware payload (Mirai)", "value": "d0c2e16ae4c99255c1ce44c5dbda6898259624e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915260, "uuid": "52b47465-1dfa-4c2e-9b47-7406c7f4b40f", "comment": "Malware payload (Mirai)", "value": "f47acc1aabc20b56efc6d68cfeac6f98f1f8ce8ba8a1666ad331fddfdafb02829c03746ed07488817b6d3435a3b60e7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915260, "uuid": "d42c279c-abe5-4e0d-935c-7a716d4f3399", "value": "T123B2D03C1B111B58DA1AC0BD839C1B513CB81F7591829D4B7207EDD79F9A4B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915260, "uuid": "a8c9fe4c-d361-4daa-b37e-32bfc9d5de04", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiq9mdzJgGlzDpH7uNj1JAS:neD8ZSWvZHZbs1row697qohQvg9IizJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915260, "uuid": "0d4e05ca-a11e-48b5-938f-fd4cb4326a9d", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915260, "uuid": "88c2b3a5-7c73-454c-bd27-4052ad555b6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915260, "uuid": "c826180b-63b7-4b38-9b58-2cfb00db8fed", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d25989f-6468-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752906011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906011, "uuid": "a486bad4-c3ea-4515-93e7-84ed693288b5", "comment": "Malware payload (Mirai)", "value": "0bbff06e402b6a7eb8356de91f67a0d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906011, "uuid": "4b06d6d7-5eb0-4840-8302-facad09cb900", "comment": "Malware payload (Mirai)", "value": "56a12c1f67501a49c2867f6b2e915c4cd5301ca273589f672e6eafbfb06cfd31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906011, "uuid": "192ccac8-98fd-4a81-9f63-e9be716342a9", "comment": "Malware payload (Mirai)", "value": "87ed3dd71fe69ae9b6bcd8825bd5bbe3fec1ca68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906011, "uuid": "f5148654-521b-411b-9a78-072455533e3b", "comment": "Malware payload (Mirai)", "value": "fe96543b2db4b9d7766045ec4da4bcd498001b90ac6dc31777ea12b0480afd5a34058e01a71b3dbfcf2839bd01f24150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906011, "uuid": "8018934f-6362-4b8f-823c-4f6e1a8f8db8", "value": "T169436BCCEB83D2F0F4A71575157BF7378B32E91E4466DA1AC758AA30EC22801A71A35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906011, "uuid": "8dec5837-c36d-4437-9e8d-950b259bfb29", "value": "1536:fteGrLESlciVKQSKvZf5OzNGo/ECdaxVatg:1VrPlCcZh8sC1daea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752906011, "uuid": "666fcf09-f4e1-432c-b7fd-b15de1c82b21", "value": 55592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752906011, "uuid": "1642a37e-1be7-409e-b1f8-f1db419dd469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906011, "uuid": "6cd34675-0e40-47b6-9b2b-d1cea4151170", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83422f9-64f9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968388, "uuid": "63872e3a-e480-4bfa-913d-006ab845e167", "comment": "Malware payload (Mirai)", "value": "b633d6fd3b9f3f462180a43377b929ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968388, "uuid": "7ce9043c-10c4-4a1c-9e66-b056f5cae880", "comment": "Malware payload (Mirai)", "value": "581cedcccdb33b60957d9e8b9ec89d92e0801946c3443371c935e668a8ec0d80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968388, "uuid": "61ad1fd2-826f-448f-9ad9-dcb3baef828b", "comment": "Malware payload (Mirai)", "value": "33ee6975baa1f565513ebb109c1820ed1905db77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968388, "uuid": "ce9d837b-4f5e-408e-9c83-b7a049e19cf9", "comment": "Malware payload (Mirai)", "value": "d6dd01e21c373352becd32d6d7c50987488fcda3394f1c79902173072d31b68d802fd4d687ceeb522a82c0e6f02a3cd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968388, "uuid": "fd147287-8ea1-43a7-be41-bb99c2002883", "value": "T196D32B45F8415F23C6C622BBFF5E428D3B2A17D8E2EE7203D9255F61378685B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968388, "uuid": "cbb7edb2-7c14-4563-bc43-3cb05eb75ff0", "value": "1536:2nITL03LQbB4c6xiBhej8R8mASjdfK4VJ1lWzTKNTUaTbv0tUk/g1Y3yqlOMwywU:IITqQ69U8mVdC4tlgwUaTbKZ/t3rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968388, "uuid": "00ab7807-90af-43b2-90ee-528bea426a2b", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968388, "uuid": "8a05c7c4-ba88-42ee-8a19-6d4af17248e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968388, "uuid": "238f25ca-fd8d-46da-b30c-8f65bc19c964", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d197143d-64f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968027, "uuid": "1ea7763d-ff46-413f-af70-aeb01c1de679", "comment": "Malware payload (Mirai)", "value": "3c4968ca8635fc3d2e576fefa70adbdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968027, "uuid": "9621a4c7-d8fe-4848-9d5f-f6c6f10e5408", "comment": "Malware payload (Mirai)", "value": "58a5940bdbfa1f911cb5557a38fa2314a332feae39c4aac43a773b4aead0ee70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968027, "uuid": "f6464647-cc96-4ede-b3c6-897609c4b1be", "comment": "Malware payload (Mirai)", "value": "25f26454ca074172d441981d7c5015d1c90d11a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968027, "uuid": "8ee702fd-5e08-494d-bbf8-ed4bdb25587c", "comment": "Malware payload (Mirai)", "value": "b41d22bf693837608e705d1dcc8eb0a0fdea2a9450fad263330d35508d6ee1b5df6749d6df61c59545c008fbb74b045a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968027, "uuid": "3bcb7e09-bac1-4adf-82be-e85fff740da0", "value": "T1F2E317D7F900DDF9F80AE73748574805B130B7A245929A37725B787BED3A0990933E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968027, "uuid": "114e3c04-d62f-4a7d-bf29-cf335dd50cfd", "value": "3072:WVACHrZjneURZJp1d0nR3uKGyXgVijbi7LckMy9Kf4H:gA8/Jp1aRNGyXsLYy9gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968027, "uuid": "43e1262f-1bfa-464f-aaeb-777de5b53353", "value": 155968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968027, "uuid": "2116d3f7-4c97-4e79-959b-e957ecc6be74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968027, "uuid": "e2183006-e1a2-426f-8c87-da5405016efc", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8c36de-64c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946059, "uuid": "20cc9ff3-f40f-4369-a133-49c094a78784", "comment": "Malware payload (Mirai)", "value": "255f6250df02e8227dc208e816731c1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946059, "uuid": "ebe6196c-4b87-445c-9185-f94b3a212ba5", "comment": "Malware payload (Mirai)", "value": "591eb207c59cd9bff7a04ee9467472f7a1a8b3caab200cf3dec98d0ae14d2c42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946059, "uuid": "71dbb292-0149-4855-babc-d9a007d1212d", "comment": "Malware payload (Mirai)", "value": "6901bee00066d59ad2d6c6fbadee59cc78ca400e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946059, "uuid": "8977f59c-dcee-40fe-86f5-7735573c0c94", "comment": "Malware payload (Mirai)", "value": "3a5ef3892fd8a179d9972bf22df5f1528da16f2dd5601b1ff1997fff6ec402e3edce3bcd5e6671b9a972d9df1f487b55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946059, "uuid": "76f48417-5309-4e2e-94dc-c671a961c178", "value": "T12A032A29F7691517D0E5527E20EF9F16A8BA1BC46580D26F7D320F2A5EB23001C1AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946059, "uuid": "7239fede-b563-47de-8b68-a14b42f96cef", "value": "768:6coNBmHnzg8FO/Pe75nr9PYWtijhErBrEfEqBgz8Ii:6cgBmHzHn5nrV5OhQRyEv8Ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946059, "uuid": "02b2124a-3447-496d-a2f0-d03fb9c0aa18", "value": 38204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946059, "uuid": "4ac4f9ce-dc8b-4fc5-8d89-f836a60b4d3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946059, "uuid": "38f454f0-cc57-4c0f-bad3-f0ff72796681", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187a2a8d-6470-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752909305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909305, "uuid": "a6923058-c93c-4352-abaa-4b44e80353ff", "comment": "Malware payload (LummaStealer)", "value": "30d0e459422baa824478f6f425905812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909305, "uuid": "158ae8d2-82ca-49b2-842a-12c5e1e1265e", "comment": "Malware payload (LummaStealer)", "value": "59229303015430109b451aeb1fcce3b98349f470d5e6cf3169cd62606b619b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909305, "uuid": "56b40fa5-fb1b-4b73-817c-af6f95a0c464", "comment": "Malware payload (LummaStealer)", "value": "10b3cc809a302b0c78548267d11bf91cd64e3a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909305, "uuid": "b951bb98-9f08-4eeb-a17a-facb576ed083", "comment": "Malware payload (LummaStealer)", "value": "c24cf2714fe589ecb9fd6ca4d8778ad5ee0fbc350340b5793aaca2640d0379fe5b11e6da19c8cada0fd73591628e0145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909305, "uuid": "98957bdd-b86b-4d06-a463-8b467f0d7210", "value": "T17E350106E61121E9E867417A8912A642F5B3BC368734EFDF03D8E3725F177D05E6AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909305, "uuid": "a3903290-4515-417a-a20d-7d0009d62e20", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909305, "uuid": "39e02e6f-da12-4809-8567-e12607dcbc3a", "value": "24576:DagOdyCGcoTMukP4Euda2eKDWSeKEuda2eKDWSeB:OgORP4ECeK6S7ECeK6SM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909305, "uuid": "37d6657e-e10c-4355-988a-57a0f4663716", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909305, "uuid": "720ac096-92fb-4b7c-968c-2ede81768484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909305, "uuid": "3b086eff-53cf-427d-88eb-eccf33e69f74", "value": "SecuriteInfo.com.Win64.MalwareX-gen.891.16329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f13398-649f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752929805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929805, "uuid": "750c312f-33a9-46a5-8687-ece4af03cc8a", "comment": "Malware payload (Mirai)", "value": "eb8047162567b66d2b6ad15b5abd116b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929805, "uuid": "0ed0209f-1aad-4c60-8a25-ea8e53360dde", "comment": "Malware payload (Mirai)", "value": "5a2e21284a0e61720392bee2be2b5c3699ed89fefeb63192893fd8215e96daf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929805, "uuid": "873ad88f-7dc4-404c-9ea8-09cb970b107a", "comment": "Malware payload (Mirai)", "value": "63599a4da20b8e290ab7730aada78f4d52b1efca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929805, "uuid": "9bdb9ebe-9894-401a-945f-ba31c2d8f718", "comment": "Malware payload (Mirai)", "value": "f819b61eb498d7b98c42a68741b80a995c4dccfb6dbe8722767e41b0e6f313478acecb9e8f543f06aa1d2bc00486df33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929805, "uuid": "f5c14ca2-fc1f-4e3f-949a-5416d2083933", "value": "T107532A9AF801CD7DF85BD77F44570909B631A3D152831B36239BFAA3BC731A91922E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929805, "uuid": "dd173c29-4c8e-481f-bf95-37adf45c4373", "value": "1536:l1dbL0rvROV6s8X6za+46J/7DH7iV+sSA8Ytp:l1dH0rv8V6Rc4Q/fCt8Ytp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752929805, "uuid": "39cd9763-5032-47a8-b230-b5fa99075b9b", "value": 62736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752929805, "uuid": "84352da0-5dbe-4c30-aa02-39120fee28cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929805, "uuid": "062de8ef-86fa-4e87-84de-cf25b750f8b4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111b73c0-6493-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752924325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924325, "uuid": "bfd1a858-45d7-4ce6-929d-396e1a6bcba3", "comment": "Malware payload (Mirai)", "value": "4d0cfb3a83ad34ca9c5255fd22d0c655", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924325, "uuid": "85b664aa-774d-4617-9f85-3c6082890c49", "comment": "Malware payload (Mirai)", "value": "5bdc3237cf92929e827567455a6ea2b2ec20eb32abbcb4946167d60a82c18904", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924325, "uuid": "6118b3e4-df7f-4218-8955-766b6d17776d", "comment": "Malware payload (Mirai)", "value": "4d0055580f1b387e547b41f732f1844b9b6bbccb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924325, "uuid": "69d6b3b4-05c0-486b-a984-fe3f5849bc43", "comment": "Malware payload (Mirai)", "value": "5010379e64c7d5c5e38efea14a2c5484998c038e2e096506a98f55b6ae55de8683942369a0549edda49a6a38647d28b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924325, "uuid": "0bd93398-6480-4497-b713-e660233c7189", "value": "T10FF4231808E43AC7DB061936BE2D0F19E0CD65A0FB64164B9642AB1C6D350EF278FD6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924325, "uuid": "ced133a3-1ff9-48ec-902d-534e229d912d", "value": "12288:K1JQODl30o9NpCPewmLPz+jSGJn641Z/UtKpBAiDd7zxFM2ieR:SrfMPV0+l1v14o+2ieR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752924325, "uuid": "6a2dd1e2-3a6d-4bb5-a1fb-ad15d7f35f0b", "value": 766296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752924325, "uuid": "08fd25d2-6c94-4953-9d45-ad0a3b91f3a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924325, "uuid": "b03587ba-c3d8-45f7-beca-5f2e7418ad37", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8724419f-649e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752929248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929248, "uuid": "543bba40-6b7b-4907-87bd-6874bfd85894", "comment": "Malware payload (Mirai)", "value": "b8b00081f9478ba1abd667a8a61a889d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929248, "uuid": "aad0b13a-0e49-46da-b046-7211f3f3189c", "comment": "Malware payload (Mirai)", "value": "5bdd30ef04b6647fb9f6feac094770eda92177125a7d1c939cae702986bb0b27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929248, "uuid": "0b8b4922-cd1b-456a-8560-aa58f89035f1", "comment": "Malware payload (Mirai)", "value": "f7788ddf994093938fa002e889ff60f9415d73d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929248, "uuid": "cceb9a23-5a84-4dd0-af9b-abc91b000d41", "comment": "Malware payload (Mirai)", "value": "bbafcd732b9155f7564e59ff6323b3bf3fae8db91307922b7849cab15ee1ebf747abf328f7f3f3a23a51aab57ab7b937", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929248, "uuid": "97a6bd04-9ff8-49f8-8c44-e7e9f4d581f6", "value": "T1FFC55B02AF840EDBC8E7CC33466D9B932A8DE59665E82936743CD904BD5F60A5BC347C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929248, "uuid": "cb5d1efe-d418-43ca-b247-17bfb6ecbc25", "value": "49152:/pghwZX6qqiAP35UzIf0ZgDQoMmOSChpZvPyX7:P2y7gDQoM1pZyX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752929248, "uuid": "e8818425-a082-428b-a411-ebc622d63490", "value": 2627304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752929248, "uuid": "fc6b867d-9938-4864-abd1-f5052b17fd8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929248, "uuid": "b7ad4860-079b-4c43-bc40-7a9dbab7b1fb", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2462038c-647e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915338, "uuid": "49c0bf8f-d6a4-43ec-b056-8f7a0ac2168a", "comment": "Malware payload (Mirai)", "value": "785ff357c0378d275c86d660ee96d45d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915338, "uuid": "ba581b7d-ac5b-481f-9614-34ca4e407e92", "comment": "Malware payload (Mirai)", "value": "5c2317f04a7e0ee906c8c12286e01ea9ccefed9f88519c0e772a1b6beb7a08b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915338, "uuid": "baa9409b-619a-4f3f-9921-121bd6820b19", "comment": "Malware payload (Mirai)", "value": "8e5c70f93a73615c0ede131e27b0ab132ba84404", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915338, "uuid": "5afcfc59-3542-458e-b65e-95c86448099a", "comment": "Malware payload (Mirai)", "value": "697cd861eabf74e264da4af376fcf30406452445a546a76b65a1b5037b49d2104765dcdbb38d36846f64d51e4b51c014", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915338, "uuid": "78ef3c47-45d1-48ec-b380-ec76eb251459", "value": "T17A330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915338, "uuid": "7b7fd9bc-6e42-4b53-9a37-8a0bfe2e471e", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGd:r/hqaJMDg9eqK806MHdkfQX6HuCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915338, "uuid": "bb4e227b-7072-4d23-8ec4-cf9bd1d0704c", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915338, "uuid": "782c45e9-bb4c-4cb7-bbf5-83be0b55b81d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915338, "uuid": "b084c7b7-bf58-453b-90ea-d71d7a8910f6", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c18ee7-64cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752949298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949298, "uuid": "9a60cb0d-c15a-4a35-af26-e0ffcb558b5f", "comment": "Malware payload (Mirai)", "value": "ad4872860ac18a4227d37d38b074203e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949298, "uuid": "762b193f-4ca5-4b11-ad8f-8ea7468e27d0", "comment": "Malware payload (Mirai)", "value": "5d0e12a685ef8ed3e98ff46f1166550bbe5d294ddb3fb6dc7de33c9277c3ce0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949298, "uuid": "c02cb813-d2bd-49a8-aa55-82452c280503", "comment": "Malware payload (Mirai)", "value": "c7b0701d1f28632917839fd53e4308548f694e0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949298, "uuid": "67e45c39-3d55-46aa-9b6c-fa71763e85eb", "comment": "Malware payload (Mirai)", "value": "70cb98da88f18e56d4287555a81e4e85d303d92a5e3bf57d226c11a37df44ec76c55cbcd4d5846c7b93ceef0a1a5b9d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949298, "uuid": "1f26a099-5e39-4cfc-b6d0-e8f492df0075", "value": "T155D31A45FC515F13C6D622BBFB4E428D3B2A17E8D2EE7203D9255F21378A85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949298, "uuid": "9583cce5-a04d-437c-960d-968ea1c4dd5a", "value": "1536:eIz8J+wS+pAocchVjtA8XA6wn4VAB2TK9M94xL/pbgzeo3SDlm6wyw8RuhvRpRUN:zzOBpM+C8XO4E2f94xl8z93Orx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752949298, "uuid": "56a4efef-e969-4450-aff8-8ab4bc6ab188", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752949298, "uuid": "9b32d765-b6b1-4cb2-803f-f0d085a294de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949298, "uuid": "63a310ab-32db-440a-8e2d-0104e429d651", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e79175f-64c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752947621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947621, "uuid": "6f108709-c01e-43eb-b9e9-6377727bc0c4", "comment": "Malware payload", "value": "62a1b36ad7b08be6b006612601179811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947621, "uuid": "ddb5d6b4-bbb7-4dfc-bda0-8e1c1ff67798", "comment": "Malware payload", "value": "5d4f48b7ef91352ae43d6719798c4ce2727ea3ebfcc19997a9a0940217627344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947621, "uuid": "c4d6c501-a15c-4ad9-a7ec-21eb08052717", "comment": "Malware payload", "value": "756348a1bec8ee08c5d8f9d96c60c913dea3d6fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947621, "uuid": "1a7b90f9-f61e-4236-acd6-0b59f144f1b8", "comment": "Malware payload", "value": "0d346394a5406f58b877507d7e32898d39b49eb45d8211b43a0331d201ac32d95df95891dba5461a9fe66cc131abe2aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947621, "uuid": "80d04053-72dd-4e74-bad9-33c7636f691b", "value": "T16C24284E78619A02C1E32B76B709468EF31543B887EBB225FD711FF43E8B5164E3A644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947621, "uuid": "16caf06c-414d-4f14-8f15-1aec93fb8e6a", "value": "3072:iAVbZMC+XHVOt14nm+2gVsB2Lg3awhf+VD4oPNR2OAs6DFkv/+iGFUXokytvemMU:7VbQH2gVsILgqwhf+VD3NSV4WioMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947621, "uuid": "0ce9e974-9dd4-4aa2-9ec8-25818e8bf603", "value": 210372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947621, "uuid": "a9975efd-bc18-4bc6-825c-25b7ea4b5788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947621, "uuid": "47ac69c0-9b47-44b1-9fac-416de46f3b27", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a15c42-64f2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752965115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752965115, "uuid": "4f30404e-b068-4fb3-b6af-e5e23c36ff40", "comment": "Malware payload", "value": "81b7cb2c5f2d33b9d6a54938a40157a7", "object_relation": "md5", "Tag": [ { "name": "leakvideohd.store", "colour": "#1A56AB", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752965115, "uuid": "59237b23-1876-47b8-870e-96969779a389", "comment": "Malware payload", "value": "5e363b9fb3f6134a68a9f124e330e6d5817f7bc4bd6eeb3d6da74f41db89b35d", "object_relation": "sha256", "Tag": [ { "name": "leakvideohd.store", "colour": "#1A56AB", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752965115, "uuid": "450c2ec3-4227-47e9-9b35-f38f4563018e", "comment": "Malware payload", "value": "78fa1db9e85d083cd9a0cd2903868c22062c3c0d", "object_relation": "sha1", "Tag": [ { "name": "leakvideohd.store", "colour": "#1A56AB", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752965115, "uuid": "64b69aa4-03b0-4333-bb24-cd47f4fa9025", "comment": "Malware payload", "value": "ae50845c388d6df6034e9888d5dd4353962049667f4b633b215a091412857c3da77de14461422e9bde003438a69d2884", "object_relation": "sha3-384", "Tag": [ { "name": "leakvideohd.store", "colour": "#1A56AB", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752965115, "uuid": "2460b1fe-849c-483b-a974-deac712b24f6", "value": "T1D3345B34B9C7EC8CF849A19585A936AA477EB0F333C864501DAC4788F3C6A95EF431D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752965115, "uuid": "4445df8b-a22c-4179-93f8-da8dc8840845", "value": "6144:M01xGtS8/6MwGg/aXTVv1s3/HOTMswmdUr+gaJ4g:XmSGv1sWTFe984g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752965115, "uuid": "f57eb5b2-8b99-4047-ba18-d4edb7005246", "value": 231887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752965115, "uuid": "1e5a4df9-27a9-4fff-869b-e887e376b642", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752965115, "uuid": "7ed0cfd7-09a0-4da8-9c46-3c69ca09702c", "value": "koidso77.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d31a1e-64de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752956571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752956571, "uuid": "58f544d1-84cc-425b-a526-f0e021cd8631", "comment": "Malware payload", "value": "dd4785211ce4c764115687d27449b641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752956571, "uuid": "e0bb53e8-69b1-447e-b2a6-fbc92aa9e167", "comment": "Malware payload", "value": "5f7f59ec21a90551be8e4a5cf2592ac6cd87f8d5033213fe75a929019a612dc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752956571, "uuid": "4119729e-a7fb-4073-bcb8-cc3e2a5743a1", "comment": "Malware payload", "value": "ed14c472b6361cde3e83f682adae22fa1e923b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752956571, "uuid": "65e5c125-7fef-4e8d-ab89-259fec4612b9", "comment": "Malware payload", "value": "724443d3d78daeb428ac3ced7361af37f8a15eff771c67bd262d140ad2dc591d949a7801474eeff189ab1fc01192cc13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752956571, "uuid": "02aec815-e696-476a-8d87-f5f12d2e1aea", "value": "T101F623F6E06C92A4FE4101F5A8B53DFE5F523F24A78434DA91906527FBCE8B9660780C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752956571, "uuid": "342d6aca-8abe-4874-81fa-46b082219776", "value": "432fc55f13f2f44d1365d832cb8bcac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752956571, "uuid": "29008df4-12d5-467b-966f-e593f1f19f87", "value": "393216:AaI+MYkThSolJa4HPtjfEER6T3ts9WaHLmUMfofrgPV/:Ak2gkJayfEVTdX6MfArE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752956571, "uuid": "dbb222e2-e103-4552-834f-01bfd3aae7d6", "value": 15965734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752956571, "uuid": "24236d1c-24b3-4e4b-b451-458f19367e6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752956571, "uuid": "d41963e2-147c-43c0-8fb3-a5fff9dd6150", "value": "SecuriteInfo.com.FileRepMalware.23012.26575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250cfbbe-647e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915339, "uuid": "5b80db78-bd46-485b-b799-4791d08e4228", "comment": "Malware payload (Mirai)", "value": "916999d3418dcc15f82b24fdf4c18fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915339, "uuid": "da4da8d5-e468-42af-9fdc-3c433552209a", "comment": "Malware payload (Mirai)", "value": "5fa2d41215b4ea148c5d638352cf9f219fbad1a38030b67acd7ce7526465d22a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915339, "uuid": "e947b8c1-a248-4bad-84c2-23ce91b981ed", "comment": "Malware payload (Mirai)", "value": "6a1382b2cc4b81c178263c881bdc27533096a751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915339, "uuid": "7c996afc-3a74-412b-bc66-b72fe18cb5d4", "comment": "Malware payload (Mirai)", "value": "b931fdfe6c8d8517da07d29fc66355b21883fda8691a8524f74ce20c8b44b019901783a5eaa89e6f187c2e8ad4213623", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915339, "uuid": "4e836c68-ffda-4002-ac69-fabc01644fe6", "value": "T16FB2C0CC61543084C98D7C7C178D4A674F6CA1D0BAED9F26E350CD98B3AEA8B745D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915339, "uuid": "3b116068-cfc6-4b9f-90a3-86a4619b0277", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpAZZqEWv6:/QlS07FUXqIYSXQKquAPqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915339, "uuid": "71bbd605-17af-4195-8395-8d4250f9470e", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915339, "uuid": "935e6ca4-a882-4eed-9b34-c0e31d1e2a04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915339, "uuid": "af2783b3-9d09-45f3-a6e9-31a18f5088bf", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d33638-6461-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752903078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903078, "uuid": "0c1eca64-539b-442f-9f01-3e9c9c2b9aba", "comment": "Malware payload (Mirai)", "value": "cdbbc060e8a7398950f201dc5d80d49b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903078, "uuid": "57648576-24b9-4304-af90-0d5221de74e0", "comment": "Malware payload (Mirai)", "value": "610c576f63161a8b02cf0d7659944d00907511cc1863444dd7f18379ae1c22d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903078, "uuid": "2578fe83-8da8-4dd9-a4d8-01d868c75cf1", "comment": "Malware payload (Mirai)", "value": "da85a34deb5120f979fb756b25788ad744d5eead", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903078, "uuid": "fc309c12-1453-45b1-8a68-6e158068a07c", "comment": "Malware payload (Mirai)", "value": "3d2a3efaba3e74b0ea66cd575b64b1dd3b13f9100c59439c1b48d715fec6e8a2b2a7a3791c7fc2c08d4c9f1941fb6790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903078, "uuid": "6b684460-b210-4036-9e97-2efbb165fbcc", "value": "T111C3E706BB610EFBD8AFDD3745A90B0635DC551722A97B3A3574C828F50B24F4AE38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903078, "uuid": "3cef0ba2-de42-43e0-8d0a-cdfe923cfa54", "value": "1536:LDoNNtvq1vfHDYuI45U38qS23gj99+4ZOJlOK25c4hTUzvnKZ:LcNNtvqN5R23gC4mvzrnKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752903078, "uuid": "66289d08-ab23-4f2d-8cf4-a62639f592b6", "value": 118916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752903078, "uuid": "6271bcd7-38a0-442e-a79d-5bca8296e7ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903078, "uuid": "90ee7630-56aa-4129-b22a-c9b1c1f71355", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028e46c2-64c6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Loki)", "timestamp": 1752946205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946205, "uuid": "fc874efd-b2ac-439e-b9bf-836f6e6ef3b1", "comment": "Malware payload (Loki)", "value": "cd0fb04398299ecebce9a050d40a9ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946205, "uuid": "b2d1209d-8432-450f-bc57-4d3bdd9073a8", "comment": "Malware payload (Loki)", "value": "614a0c1732daefafd0a0a71c9b2efc63f6bfc524834e3749ff5bb6fd103db974", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946205, "uuid": "f65bd520-25d6-49b6-9521-8a5bc82d4905", "comment": "Malware payload (Loki)", "value": "45582928eb0a173d8cc393316f1531dd55b52f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946205, "uuid": "9686898f-e72d-450a-b8ea-d080b513cb71", "comment": "Malware payload (Loki)", "value": "59e30beb66af1ff5b39f43efa0e1f44504f8a4ca21b90fb8c9b0896abf5c18a64bfe5ca40ade62ecd85ed1c68f71b6fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946205, "uuid": "8f738340-c21e-4903-b00c-295c620e88e3", "value": "T168C48E22A2D1CC37D166BD398C4BD365A835FE60393469C627E81D4E1F29782B57A3C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946205, "uuid": "d063a36c-94a8-4842-97d7-df55f4b8a40f", "value": "cc3d6827b1cc0adc41f168e2d32d9d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946205, "uuid": "c06f4e45-5143-4cb9-8d5c-beafac7d2927", "value": "12288:FbtTq448KfyvAvKqUGe+w5aNZqX+z5vbFdC:Fxu4tvcmK8POc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946205, "uuid": "0a535590-c870-4a3b-bbd6-6469350ed3a2", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946205, "uuid": "6f6c04ad-fb10-4c8b-8fd5-400a9649ffd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946205, "uuid": "fd3e29a2-5cbe-4a9d-bd2b-054327a60129", "value": "cd0fb04398299ecebce9a050d40a9ebb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f557f07c-647d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915259, "uuid": "1294e1d7-c704-4618-93fe-7318990b1d72", "comment": "Malware payload (Mirai)", "value": "acc363924b2495f52143fb14c36d59a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915259, "uuid": "924d161f-029c-47e5-8e0f-9fe87cfc6fd2", "comment": "Malware payload (Mirai)", "value": "61ab75bdb73b69e02f48f14a71005e9d8ad8b57f528d53bc9a9f45be0848c246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915259, "uuid": "df09d8d3-b704-4cff-9bb6-bb2b116aba01", "comment": "Malware payload (Mirai)", "value": "39a3ac64f25bdbf5c44b714539d69866fcc01ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915259, "uuid": "c739f784-b24c-4af9-b8e8-ed82045f95bd", "comment": "Malware payload (Mirai)", "value": "0390fd4f485c3cd087423e3314b702ade9961806a5d11adc80ee4505ac56d69f649ac8caf9d19fccb6be465764c3f0e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915259, "uuid": "dc8e267c-3602-48e9-8132-9e1264dc5674", "value": "T13B230271880E9EB165303C72DAD9D393BAE129B1C6573013DA290B382F69B531E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915259, "uuid": "10e72986-5bc5-4646-bf2a-131921808608", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3OX9q3UELbUXfi6nVMQHI4vcGpvV:DECFd+A6YHAxOmLRQZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915259, "uuid": "3f11f005-7a50-40ba-8843-857fac1afe03", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915259, "uuid": "0682bc66-f760-420e-96ec-b94107759423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915259, "uuid": "0b37e550-f534-4108-8fe9-18725aa5eead", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4557ed-64b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752941046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941046, "uuid": "1f58ce49-538c-40d5-8c44-6e7a09c9cc8c", "comment": "Malware payload", "value": "26e355e5faf4608b3580a231cb528ab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941046, "uuid": "a133c38d-011b-40ed-a810-13062dde6781", "comment": "Malware payload", "value": "62961fc865e89138e821189c688a63071eb608b9c63bbed3de21cf2a229eefb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941046, "uuid": "a2bfa88b-a4d0-490f-afc5-1db160a3339b", "comment": "Malware payload", "value": "caf61fb9f216560845238274dd3025eb993dd6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941046, "uuid": "7268b304-f52c-4534-b7e5-44184a2a6959", "comment": "Malware payload", "value": "f5bd0384725367600ae76201abf98af84682d7c66b9b5b4d09ec60dfd73b5ef65bb209eebc384610d0dd9c56b5798f35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941046, "uuid": "5e769441-258e-4632-8afe-14568995ca51", "value": "T11D656C867C5444B4F1BB93308A755292B630BE593B325FD72B00B2F82BB6BD94E39351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941046, "uuid": "b5547d24-6b73-4bcb-95b1-b52449f7d798", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941046, "uuid": "308567e6-7193-463e-a655-77bc79ef051d", "value": "12288:msacYO95pNmCasJeTIcV6FuoPYrli7UZrKlbyyXarkbqj5VpPugRZjhXVrqMzNi:VaXO95pNnasJWV65PQuldeHpPugRtV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752941046, "uuid": "ffbc94dc-c7da-41f1-8d7d-fe24de610154", "value": 1421016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752941046, "uuid": "1197d64e-1c22-4aa5-95bc-bc4fefa2cc20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941046, "uuid": "4ffa5b55-b195-40c5-b25d-e9ced8ce9ecc", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58412fe-64b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752940519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940519, "uuid": "3e1b198e-0209-432f-939e-1b27046fcff4", "comment": "Malware payload", "value": "b6b71c446433ce7a32437d63a7b31484", "object_relation": "md5", "Tag": [ { "name": "178-130-47-243", "colour": "#B12F43", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940519, "uuid": "0baaa738-292b-4d1f-9dcd-3979b4ff4247", "comment": "Malware payload", "value": "6411e21322f66424d566b3aeba7cbc53aa55025792cfa6d3d5ec8fd017d13a87", "object_relation": "sha256", "Tag": [ { "name": "178-130-47-243", "colour": "#B12F43", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940519, "uuid": "db57f8cf-adba-4e49-a696-9b7aaccc6b5a", "comment": "Malware payload", "value": "8caa97be4e383d125eec22efe353055d4dd298c6", "object_relation": "sha1", "Tag": [ { "name": "178-130-47-243", "colour": "#B12F43", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940519, "uuid": "0a30b873-cf04-4414-90c7-39b17e646d12", "comment": "Malware payload", "value": "ef5eaf5902706dfe869f27c477e0bb557374cc7a106d5df5c9cc75072d27371b2d6736b99b499c7dbd1aa69417e08b6d", "object_relation": "sha3-384", "Tag": [ { "name": "178-130-47-243", "colour": "#B12F43", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940519, "uuid": "6865f00a-814b-4a87-bf15-84e9990b5808", "value": "T103166B31E541A065E8F914B7B3FE4EB748EE9C086B26D0C3A5D938C45A712D325F928F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940519, "uuid": "f39b9d76-c934-4fc0-aa9d-4a9815efe970", "value": "4e6ddafb4dbe3e9b050630d3a06fc0bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940519, "uuid": "c6e66bda-9ae6-49d8-ba36-f5c121bdee92", "value": "49152:Pg/8NCM9Nwv/YXxp0DDBdEcnW2vuqxI8C5HBKMZnCPdJ9TB7itLV74AyheM/:oUroA2Ecnnq8GHYMZEJqlVtyheM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752940519, "uuid": "26fa050f-12c9-4164-bc7b-31c003da6c75", "value": 4051016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752940519, "uuid": "d405c852-fdbf-4f59-af63-39cdf20f19fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940519, "uuid": "9beb67c8-0d4c-4c81-b631-67006e1d4ea5", "value": "python38.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55d401c-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925057, "uuid": "1c65d119-eb6f-483a-a0b6-8dcdb8bd3624", "comment": "Malware payload (Mirai)", "value": "405258f83a8266f3494c945945f9c65d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925057, "uuid": "3b1f0140-e2d0-4d32-a6b5-697068c9af9f", "comment": "Malware payload (Mirai)", "value": "64e02dd9310346de4018671c31a8111158615abf5dcd9129d1777db5850c320a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925057, "uuid": "7e93587f-c3e3-4a66-9eda-c6f47223adfc", "comment": "Malware payload (Mirai)", "value": "e5964d6ad0814cd65e1130ebece2cb163823a3b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925057, "uuid": "0aeeee0a-a20f-4282-b236-4e5580c05e4e", "comment": "Malware payload (Mirai)", "value": "34eea4c9358c13ec8a35d1e0e51bdc7b34947fda4ea159c5447d93414726daab5f71163422e193e27dfaa88d8e861988", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925057, "uuid": "89935861-ab43-4323-9659-e453dd369753", "value": "T126330951B8C26667C2D013BAF6AE968E3731B3E8D2CF32179D211B113AC512F0DA7E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925057, "uuid": "542779f9-d094-4b67-9cbd-f308f44d3066", "value": "768:8pn7fx2wLtIhxYkn8IdF004ZKy/cJzFozvJVMOkpc0i4X9K2HXRNwwJZY10Up:8b2wJIdsGgmFozv7M5pc0ieJa10q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925057, "uuid": "96c160f9-2b93-44bc-8e9d-269480de69c8", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925057, "uuid": "4b0d7a52-1bd1-44cc-9c3c-6348d69178bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925057, "uuid": "5badc1ee-6ee9-4d1d-9869-8670a624daa8", "value": "uYtea.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8feb42ea-64f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752967917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967917, "uuid": "d900b906-a7bf-4c6a-bc93-4a5307e3e0d4", "comment": "Malware payload", "value": "5db52d55b4db43914f8ad1cd207c028c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967917, "uuid": "fb271b2f-d169-4363-ad14-7c22c19c41b6", "comment": "Malware payload", "value": "655b073f7428637e3269d4b7c8ba2c695b0561b26d87db079b79ce964007fc95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967917, "uuid": "c1b986e7-f8b2-4f15-a3d7-c81affbd15c4", "comment": "Malware payload", "value": "b83d9786c4808ff091badd8767168a99ea0aee0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967917, "uuid": "a63ace7a-b96c-48d4-a3cc-47a23ec56b76", "comment": "Malware payload", "value": "06dcbc4be1a89c40d592f03fef667f568c1314b573455b3db5d1c85745179235ac4ee92cc0897a95f5787e1df003c4c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967917, "uuid": "7939e6a4-f2f1-4417-b544-8a893a89cd6c", "value": "T1E283181B97A1D82EC04753F06AC7D8A2D412B63C0B3B615B77A07D69BF635C42D6A30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967917, "uuid": "9945270f-2551-47b2-bdc5-0b6198be6ebc", "value": "1536:A7urT+jMOZWQmL94aWb/Z4S+gPQPn1Zwmm2sg/q21:A3IOkQc94B7Wf1W/2R/qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752967917, "uuid": "f5359a4b-bf87-4477-a4e1-820f487d6cc6", "value": 80945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752967917, "uuid": "75e0b5d8-a586-4c0e-b6db-751ff43076a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967917, "uuid": "82cc3093-4850-46ea-af89-74b2bb9eca7c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd342bb2-647d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915273, "uuid": "8fa7e809-8b32-4b1a-90e6-e1720444bb8c", "comment": "Malware payload (Mirai)", "value": "cbd740b5c928f0dce2f06207aad7c8c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915273, "uuid": "0f94c940-18cd-493a-8305-c2479a3a8317", "comment": "Malware payload (Mirai)", "value": "66ddd3d8e98b38ec01c9ddd8c2e116cba62ff20b16a3681f1e3bfe3be98b49d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915273, "uuid": "adcbbd7d-703f-4f3d-9fc9-db722e3519e2", "comment": "Malware payload (Mirai)", "value": "0e79194ddb07c54e724ec02086d92ff90a18b3b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915273, "uuid": "a78ade7c-7f9a-4b5a-97ad-2058db6e065e", "comment": "Malware payload (Mirai)", "value": "58f96de6a6927ed7458a6378c375ca8b5fc51dbe4ed4b81b59bcc0b2b56adf7032a53ab354c1da577fb93230e3b28cfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915273, "uuid": "e9294445-c084-4d42-8121-c5e43056a846", "value": "T177630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915273, "uuid": "42aeff05-6627-4869-9767-4685e1cf291e", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915273, "uuid": "132af4d9-76d6-40e2-8eab-de9b5303bc6e", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915273, "uuid": "2ed76579-b563-424a-8da0-0e92ba5d3872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915273, "uuid": "30a6e5de-a974-42b2-952e-de162dde1a23", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d7c8b6-6463-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752904098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752904098, "uuid": "2b2765df-1d89-4f7b-b401-dab51b4066d9", "comment": "Malware payload", "value": "450aa7e287882f83952e4e4a0e0a2b6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752904098, "uuid": "bbb3f9dd-61c4-4494-b910-55e8b3df6092", "comment": "Malware payload", "value": "67161773125a74814ea18af98d0c1d36018c5b627950b5657387185ba7ed5123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752904098, "uuid": "663a5c16-d32b-4d21-b10f-7da176ac024c", "comment": "Malware payload", "value": "a681d1e40876c0b51e543742b3409de75d0168d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752904098, "uuid": "2f5154b8-14b6-442f-8733-866b4d9b489a", "comment": "Malware payload", "value": "d51118b157bb35b04801e1e80205518bc4bf3384bb80b371b0ad734e03e49b014bb103c28926075491a4f82db583461a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752904098, "uuid": "61ecbc7b-e21e-4c0b-a6e7-06a7c830f102", "value": "T1967319D7F800EDBAF41AE73B4457080AB230E7A10A821A763317356BED762D91877F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752904098, "uuid": "a19e7005-bc16-49f6-af72-bbd7c1a7fb46", "value": "1536:mpw9CUxjIO/4N8K8cvLojNygjrz2qy7ifWndT8gjmNjSEAmRhmoRg4:m8CUl/4N8kLgNygjrzGiOntiKmRhJ+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752904098, "uuid": "b72b6e10-ea6b-4051-9f76-34676d81a500", "value": 77140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752904098, "uuid": "7857e486-0033-4f72-a1c9-06563638fd45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752904098, "uuid": "74a1eb9c-a238-4f21-b8e0-c3e339a8fecc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d1a868-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933279, "uuid": "d8b64661-e9d9-4da4-b414-897978845c2a", "comment": "Malware payload", "value": "deab1aa31e408a87f2a2ccf59d3c4b3e", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933279, "uuid": "684a011e-5363-4f41-b1e9-e4306f104d60", "comment": "Malware payload", "value": "6738b5bfcfc91f12e3b58d22a1f2b9a067f48b6fc4d2228c8b498215797962d6", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933279, "uuid": "92e8b735-3395-42c5-ad9b-63cb8aa5f887", "comment": "Malware payload", "value": "afda46c1fb096eedd64b991c97d45db5e996d8f4", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933279, "uuid": "eefd4dd8-cb77-47fe-80c8-3576f1146a6e", "comment": "Malware payload", "value": "4af783939904da840f972c89fe2ef67bdc96b05853f659cc3da011bb3178c72a7d8abda0df4d58948c51bed75fae585b", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933279, "uuid": "01f578c4-a741-48e3-a894-639fedc0102a", "value": "T1C9E15C7C8173081ED37A10B9561110928B29FAF982471D377EB09B1EA9BFDE7232C655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933279, "uuid": "c957177e-634a-4681-b810-57d495d78717", "value": "192:VdQMe+9OV8vdQjmdUpr6uXSzYu6xwfjAU:MMw8qme2uXTu6xwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933279, "uuid": "650a5d36-18fd-4aee-beaf-2fe677defcf0", "value": 7186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933279, "uuid": "b0feae77-28d6-4cf0-83f4-24ac7cdcb431", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933279, "uuid": "d9ffe04a-e101-4dd2-b93f-6e0cdde229d0", "value": "PO.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08344507-6495-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925169, "uuid": "27a95a34-3487-4703-ab17-00f2bad42c31", "comment": "Malware payload (Mirai)", "value": "ecd5cdbcce5a071f24e5b6a816b9e0d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925169, "uuid": "c467501d-5037-4179-8468-d2567c5738b4", "comment": "Malware payload (Mirai)", "value": "676368db95e258c85fe3524c289102491a5f640975a51318e728d68b5643f4cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925169, "uuid": "f834e6dd-6430-495a-858a-ed60e776676b", "comment": "Malware payload (Mirai)", "value": "d12901a5c22864bc1e2a8b79dc040b46f3f67528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925169, "uuid": "1c2314fe-e452-4164-8665-d088f95d8745", "comment": "Malware payload (Mirai)", "value": "8266c6763657f431884973051e40104f80bcf59a90a84c6e023d0a5ea652175f9ee2d54ce3ddf792a0ca441029618651", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925169, "uuid": "928c7b2f-a3e5-4dbd-8127-64a9d8ce3d0b", "value": "T1712533B926EC8891D5E01C5688BB480B6A38E7D95DA30C7B9185FCFCDA708DCF731265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925169, "uuid": "76dd77e7-7cab-4a40-a6a2-5c0e32f2d4f4", "value": "24576:RL2eDzUe0V9UFBQO7BxAkdX8SKoQzyhLYoxXjDRtQs5elHCX/:R1fUe89fO77A21QuhU4XjD49liv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925169, "uuid": "9128bb63-24b9-4381-9e9a-a79e77833a0d", "value": 1013300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925169, "uuid": "cfe3c6f5-07d7-415a-9af5-8c84195df2d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925169, "uuid": "73666817-e76f-471a-9c27-0dbf2bf16c85", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775cc036-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919772, "uuid": "fa4832a6-ed02-47bc-a2e0-97487c487177", "comment": "Malware payload (Mirai)", "value": "86a34f7aa3dc951c2d0a10433197815a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919772, "uuid": "512eaedc-f30a-4ac4-8585-ed072fe02035", "comment": "Malware payload (Mirai)", "value": "67906ef3cfb7050ecaddf948648f9dc3da36b52787e56e644a4b0e070368ede7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919772, "uuid": "923b4ed3-f75f-44b0-8dab-a57151bbbb73", "comment": "Malware payload (Mirai)", "value": "ec7cb1df77361741317e4ea90ebb99efd0628638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919772, "uuid": "18d8c732-d9bb-4a80-a1d0-0190c98176c1", "comment": "Malware payload (Mirai)", "value": "3670e2202b0ec4f46aa801193e98b824188bdac668a40e0d1af90dbfcded27af5c57ba18021e3fb31ec3388a5a46ff62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919772, "uuid": "fdd571b0-9a56-4459-831b-161ded3ef292", "value": "T174A3C71E6E158F7CF79D873447B78F219688338B2AE2D141E15CDA015EB028E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919772, "uuid": "3c0d84f1-f972-42d3-87e1-d40d931f76f5", "value": "3072:pqunD7x7p9V7EbcrjQqGdnK/aIfaazOBCtM:pqunHtp/tGtKy8aaz9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919772, "uuid": "7909ae43-58cd-42ad-858a-7075877a353f", "value": 101132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919772, "uuid": "9de35aa6-3a44-4744-9ff0-4450d329e2f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919772, "uuid": "c203e6aa-1e30-457f-a17e-427da95a1f30", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b821a30b-64c6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1752946510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946510, "uuid": "23dd5eab-a6da-4af5-8d3b-0bf8810f73e0", "comment": "Malware payload (njrat)", "value": "cd4f8a3f4325ce65e0a6f6161c0adb7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946510, "uuid": "da96b05b-89b0-40bd-91e7-5ef3bd462925", "comment": "Malware payload (njrat)", "value": "69e4d3d80fa746e65b4ca0c739282be3c719e33f6eb3c14af26f24eb99ea834d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946510, "uuid": "d48bf635-d25c-4bff-aa94-34724e4ce06c", "comment": "Malware payload (njrat)", "value": "e64b272bb5d59e5b3feb947a828d3f03d2172faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946510, "uuid": "785ef395-708a-46e8-bbe8-dfef44cd7b28", "comment": "Malware payload (njrat)", "value": "9755e847887a71a86c8a6753fea8fab9988cb7fc7bfe1d94194e0a431fdcc8a91dd710466fdb374713b1fcab4a441c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946510, "uuid": "d71ca66a-5bca-4f0e-9eac-b0e395c9f70e", "value": "T161F30947ABA66535C2394B308C13ED06D5D080ABA7B7FB5602985CF2D7E9EF84C1F186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946510, "uuid": "0b9cdaa8-5624-4df1-ac35-18601dd8a343", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946510, "uuid": "2c39b198-a356-4161-b80d-9082e67703d1", "value": "3072:NKZVf4U8CCx/d15+VEstFjO6ZaIXauqfuPJUidqooJnCLeJ:NKnwUURdbfsrjO6w0auCuPJYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946510, "uuid": "0ad503cd-80ed-4955-bc4e-649150e2704a", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946510, "uuid": "3a1722dd-92b2-4f1a-bd90-6d46a2921380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946510, "uuid": "57031339-0a33-4f91-989e-96e8efe7e98b", "value": "CD4F8A3F4325CE65E0A6F6161C0ADB7B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b19eef-64cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752949465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949465, "uuid": "33653dc0-6c6b-4473-bec0-fb618ac32624", "comment": "Malware payload (Mirai)", "value": "583c1051e975523147b2f3d85ccec0d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949465, "uuid": "b5d4059c-6c40-4511-a971-7fe9cc62ba34", "comment": "Malware payload (Mirai)", "value": "6a0c2d35048161ce8a2ae7bfc5e3fc9dff9e6157b44fcbe492b767e73381c32a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949465, "uuid": "85ea3d02-8b41-4a33-b1c1-db1bdc76a299", "comment": "Malware payload (Mirai)", "value": "e4b9657c62d8b3d35335dccd42c980b4321a6d35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949465, "uuid": "6d04412a-30e5-42ad-ad11-44e1d17049ff", "comment": "Malware payload (Mirai)", "value": "e506f5985983c48855ddab7d88e9ab689117106a6a0a626bc0b0e59603e22b035938547b8d54e87e98b8573fc53e1ff9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949465, "uuid": "8f05ad0f-f7bb-4dd9-939b-9366550e82f3", "value": "T131236D1B6541C0FED8DAC27A8BAA653AE533B03D1265B10873D8F7229D8DD116F6CA03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949465, "uuid": "954faf3f-9ff2-45b3-9877-a15452e5c641", "value": "768:4KZk6QxDkmPJVruf8ZIsuMkthra+PEqxpXKotB3BkoIFv:LZhQxgQHufKI3fLsqOFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752949465, "uuid": "a20674d9-6e69-40cc-8340-bebcfcc6304d", "value": 46704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752949465, "uuid": "cbe26059-60ba-4638-af7f-ecfea748182d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949465, "uuid": "0b95a048-3685-479e-8326-da9c001e177f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8034b12e-64af-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752936538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936538, "uuid": "82b0bfe3-a1e0-4805-aac6-62e0d4de340c", "comment": "Malware payload", "value": "2a9963c175fe52988880f2f554e6c6ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogs", "colour": "#F8D1F7", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936538, "uuid": "b99a466a-7eab-457e-9f14-e633da6eae8a", "comment": "Malware payload", "value": "6ac478dc203fdd272f0edc352daee1c0f8d007d439bbc93ead84ffe4a7606225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogs", "colour": "#F8D1F7", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936538, "uuid": "4bc5861f-c182-4cee-b660-64154cdad95e", "comment": "Malware payload", "value": "b583f2f8cb15c11b6ade810ed4c6f39b2b424a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogs", "colour": "#F8D1F7", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936538, "uuid": "cb53a249-0494-4697-8472-113fd7e26d0f", "comment": "Malware payload", "value": "6a91640ad537209e30ecae5466022540a9dbee4673c23c9061a04517235b10191afdc282662f22e8419d9fd33678792e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogs", "colour": "#F8D1F7", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936538, "uuid": "ff971fa3-193c-4ca6-9ccf-907f95f22881", "value": "T193A5F12A9991F2CBFC7641B2509265947833B637C22A1FFB8264D273DF276C41B19B1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936538, "uuid": "6681dc20-8dcb-449b-9831-fb61ef3b6ac7", "value": "f5f30b7b5f259a4a0b7809ee71919fa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936538, "uuid": "0328e549-5fce-4e2a-b512-fb0f38553511", "value": "24576:jPHgeez3kDAnbS4WbX5wK6djIMY2AbTBV8bdIX5wK6djIMY2AbTBV8bdft:jPAIAnXWqK6dcRV2K6dcRV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752936538, "uuid": "4c971302-9487-4362-80d7-a04b22d38dcb", "value": 2105896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752936538, "uuid": "88409035-7347-4197-ad64-92c1acf1a175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936538, "uuid": "4b3160d4-10b6-42d6-817e-ad41fb9b24d0", "value": "signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c2dda0-648e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752922244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752922244, "uuid": "6f0996cf-e165-42da-bfea-9f3409aa828c", "comment": "Malware payload (Mirai)", "value": "61da9037b76a208851f4f22a70c162f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752922244, "uuid": "46f1dee1-1464-461a-9ec2-5cd62dcc4dac", "comment": "Malware payload (Mirai)", "value": "6aee9f447e722760722a7d3cdab34e1002cd0af9edbd28d946dc2dfd6d466570", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752922244, "uuid": "aa235a95-cdaf-4648-932c-7c94c275f32f", "comment": "Malware payload (Mirai)", "value": "bbc82e79ccd81a15ca8169519cf96e3e7255b908", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752922244, "uuid": "6a6d3762-35c2-4cad-9c38-1e71366b809e", "comment": "Malware payload (Mirai)", "value": "4f0bb129b12a1ebd80e293de4f5b8d5b662df8f3b4108ca8e55699d8d145e60dcff5ad064948f579baf1391b736ea7bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752922244, "uuid": "60fee51d-7481-40b2-a0bc-825fdb7bce8a", "value": "T1AEE02B44D08300BB30738D2DE2F7060C71005E0B04050F2EBC4DE03A4B38C9470716C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752922244, "uuid": "01025437-1fec-4eb0-88f1-b0ff89fb34b1", "value": "6:hTnnID91/UpWVhenZ7NXordMJT7mOJu4ryOBLj:VnIPTCJSBkTqgluOBLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752922244, "uuid": "c7efe386-b3d7-4bfb-9b49-cc3341142399", "value": 295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752922244, "uuid": "786cb132-60ae-443e-8a03-37d6d0ea789b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752922244, "uuid": "68b5bdd5-0dd4-48ca-9ee4-b651edda4e8a", "value": "sky.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cf46ba-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925050, "uuid": "5cb9f409-d7da-440b-9dd5-db7839ae3171", "comment": "Malware payload (Mirai)", "value": "27ed6c61923264610c21ea8a5eb74cc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925050, "uuid": "a3c886e5-38ae-48ec-bc15-69c619b0cc39", "comment": "Malware payload (Mirai)", "value": "6c87487055388d68866ebc3c0a28365554298885a22b024eaac8719f0b1f1d22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925050, "uuid": "6c165d4f-89d5-41c2-9471-72afe40572e3", "comment": "Malware payload (Mirai)", "value": "490beb9894b1f0c828682d00af1a7af6c1eb58da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925050, "uuid": "c3a3f375-b8d3-4923-bfc1-21965b11c0ec", "comment": "Malware payload (Mirai)", "value": "d0a9edc299ec583b9d87a9fdb5e8d63cf006368b9c3d75a4b06d294f62ce76a13d17030a15230f7d77723a087b8c8619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925050, "uuid": "08e01903-1533-4cf3-acec-5ab0a3f0305f", "value": "T18E434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925050, "uuid": "a4e22248-d164-4a9b-8f29-f12908cf19a5", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmc/Dj5gk9vWnTI4eBH+4sToQLDLFv:Yn/EsW5qhSh6amYlWnU4GH+dNLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925050, "uuid": "b50b1d05-205a-4ab6-9ff4-b45056664521", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925050, "uuid": "0726c884-5bdd-405c-8066-35469ac86ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925050, "uuid": "8d7c7eae-c4a2-4c82-95fe-b5d8968c6fe1", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42bd2d9-64ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ACRStealer)", "timestamp": 1752941322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941322, "uuid": "651faeb1-910c-4a79-9bed-46e377559dff", "comment": "Malware payload (ACRStealer)", "value": "c7a747cafef8f8fda762647d92c6be4f", "object_relation": "md5", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941322, "uuid": "22957f07-d901-43cf-8b3c-38ee09b5964c", "comment": "Malware payload (ACRStealer)", "value": "6d3a89cae7263417d22aeb13098e81c875c30b0122f8d08e2f7bad1c99089a71", "object_relation": "sha256", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941322, "uuid": "40f0eb92-49b5-4441-a3d4-74df8287b914", "comment": "Malware payload (ACRStealer)", "value": "f9d8e3485318916767b4e18d082cef2454369f98", "object_relation": "sha1", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941322, "uuid": "3cb6a427-be23-4709-bf94-bb016c7ae54d", "comment": "Malware payload (ACRStealer)", "value": "42a211547968c5e97cc9fe60b796058136ac71c13bfa420f3cc567f331d87c12efd263d876ec6867b4cc883e6161c45a", "object_relation": "sha3-384", "Tag": [ { "name": "193-32-176-219", "colour": "#4CECA9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941322, "uuid": "c770fcdf-0903-4cef-a111-c2e8e0490197", "value": "T178E69E1A7AA840B9D0B7C17CD9978A47E7B274050B709BDF52A1436E1F23BE11E3E721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941322, "uuid": "3baa0dd5-2958-4332-9ca5-ad186d4ad52f", "value": "196608:UGpk7HhKd6JDws76A2Q/79dQQ6j2eF+7pJmqkA8lvAHnGZZN17d33349S:27B2ds7D2279T6jj+lJmqkA8lvAmZZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752941322, "uuid": "706f829c-73d4-4462-b958-a9c3a4458fc4", "value": 15092224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752941322, "uuid": "91827650-ca59-445d-a9d1-ec4e4f4250fe", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941322, "uuid": "8db1ceb0-643b-410a-8560-d36429cb383b", "value": "Setup$.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6c1a97-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925047, "uuid": "9b98dd09-fc21-44d4-a46f-1ccbeb43270a", "comment": "Malware payload (Mirai)", "value": "383cbe27c881cbf15b7f67486b030aa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925047, "uuid": "218c897e-362d-473d-82c7-82bfb6fb01a8", "comment": "Malware payload (Mirai)", "value": "6ded261b58bc36629323eff336278e7f9b87619af341e817962e171a8461ce6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925047, "uuid": "6e5e5cd7-b904-47de-9d7f-7384c42bd1ec", "comment": "Malware payload (Mirai)", "value": "d1f7186384f3fdb6ece8afdc1dd8a80311cdaca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925047, "uuid": "748eecce-493c-4160-898b-f0fa4743ed84", "comment": "Malware payload (Mirai)", "value": "a3052281ae31017790e51a4a210e5b433b980350969b89f41ac178f7616df843d92123d0255dabb5bcbc629b5de59b97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925047, "uuid": "4af5585f-1b92-46f8-9b9c-c020441d56bc", "value": "T1EB432B95F802DE7DF80FE67D44164E09BD3063C261830F2A27ABFEA36C720966D56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925047, "uuid": "432ad79c-7d56-4e2d-8a67-dd73faf6541d", "value": "1536:/+dPsTgnLbMuv5tGHbaXnb7f98V8TWl9ouSQy8fNLsA:23rebobZ8V8T4oHQD1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925047, "uuid": "90bd0e51-77b5-474f-bd4c-d03d6002202a", "value": 60452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925047, "uuid": "59813e3d-db27-4093-9f95-f87f3739514c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925047, "uuid": "c01390ab-f7b3-4445-82f8-0c8fc336e251", "value": "uYtea.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8715a73a-646a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1752906914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906914, "uuid": "55eb7c18-0b70-4588-9197-846be360f4e0", "comment": "Malware payload (DCRat)", "value": "808116fee66c4ecc93fdb82b4702e2c2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906914, "uuid": "3ec03e13-66df-4d5f-95f0-a0a3abf0ddf7", "comment": "Malware payload (DCRat)", "value": "6e22b8c479103bfb6344db31046c4c2f8230c965859cdd17ef99f2e52612b9e9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906914, "uuid": "3870b28b-a7e4-4a65-8119-64b57af993d3", "comment": "Malware payload (DCRat)", "value": "f2a9895cf0a59b344dc3f74089179b446afbf072", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906914, "uuid": "a31470a9-54ee-4713-98a0-078dfb74031b", "comment": "Malware payload (DCRat)", "value": "26aa0129325dfdbcf9fddd625f6861e5a4560a8825c1528480de893f943dc42914e8858bddeef6f362b3ff2ffef2196e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906914, "uuid": "1c4699b5-adae-410f-9420-2c8e79057f8d", "value": "T1CE05E7027E56CE11F0191233C2EF454887B4A95166E6E32B7DFA376E15123A7BC0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906914, "uuid": "0c2a0e99-61ea-49b4-85b1-abe649af4de2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906914, "uuid": "125adc1a-bb26-491b-aba7-b7f87ad40b9e", "value": "12288:129hqSDtkFadk25R/ZqROqAcPfrB34VsTUkKQtGDURgBQIy47y1GO:1GqSDtku5R/ZqROqPUkTG48QOO1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752906914, "uuid": "3e3b3735-40e5-4347-b855-34da17ad3bf8", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752906914, "uuid": "0741e1f1-c536-4421-8210-44bf315dc019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906914, "uuid": "6949ca08-52cd-425e-bcbe-21099af77745", "value": "808116fee66c4ecc93fdb82b4702e2c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7fe70f-64c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752947265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947265, "uuid": "aeb87e72-5dff-4814-b5ee-143f96be3a3d", "comment": "Malware payload (Mirai)", "value": "2da922cb7f294d5cfefaec6571e02e66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947265, "uuid": "882ccd0a-0d15-4e30-b740-62d6a51fb7d1", "comment": "Malware payload (Mirai)", "value": "6fa2160269d8cc535e74ec6652851f9aea8822c73936f1b33e0aa0fdbaf1702e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947265, "uuid": "7369c1d1-4201-42d3-9078-53fe536740f0", "comment": "Malware payload (Mirai)", "value": "c3270142713f726b6be073d7b9df29672f93cca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947265, "uuid": "13b336f6-7a32-4bcb-8fb0-3e3ccf0e7a49", "comment": "Malware payload (Mirai)", "value": "c5d2bd20672ffa70343f4903cce28aaf0db8898a4103692c1da5b90db316b39f21a85b886797efe5231d398c5ae40449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947265, "uuid": "ff848561-676b-4486-9776-b8a4b0c05702", "value": "T176E30A46FC819B12D5D111BEFE0E128E37131BB8E2DE72029D246B75778A87B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947265, "uuid": "8efc394a-4104-4a13-86d6-782f51ad2274", "value": "3072:nGMsNakU3uAxiXO2hYFbaFqaYp4xV4MAP9YKAl:nGikApiX5hYNa4aYp8M9YKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947265, "uuid": "cba1c572-8b54-4a60-9bbd-8c0c493bcc20", "value": 150364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947265, "uuid": "b7764611-267d-4216-9895-1d0d84cc08a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947265, "uuid": "8a24ac62-9254-4b96-9d54-373ae6d9a1e8", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e82d23-64f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752968026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968026, "uuid": "a791a3bb-0b7f-4b92-a580-50d98421d4d7", "comment": "Malware payload", "value": "5d6704438bce70c71ea601421a0c93ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968026, "uuid": "6629f0f7-21f1-4d8a-967e-014c0cbf587c", "comment": "Malware payload", "value": "6fac95cc1a94c285ec178638a7cd29a5d90a547c427333fa4d4a9f4c27ecf8f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968026, "uuid": "7a7d4af4-7adb-4657-9e69-98b100bae883", "comment": "Malware payload", "value": "8319285ffb0bc3789b214bfd24ee467159764575", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968026, "uuid": "f28c9cfe-50d6-4382-a289-b90c7902f0f6", "comment": "Malware payload", "value": "8f587ee76c37afa6980d6228733af8744322bc273a8c5f44f121aa26fdb4d83c1f3ff008823b6262c89ee28a52db64b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968026, "uuid": "742e8f1e-ffca-4fa7-b327-53607d761c77", "value": "T11E732901B650D573E04226F61093CF622131FA3E2BAAD85EF7696C79BB31144B271FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968026, "uuid": "4f75c5cd-0425-45f6-a962-f4048f5bdeb8", "value": "1536:z1v8Pi+BtEEnWd8gy+kYJr4Et+prGPpCi7/VdGl:Rd+8EnWd8qNJrVt+pqBtLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968026, "uuid": "5bd3bcf8-157c-45a3-8213-3b4301bd4f7d", "value": 74404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968026, "uuid": "a23deac1-20a7-4f82-9727-e7ffee5bb468", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968026, "uuid": "7272185b-6ef9-43bf-8113-c431ec1d9ae1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105f2554-6493-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752924324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924324, "uuid": "95047835-edc8-4e14-85a6-42f6154f7964", "comment": "Malware payload (Mirai)", "value": "1b5435e1079b7a60c3f93a1fa73e88f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924324, "uuid": "f1a7b980-6e8b-4179-ae9a-1cb3be5273c2", "comment": "Malware payload (Mirai)", "value": "728878b2d32598aab9de2f1a587fec594880f26bf8708e8e682f675384288e98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924324, "uuid": "7cb5b5c1-be02-4412-927c-e05259a4dce1", "comment": "Malware payload (Mirai)", "value": "8efa225a023025c9f9adbf73e3c283ddbca60735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924324, "uuid": "9cc03e32-d1ed-4f27-9f3e-acc6df86055d", "comment": "Malware payload (Mirai)", "value": "ac0f0544f93939fb30353c9c0380283fd8972b78f305d9cf48e2dbbe0ec69f767125fad7ab700673be0739b2f85dcee6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924324, "uuid": "298c8a37-47ba-489e-a1e9-73f0c5c79889", "value": "T184F4335DE799DD9715F3DB42A84FC1441AB2BCD8B05702CCAD00DAF612E8E8D25BDA23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924324, "uuid": "8abdc94c-2ced-4a1e-bb6d-bb624c65dcf7", "value": "12288:Ugjx5Sv9BztpKe1U49yEy0L4hz4hsGV6MVt1/tVRfQiiAR5AScUGWg1mJzk0DClv:UgjxAv3zvU+Z4ihvnhLVQ1wASbfulG6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752924324, "uuid": "0c2ce687-e708-4d9d-a595-da7ce08ad476", "value": 785120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752924324, "uuid": "55287f58-689c-4c29-963c-164ee1799cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924324, "uuid": "887fd275-78f9-446e-9b14-94ab6cbea0e6", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493c895f-6483-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752917548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917548, "uuid": "a9c080c2-faa0-41cc-af69-057d9d447a3a", "comment": "Malware payload", "value": "d4fdfaa7b61b96e3c9e49ac216e8acc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917548, "uuid": "8b13c2b5-b1c9-4e56-b001-b43d6368ce66", "comment": "Malware payload", "value": "72fe7635a2a90bbea5d0590e7073deb0142f7e4c4aa51ad37199ea9dd5730e6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917548, "uuid": "431aa108-9a73-4518-ac29-f116469e89f3", "comment": "Malware payload", "value": "9540c5ed01bc646e7192bfec6c1a21dff896cc85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917548, "uuid": "b323120d-2a32-416a-b241-9ca6dc99c6e4", "comment": "Malware payload", "value": "8a23b241497194056f9fe14f0e72c6d57ac34139ece046eb3f380cc2809472deeea3301c985e9e07de0de481c26f92d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752917548, "uuid": "915f049b-736e-4399-b3a9-fe37e2d4f97e", "value": "T1AAD6334AA3E10CEED8E35135E6F282266BA23CA55B51C0CF07E81B677E170D55A7EF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752917548, "uuid": "13b8ee59-4c90-4850-b5fd-d6ba3b988d43", "value": "064967a99ade726316dc79a4a929fe96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752917548, "uuid": "b16a7bcd-e862-43ae-948b-4bf44455da21", "value": "393216:p85vzKGV2KL16lp1+TtIiF/ZKSJaxRNsIqlGjx90Fj:u5vzFbZwp1QtI6FJax8IsIL0Fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752917548, "uuid": "1d4b214f-5ec0-4484-8622-dff57a7e9380", "value": 12962390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752917548, "uuid": "76059dec-c514-4c04-be3e-b5632820954b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752917548, "uuid": "2ae89bdb-d1a7-4716-b6c6-816fbb9d4a00", "value": "xworm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741fc531-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919767, "uuid": "be0e63fa-fed8-41fc-8cc8-87a5b1266869", "comment": "Malware payload (Mirai)", "value": "d9cafd3b9716aad5a66221fd85efe6ef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919767, "uuid": "698e22fe-7938-491d-8ef8-ce69cb9871fc", "comment": "Malware payload (Mirai)", "value": "73157faa8cd4c492526f2c4589fe59ab5a5841a7153b8bff57b3d113de634bc8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919767, "uuid": "cebc524f-70c3-43f1-8b48-1ebef9f004fd", "comment": "Malware payload (Mirai)", "value": "e33653dfd1ec193425661a9552b0e8e8789251de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919767, "uuid": "3cd21003-9793-4955-b780-1ddb7e726b7a", "comment": "Malware payload (Mirai)", "value": "648d4e12e9333f751d5003b1506818d9c41d0d748d8ee1f70bde31e3751e7714b062a54aaa5dba00f6860b26019659c2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919767, "uuid": "3ed72b66-c778-404e-b32d-d676124b35dc", "value": "T1601114D90064D0966A0C7B24B05A843DAEE7F6C0707219F4E17FE43394DB9992716F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919767, "uuid": "936812b2-fe01-4a3f-a22b-2d9b8bb2bdd8", "value": "12:3J3VzQVraLQVnNIQQAQVsvK2HQVaKAQVKHQV6QVJ5QVJHQV3cAQV/3AQVUzAUR:3J3VqVnNIHMKvBlzHJYJu3a/lUTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919767, "uuid": "8528eb1b-c942-43c3-aa23-9e39615df4be", "value": 1066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919767, "uuid": "21fda4ef-7af2-4848-9984-8de59939bc6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919767, "uuid": "98aec871-91e6-43e6-9a23-95e49c000560", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ed1020-64ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752935093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935093, "uuid": "c0c7836a-0869-477b-a12e-cf2cb8395dbb", "comment": "Malware payload (XWorm)", "value": "ff836ee3271569719eb14554f65ea700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935093, "uuid": "f61ae5f6-ab36-495c-b843-b446ba496403", "comment": "Malware payload (XWorm)", "value": "735ae96aedf83828c75cbe51bd03dd8bd1ac6749b6bab4b8a093afd5bbf2945e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935093, "uuid": "cd160f0a-d1ad-4e1b-bf67-b1b655f0920a", "comment": "Malware payload (XWorm)", "value": "a569b87ac9d92a62cbbdca8b5d5f47b6da715cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935093, "uuid": "049ceaf8-99f9-40e3-a120-35c0a2fa8c47", "comment": "Malware payload (XWorm)", "value": "5fd4ae9e5bc163cb8728e3e830b4bdd3ef0f499afa79df0acd97c1668a64d5a8a42eee82933ae3fb6de07a2c6d9de374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935093, "uuid": "c8e0dc03-c27e-4cfe-b20b-dade6efc5875", "value": "T110256A2878BB90595477FF913DECB9EBDDDE2A636509642B1085030B8E12F90EE4393D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935093, "uuid": "dc3bbea5-eecb-4087-9286-a829b8e7834d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935093, "uuid": "a5e4aca1-d17d-4f96-afcf-0e2664eeb6ad", "value": "12288:9Yr23Xh1HLt/lZRY5uSsRwieF+zwWHz2jdJVjyB1hjwBpGUhYgLSgCTKAySVGLn/:iojy5SjdLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752935093, "uuid": "77d367ee-6420-4162-8a9c-fa937da16eb7", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752935093, "uuid": "60588805-0399-4483-b9bd-eb642e34dde6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935093, "uuid": "67bf87a7-4174-44f8-b842-5897638622b6", "value": "GPgb8s5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb468202-64e6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752960286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752960286, "uuid": "445bf35e-e9b6-4831-be0e-45cfa85fd018", "comment": "Malware payload", "value": "822c22fbcfaf8eb1947219a7e40958de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752960286, "uuid": "4147a3f8-4ca7-4887-bb09-a8afd4349e0a", "comment": "Malware payload", "value": "74cda65a898465719b7709c13925df9f2318624c8a83d132470a92d20953a7f9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752960286, "uuid": "34229834-b98c-4ade-9a6c-bfe415a0222a", "comment": "Malware payload", "value": "7f77ef472a0ed0697a2fa987682b31fbee86cbe2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752960286, "uuid": "5d699879-7c07-41ec-9703-9d6ea94e57e0", "comment": "Malware payload", "value": "a6d1060de223efea650199c0e72729415ba73800d184895c4d553a1b48bfd7d4741ec9d297352f088f2e60e11c7ecfe3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752960286, "uuid": "569e43c8-fe3b-418c-a707-4e02c7732994", "value": "T1D621FDDF42186EB265C1C9ED35C30C2468C2C1ED1ACDCACEA4CF1935A8CCA0C7052E6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752960286, "uuid": "bdf33119-2843-448b-98ca-d3122a4a0d48", "value": "24:yRk5zOt+MB0OkUKgmkUokUWkUEZJkUwkUi6jn:4k5CEA0OkUWkUokUWkUEZJkUwkUzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752960286, "uuid": "f34eb884-528a-414b-8260-ca95683b5325", "value": 1290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752960286, "uuid": "c7fe1900-07a5-4e6e-a629-b3a3eb00430f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752960286, "uuid": "f5963ca8-8c44-4b5a-b326-6de2dc4ef8da", "value": "n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ba3825-64ee-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752963575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963575, "uuid": "05921196-8901-45ec-b7e7-156db3508f13", "comment": "Malware payload", "value": "3134c94ffbc5ee53f76e12d88e8d964d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963575, "uuid": "63f6a4cd-8705-463c-adb1-3477627c5e05", "comment": "Malware payload", "value": "75c0aa897075a7bfa64d8a55be636a6984e2d1a5a05a54f0f01b0eb4653e9c7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963575, "uuid": "47953fe4-010e-488d-8f98-e7388e97d60c", "comment": "Malware payload", "value": "a77271854d70ac119552ab830eb266e94cc8b9cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963575, "uuid": "014f229b-0120-428c-a611-28cedc838d95", "comment": "Malware payload", "value": "e053f06ecd578d1481b9e117476399f6f2ad011ba1d2e34e5af7f4657d25bfe5a36216972e3d46506b61242d45677296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963575, "uuid": "5fce8109-54a4-4c4c-8f9b-e0a3889ef815", "value": "T181652947D6BD10E8D0BAC138C6036727F971385D8324B7EB57D98B961B22BE4A63E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963575, "uuid": "5d263382-7cc0-436e-b0ed-5ae62e8ee1a2", "value": "dcdbfa2c3573f6d4cca839af8875f3c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963575, "uuid": "feca9dba-06b4-4114-ba06-4819837fa001", "value": "24576:Xo3V1fiIuwGr4ftcWL6lhOekTk+2hloSTwIbdvVqrbT3aycqxHghnVNyPNljx/:Xo3V1fnuwmm9LwVkTk+2bo+bdvV2bT3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752963575, "uuid": "9a6afd4a-62bf-4780-a358-56016cebf715", "value": 1473536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752963575, "uuid": "9502e838-2dc8-4baf-b3af-fb27a3b0bcfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963575, "uuid": "8d734211-8d67-47e6-8c04-e2ddca09cb93", "value": "75c0aa897075a7bfa64d8a55be636a6984e2d1a5a05a54f0f01b0eb4653e9c7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd5aa95-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907918, "uuid": "488ec6c2-1121-4e95-bc3b-b903ded81b03", "comment": "Malware payload (Mirai)", "value": "abc1eb05f4f14137582119d464eeb49e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907918, "uuid": "7b7d5951-32ff-4036-9b01-5d9a6ecc37c3", "comment": "Malware payload (Mirai)", "value": "7687fa4c5ce737028c81f4d325d3d046d8e5351dd044106ad0517f45fe93d76e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907918, "uuid": "998722e3-6409-4fe3-964d-53e2b315790b", "comment": "Malware payload (Mirai)", "value": "b18024bd4092dc104b723f9777f2aa2e5102ee38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907918, "uuid": "849b864c-9388-43b9-96d2-128e74d87e52", "comment": "Malware payload (Mirai)", "value": "0c44948195d9dcb278e4d35384ca77edce81ef33d98a0ede2b54e16851a325e499f9d94ed92746a472e90d3d43474ebb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907918, "uuid": "86f8687a-ce29-435f-a91d-ecad237e7ed1", "value": "T1F4D3EC7AA7A29EBBEC1ECD73059A4502214C928D52D96F6FF264C518E3CBC4F48E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907918, "uuid": "fdd4b3dc-34d3-41a1-8417-6e9b5cd80a13", "value": "1536:/ZxwFKehZ+ag5kOnmsV4z0lZ3Q3L6p1aKHHaLDtgbQuD0ICP0zNTECTcYl:/ZxwEehZ+ag5kOUz0lZ3iuAICPALYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907918, "uuid": "a01c3dbd-8d52-4f88-90ea-0774ff9f00d3", "value": 130950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907918, "uuid": "82e670f8-4d6d-4b60-a0da-399f913db2f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907918, "uuid": "c9471da0-da7a-4d36-8875-86c6f426bebc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef5ce76-64cc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752948803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948803, "uuid": "d44d4bf7-4721-4549-9590-07c07c0b8499", "comment": "Malware payload", "value": "4feda4f241f660b408fd5cc1490b48aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948803, "uuid": "62e4dbdc-45cc-4e6f-bb25-75ff48e64baa", "comment": "Malware payload", "value": "76f404aadaba00824a4a2af79e1cc696a867b55eeaf6fc38795da0be79db536d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948803, "uuid": "d5be7760-a8d7-4222-9191-4ff1355a3f29", "comment": "Malware payload", "value": "a247829e383276d6a1cbb8cd29cabbf0a59f9a64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948803, "uuid": "5b0a366c-dc27-4ce3-aa01-cc031b1b7994", "comment": "Malware payload", "value": "e9181526cba14ebd97c3dc7f1626d780f2c37140ea7166ccecf836db7f0f126f24b4941335a1bb778610f87629418d81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948803, "uuid": "94622b59-bac8-4519-9e04-4f554220354d", "value": "T101242947BCA09601D1EF5976B90D818D3B170FB8D7EB7225ECD01B241E86B5B4E3A583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948803, "uuid": "caee59be-25d9-48a4-bbbf-8ebd18eea47b", "value": "3072:q6ej5iBZ25pXFh0UbRe7SBPiPQKVU25VMQ/t3CjtBeJuHqtiGFUXokytve/n:q1XFhZmyPQQKVUYrV3CjtBewHq0oM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752948803, "uuid": "8851f8a8-7482-4543-8355-6bc8c915cd15", "value": 223944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752948803, "uuid": "807e4201-792f-4a64-826f-371b7487bffb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948803, "uuid": "439e981b-a560-4085-b218-4b3b24d58066", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf52380-649e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752929202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929202, "uuid": "9653347b-da78-4ef2-a0f2-d2c91d96daed", "comment": "Malware payload (Mirai)", "value": "9a16a808c668629cb3fc667f8ddcf4a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929202, "uuid": "686d1aad-5c49-4aff-b529-63de34d0d1c3", "comment": "Malware payload (Mirai)", "value": "7751f2abb9c3db6350f0d2f6a6b9e921a0b92b50eae7329431921c2a910ed542", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929202, "uuid": "aa5518e8-c689-486b-9277-c1092d5967be", "comment": "Malware payload (Mirai)", "value": "bca80fcca75821995d40b815d2a8ff30c2b3a19b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929202, "uuid": "8538c571-edd3-4133-9044-e6aeb66fc95f", "comment": "Malware payload (Mirai)", "value": "6254a77f7f23409c61c529ee2a31a4f7bc9a0a557b4cb4a4a541d73952d5b28e3eee20634a3b5d6e14336964ab10e1bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929202, "uuid": "9c9823ae-1cb5-49ee-bb66-7a886794303d", "value": "T154533B35BA761E17C0D194B621F74B25B2B147DE26E8CA0B3DB10E9EBF71A402543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929202, "uuid": "0a8ba83b-0ced-4fcf-acf1-6ef20e3fd950", "value": "1536:9IYoqPFir/YcH6DreHtSIQNX75KtFhN7J:qCngKXVoN7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752929202, "uuid": "c6d6667e-883a-4257-a709-f34f1938b16a", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752929202, "uuid": "6e70dd99-c21e-4e31-8d4a-c24a8291c54e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929202, "uuid": "fa97848f-05f1-4d06-9bfe-759383bb204e", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbba3596-6497-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752926437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752926437, "uuid": "461b6733-8c27-427c-986e-e827708f30ff", "comment": "Malware payload (Mirai)", "value": "df7b00854470bbf893c41a7a8a43955c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752926437, "uuid": "4e6b4431-4d74-4c74-8b3b-714f7e4b13cf", "comment": "Malware payload (Mirai)", "value": "7851f99b928deefcdf9d9a3749beb3018765a864c7794518c063186f5727f7bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752926437, "uuid": "c9554bf8-9e59-463c-ad1d-f36b179439c0", "comment": "Malware payload (Mirai)", "value": "fc4af241d51e8907edb0e6c850621f9270184c27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752926437, "uuid": "96c3ebb1-bde8-46f8-82bc-2ceecbaaba75", "comment": "Malware payload (Mirai)", "value": "fee2f34d8101c0207f7ec94fb0d72d07255b06e26b37d88e227881cc4863cb4a93e4d61310bdb7dcd5e981a4a73ea5c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752926437, "uuid": "ffa630c5-8ccf-4ad3-92bb-73ab4444ba1c", "value": "T156338C66E81A6E18C0560170B9648F741F63F0C4D34A2EFB15EAC2B95493EACF519FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752926437, "uuid": "944cbe0c-68be-4eec-b989-15cdb3b14d96", "value": "768:jat1veCYyL2Eft5hLrtuhK8SpPHCHAnvKv57qaPXoDpdyBCAa8ZCfE1BJwnzI:jaPvb/Lzft3oOPTKv57dgDqBCAZ1wnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752926437, "uuid": "4d563626-e12c-4410-9e48-1f0e04eaa3af", "value": 51800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752926437, "uuid": "40e29c57-cbb5-458a-9eb2-9e0aecd8b9e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752926437, "uuid": "80dda56f-bf2f-4366-9d7f-03ff3ea688cb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d9be6a-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1752933062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933062, "uuid": "d8773b06-07e7-4a4a-b099-5e5389c7c021", "comment": "Malware payload (CoinMiner)", "value": "9700fc13a65bcfe4173f96508631554f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933062, "uuid": "d8807c47-8ac9-4887-bd0c-ee9cf10fdf14", "comment": "Malware payload (CoinMiner)", "value": "78a339ccdda10717f172f2c3b8c5028d1645e4bef2553c310048cc48474c77e6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933062, "uuid": "5dfd2aac-eb99-4bfb-8194-ce21f6a5568c", "comment": "Malware payload (CoinMiner)", "value": "4646a8568bbf2414f5ea179454a550d5a26c97a3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933062, "uuid": "ed0636b1-8cca-4df2-aeb5-cd898c6c836a", "comment": "Malware payload (CoinMiner)", "value": "75493e5a8a5e2f4ad526331f0454b6a4ef11c7fd1db0f91704beacc7491fc6ccad550f63b010b8bcaed28a6f592604a7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933062, "uuid": "fc6a0f95-5904-42ab-b66d-b2646c4eddd5", "value": "T128362391E69151EAF45B41BC8467A501F6B2B836C638FF9F1390E7334E17A903E36B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933062, "uuid": "3c684f52-7e00-4f78-935d-cd9e5531daee", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933062, "uuid": "a254bb77-2bfb-47bd-80e7-ae0113f056f0", "value": "98304:h8rdnDMnSWU1B2qZPrOCzWLUSejjclXdnDMnSWU1B2qZPrOCzWLUSejjcl/:6rdnDMnSWUTbKsWLhenGdnDMnSWUTbKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933062, "uuid": "03d16736-0e34-41dd-ab0c-a575fe38aca6", "value": 5022208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933062, "uuid": "2af532ac-0bae-4366-b1fb-2e2a89f47a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933062, "uuid": "833cd3df-d1df-4573-bd24-79ea82eefa92", "value": "OM8hqGX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22bdcdc-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925052, "uuid": "843db956-b4ec-4221-bdad-9888e1780727", "comment": "Malware payload (Mirai)", "value": "8db408e1a0807be55a11553046127a23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925052, "uuid": "a84d2b7f-bca6-49ae-955f-310a2ed18ff9", "comment": "Malware payload (Mirai)", "value": "791ae9cab92d44cbf9972d8a53ff72b8062965722fa28a9a229612e1db35d4df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925052, "uuid": "13cbdc2d-5ea1-4baa-bf65-22b429fcd293", "comment": "Malware payload (Mirai)", "value": "69cdcc316dc2e827210cfeeb5d11b0e38d6deb51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925052, "uuid": "c0a0ede7-f503-40d8-b8da-165b168772c0", "comment": "Malware payload (Mirai)", "value": "6553e8e2573dc82f6c72846aa820856514f1edc953d4de2313bd0037bc743f428613c72b6afd3b1339711e91a3066c8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925052, "uuid": "30f5d7ac-79e3-4b27-b277-db1ac18bb34d", "value": "T11273C70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925052, "uuid": "d6464e7f-4f87-41b6-96e1-a5940fa87ff2", "value": "1536:bpxe5qoct9fdlQBI6rZUEnUFndlBotYG9CJa101Dv:Fx3oANdsUrndvomgC4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925052, "uuid": "ae413c6a-5b82-4e28-9fbf-92b829f41fe9", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925052, "uuid": "24bc51b6-9859-457d-aaae-ac9b248ba5a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925052, "uuid": "9178a18b-b176-413f-9cb7-4380c05a710f", "value": "uYtea.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead57938-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919966, "uuid": "312f8dec-9ff9-47d4-b71d-f3dd88c5d153", "comment": "Malware payload (Mirai)", "value": "cb2ef6be6396e6916be013e4e9f9ceb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919966, "uuid": "d772a3a2-b458-41a5-9c61-070fdbb263b0", "comment": "Malware payload (Mirai)", "value": "79c902ccbb0c1c29380d282c12cc7a938f2297f356d330383bb9e3dc9a5a68df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919966, "uuid": "279eaf22-d693-4bdf-a7a4-7ae8f8f71673", "comment": "Malware payload (Mirai)", "value": "597290add1bd526a0d4fa875bc8b4a26b36bb263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919966, "uuid": "13eb93ef-02e5-48a0-88fc-66dc25b2fed6", "comment": "Malware payload (Mirai)", "value": "86a08b9896b38e5d1ab91b0b794650f3b12deb674064af7f731c854ee185b2a5828cc246b6afbba5e394c982247f649b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919966, "uuid": "c9cc0236-09b0-40c6-ba27-ca881cc4b26d", "value": "T182A37CC4F243C8F2E91B1570603AE73AAB31D269211DEA87D76C9931ECD2D41961BA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919966, "uuid": "6eef3b7f-37f1-4d27-9c79-662ce37d7342", "value": "3072:uCJAjhZP5d4YI8JiTA1nD2w9f4Wn4AOSD3fh:NJA1ZP5Ch8JiTA1z4SD3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919966, "uuid": "9d3793a8-c78d-4c53-bdc1-0f3ab1c944d0", "value": 103496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919966, "uuid": "30671b75-cbdd-4d5d-a98c-bbf7be7255ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919966, "uuid": "fc931959-947e-436b-a943-e492433bbe83", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d60799-647e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915284, "uuid": "571f828c-c29d-4647-bf74-75d247a3da36", "comment": "Malware payload (Mirai)", "value": "a7507ac23a3f7ff1a584845967221bda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915284, "uuid": "659e5659-a129-414b-a46e-d6c0db665f31", "comment": "Malware payload (Mirai)", "value": "79cc28400d7134481b6078ab8cc8b969590699ca0d078f4a1f8b1230759a8327", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915284, "uuid": "7c9e7708-c787-431c-a35d-a3e1385911c3", "comment": "Malware payload (Mirai)", "value": "9e791a2ceaf2af976a9d6623c121ad9b9ff8970b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915284, "uuid": "3389bcce-d4ca-4fb5-8c52-3b6e0408f219", "comment": "Malware payload (Mirai)", "value": "8f8b400400b5cd02b6682658e4e17790332cecf3f78fcb87cff104a5ad4c7279da8f59eb45ae536d21098859ddcc48b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915284, "uuid": "149706b5-f6ae-4ee4-b56b-ea6ae3e73b58", "value": "T1B263951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915284, "uuid": "b8119027-2b9f-46f6-ba94-754c00563f0d", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAl:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzmL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915284, "uuid": "4759cad0-c887-4bef-8bc8-f071b5700ec8", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915284, "uuid": "4fa9d706-9911-40cc-b4ee-fd8fb7a0b117", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915284, "uuid": "0669764c-632a-42b2-9f20-c26c14a072a0", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7976f5f9-6466-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1752905173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905173, "uuid": "52b8a0fb-75bf-44dc-8638-7cce59c45558", "comment": "Malware payload (DCRat)", "value": "7cc9c3cda2ce391109dde4102547fc5c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905173, "uuid": "da6f5578-739a-44d9-891d-db81738b31a6", "comment": "Malware payload (DCRat)", "value": "79f1e0a06dfd7f4abd9753989c6c177f3a9c9de57d62d44a7583721966d77852", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905173, "uuid": "8c34e759-ff44-4973-ae01-ae24e14c0667", "comment": "Malware payload (DCRat)", "value": "db68b5acfa1805631248fc68a1e305d8cb50731f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905173, "uuid": "e90b8462-8107-403a-be18-3943f7821fb9", "comment": "Malware payload (DCRat)", "value": "5ad4213ac7ebbf988ef780bfb85434ed28b31a7c74fa48591b4a5d0538e35577ceee05a63960e011a77c18762b3192c9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905173, "uuid": "73b4ca9a-1976-40b0-bfbe-c14f393de715", "value": "T103A5AE16BAD14F32C37057329597023E92A0D6313626EF4B369F54D6AD077F18E722A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905173, "uuid": "80a0fe38-ffc2-4483-846e-58058faeb8e4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905173, "uuid": "212b96d1-a6bf-4485-a3b4-52b60e44f5d1", "value": "24576:2TbBv5rUyXVGhNBYIyi9x5iEPqYd1iFdqQMSX3SKaEy9ZvATjbOKSvLLiOGQ33mh:IBJGGIySivQK3JnaH59YMcqCEj5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752905173, "uuid": "3d6d9519-7eab-4392-bb8a-7ab1d4d809c5", "value": 2237674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752905173, "uuid": "cdffd4e9-a181-4b77-8dcc-df16e9a2c055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905173, "uuid": "92a98f7b-169b-4688-a4af-2a0dc2639b3b", "value": "7cc9c3cda2ce391109dde4102547fc5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aed586a-64c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Hajime)", "timestamp": 1752946783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946783, "uuid": "cfa238bb-57f7-4e93-93ae-e0124b6fde1c", "comment": "Malware payload (Hajime)", "value": "6191112353a47af07c1ec51a0c4ca34b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946783, "uuid": "026256e3-5666-43a3-92a0-134280f3e0d0", "comment": "Malware payload (Hajime)", "value": "7a3c7d05422ad8ae24410b7366438b4922fc3e08442ed2c319c5225da0a0cabf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946783, "uuid": "a2baef32-49f7-4839-8ede-e140fca6de56", "comment": "Malware payload (Hajime)", "value": "31015e67d8573a6488d1a08aed662de17d2f0666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946783, "uuid": "8724a93f-e2c8-48b0-a68a-7a332f73f2ec", "comment": "Malware payload (Hajime)", "value": "e3ca6ac7edaf3570c1dd9898fad2237af0f19d928c472ee92efd49156b8852204856811b1724a52f7e7922d5f988fa4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946783, "uuid": "662cd82b-e490-439d-8f46-48784fa5cbdc", "value": "T17C53120233AA297196B14AF1E7FDBB88E6493D588FF66C15AC113D68F97235D1CC890C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946783, "uuid": "f6794854-ec26-416e-ae93-0e090c6f772e", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxL:yYI0ARqw1qAEv7UIFM8oJorFquyjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946783, "uuid": "ab7c426d-2668-4763-860e-f281ea8dd448", "value": 63848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946783, "uuid": "7dc0989e-d7c4-45b5-9c1d-d60c56cd3ae1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946783, "uuid": "ebd3c27e-129d-4c66-add6-4dc5ff3bf15a", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5ba07a-6470-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909389, "uuid": "98e51a3c-b23c-46fe-a480-6752f896abc6", "comment": "Malware payload (Mirai)", "value": "db6c64481c76a07adb8939fba35f01ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909389, "uuid": "61f513c3-ef48-4a30-8fcc-0c55f95652fa", "comment": "Malware payload (Mirai)", "value": "7b197c6685bf5752e0c669523d6612e66f1afb1005cc3fa767999dfa7ff7888a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909389, "uuid": "3e4fb7a8-4817-460a-93ac-8b8c7d408468", "comment": "Malware payload (Mirai)", "value": "c0ab5d8a20f9a4491022cdb9ea47c429b2b7d27e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909389, "uuid": "e19a8d88-66c5-431c-854d-6168cc3d2df7", "comment": "Malware payload (Mirai)", "value": "6d837c406716bd67c1e9548020960ecbc6e4f96d58dc99c869bbe742293ac5d3bb02dfd7068e9c9bed4a6b8e254d215f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909389, "uuid": "a2d1c8d0-4544-4a57-98d3-ef87079df7c3", "value": "T11A63F756F8814B16C5D102BAFE1E124E33231BFCE3DE721299245B7577CA96B0E3AC19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909389, "uuid": "e62ee856-b535-4be6-bab7-244e924d237e", "value": "1536:/wnCTyf2GVeDaORPsxNCbPamVmwceIFiF55MB3M7UE5TYb:ZyXV81sx0PaQ55MB3M7UExA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909389, "uuid": "e503b6d7-4aea-419f-b668-c3499f13f0ed", "value": 67020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909389, "uuid": "fe4e6935-6f67-4b8a-ab78-72d8576591eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909389, "uuid": "73fc4e43-ce41-49ff-a71a-7995c94fd34a", "value": "nexusnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5e4d3a-64ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752949683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949683, "uuid": "987f1594-c453-45ba-a8b7-0134b7f7f89b", "comment": "Malware payload", "value": "80fe0ac93c6d76f000d8cb1592760855", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949683, "uuid": "a29580b6-581d-4551-bb71-abe3df844ae1", "comment": "Malware payload", "value": "7b4e18cc58c458f89071c485176ede6eb615fdcf88ad66999c799435f0dd5d85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949683, "uuid": "a9d571d5-93f9-4a9c-8533-2f735c96cf53", "comment": "Malware payload", "value": "9654ba1bf195b7a30b34dde10a45532e9a7418f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949683, "uuid": "33a22188-f20c-43c3-ab34-b439d91105d6", "comment": "Malware payload", "value": "7607575ea82fad95d1cb712006ad87ad0e8991f18dda67c4d00333b2ba030066bc1aadfb2d59b6bc3bf1984addbdcafa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949683, "uuid": "8ab30489-a073-4c1b-9d22-998386e9d1bf", "value": "T166430956B9829B11D5C1117AFE1E224E7323077CE3EE73129E24AF2477879670E7A806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949683, "uuid": "62b99aaf-15f7-4b28-86ee-6a41df8fd959", "value": "1536:iunJCachTmv/4tDLFaq3LUXtMqi0EGSBS5wY6:hCfhaItDLFaqMEGSBS+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752949683, "uuid": "84c1cac0-0246-4c6f-8b01-78762746a910", "value": 55424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752949683, "uuid": "eeb53766-0629-4ecc-b0a8-ad4389dd3171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949683, "uuid": "19f508ce-1baf-46e8-9b2a-1f0e35f261dd", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1393007b-64fb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968997, "uuid": "86778088-9941-456f-b6db-dc6a6086eb9a", "comment": "Malware payload (Mirai)", "value": "fbb867eeb8e3e800be0d9e4ff6c9eafb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968997, "uuid": "dc0d9528-4679-45ce-931c-25dc1765ac13", "comment": "Malware payload (Mirai)", "value": "7bbfb8877aa96fa475e9f616868893dc4b7596e05dd44ec4f5e485af28958f9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968997, "uuid": "c5459d51-c7a5-4a73-8e1f-9238987e9f8f", "comment": "Malware payload (Mirai)", "value": "4df4b477dd152456b324dd321c7f729b4b309e00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968997, "uuid": "35e3abe4-e749-4a8a-bb53-b8aeadf1d55c", "comment": "Malware payload (Mirai)", "value": "a947ce2c0d080fcbc68220792ce3ee32362f0b87067891b02919a257bd8e57fb761f2fec57f708fc8c1084e518c83f43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968997, "uuid": "f79bf87e-f024-4a6a-b491-08d6e0ba3930", "value": "T120A3833F1B270E63C0DA217105E35272BCBED74834FC97979CE4686D6E1A9A830552EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968997, "uuid": "235fd546-ec17-4e00-89a9-990560e53f59", "value": "1536:K3ZE/QaS7s2D0/VSPpe+xtCg8sngez7fK:K3ZEoXySBhtCgYez7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968997, "uuid": "0dab2d7d-06d5-4608-9160-2b10dfa69ff9", "value": 104305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968997, "uuid": "bb05febe-aed3-4ccb-b998-c015c2b894de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968997, "uuid": "35c33639-30ea-41e6-84f7-78d1ed0cdb87", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37eb28c-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752907928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907928, "uuid": "6ac9a04f-7e8e-41cc-bccc-e7320fede045", "comment": "Malware payload (Gafgyt)", "value": "029f92b6f1d56dbcea8e41cc0a0cea15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907928, "uuid": "887d0a08-951a-4e38-9eec-00ddf762429d", "comment": "Malware payload (Gafgyt)", "value": "7cda7ba78380cde9dda7ff13f49d38544913184b3f96b4b0c50ae094f149c819", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907928, "uuid": "592d7aba-322f-4f74-aa43-37df61d29940", "comment": "Malware payload (Gafgyt)", "value": "48128c82c5d08c7fa4082d7b9bd89239c5451c6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907928, "uuid": "93b0adf8-c2c9-4ce4-90d3-8a8c95768ed5", "comment": "Malware payload (Gafgyt)", "value": "e7e91b695bf6fb38402239cecbdb451667b88f9c778fb55b968a25ca4a8b663b235dbd94222e703fd48348037ab3a976", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907928, "uuid": "b847c1e5-5040-42c9-8687-ceaa7de99bda", "value": "T1D593194E80A16DF7C184F5B93CB7E9350B0EA5456B1F1A96683E9631038F9CFA00F66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907928, "uuid": "e03a23aa-9847-4d73-a119-0eab5d80c012", "value": "1536:S05itiG18CQOr7vGG9nxH2WgZIECCG2hHqQM:S05itHRQiv59nxWWqIECkHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907928, "uuid": "b6dc26ba-04ef-4ebf-8457-3a8ecc6292a1", "value": 90680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907928, "uuid": "cb6e25a0-402c-48ae-9a3c-409bb7470808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907928, "uuid": "27ac19f0-0b9c-4f16-8710-1f87578600a0", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ca026f-64c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752947746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947746, "uuid": "d406d7f8-d845-4d92-98bd-06ea7c87e95f", "comment": "Malware payload (Mirai)", "value": "8824395e4339a9e9cea2bb1e87cd9221", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947746, "uuid": "3a110607-9a7a-4c70-a7e0-25846d6c6c3b", "comment": "Malware payload (Mirai)", "value": "7d6e0067be1beb10bc1c9976049964f5970a8ace8db721b41dd41865b577c5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947746, "uuid": "9b267a09-dd5f-4956-b5df-6d0fa2e056da", "comment": "Malware payload (Mirai)", "value": "a9e0033fd26a4b8341118e6373aab8ac4db79ae4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947746, "uuid": "a24f5b99-7b0a-4b48-a696-ce344ff9176e", "comment": "Malware payload (Mirai)", "value": "4e143361d62c1f7cb56835f2f89100f41f665765c74a504151de83fc828c28eb8a8042167ea2a9b1a32b10bc4292064d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947746, "uuid": "093eedef-177c-486f-a2c8-87b0b27202c4", "value": "T1A57328C2BA4BC0F6D91748704027F33FCA32E5798065C29DDF6ADE26DE376426216399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947746, "uuid": "0791a304-5d53-464d-8a1b-2647a7f598de", "value": "1536:VqUfXwO7et9RIW1/GIIbPvP7KLWqIdVV0ZpAtzery2w9:MBlIW1sv73XdVVgStZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947746, "uuid": "b98d1cf7-ea93-485c-90c5-9b4cb46c8769", "value": 76304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947746, "uuid": "9db7b1f2-fe51-4fec-926a-ca447dbff096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947746, "uuid": "115f3380-3dea-41bb-b2ab-07c3ccd27f3b", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb4e2cd-64cf-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752950383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950383, "uuid": "e8620e86-c58e-4064-b0e8-b7cc69d6d28a", "comment": "Malware payload", "value": "2cc98d9feed661fce33aa4461a585059", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950383, "uuid": "88b06c55-8bfe-4b3e-a7ce-167c234fe4d6", "comment": "Malware payload", "value": "7db1af9990efa57573fdddd2da9677722028746244c347fd041ff88f0b0cb697", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950383, "uuid": "f963d903-a406-4de5-b15e-5826e08b6c49", "comment": "Malware payload", "value": "6210d38e417c0e301881be6d983963c283d10f2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950383, "uuid": "62cd9bdf-3d8e-47c8-b882-f72d19e604c0", "comment": "Malware payload", "value": "8534699d1b5b72e0c0585547c13adfde6067b4b84cde025596371e2a4736e380b9db2cd14a11ea46bd77bf5028def5e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950383, "uuid": "3ed355bb-a0f0-43ac-8486-99497c364d75", "value": "T18D933A4F90A16DF7C148F5792CB7A9350B4EA5866B1F0A96683D9271038F9CFA00F27D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950383, "uuid": "93f57f7e-814a-4b36-aedc-62b4df5acc74", "value": "1536:FPBY2ZiTNoCcC7HkDCD95XTIAlEWjtZV/aC/jpnSDM:FPBY2ZGFchDq5XE+EWhZV/aknl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752950383, "uuid": "2c44376e-24b8-4ceb-bb19-6fa2d40a5524", "value": 90680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752950383, "uuid": "0c8876ac-d92c-48b9-95f4-c656785e587c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950383, "uuid": "b0208fdc-2a65-4a44-a5f2-4e27b9c77315", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa1278e-649e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752929200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929200, "uuid": "72b2f7de-638d-480d-a4ee-a0d0473588ec", "comment": "Malware payload (Mirai)", "value": "ebe58ca2265cfe6e17811acfac22b74e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929200, "uuid": "02899bcc-64da-43df-93db-5a42d3164f89", "comment": "Malware payload (Mirai)", "value": "7ded50fe6f9c022863e7ae498107bf3482c3b6a843efb6b156d9f503426e83e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929200, "uuid": "9c2e953f-c6dd-4a64-a358-cffc2979cd8f", "comment": "Malware payload (Mirai)", "value": "addb23afea79a28644b1de35c9d769c45e067572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929200, "uuid": "12fbbf23-03bf-4fea-bff8-5e42544ee989", "comment": "Malware payload (Mirai)", "value": "dbd4df791c488f07355f8e825eac93c406e571bdb4fa2c911fe54bebbf5938faa92492d553361ef925dcfc643950347e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929200, "uuid": "6799bc86-8f0c-4b47-a41f-a7b1a80dacc1", "value": "T1C7052344EF1EE34AC5FE23FF3F9257ADCE7318A1BB0A1592D9B05E6091B1618900B974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929200, "uuid": "0b5540e9-a3c8-4b35-8a13-78e3095798bd", "value": "12288:tvBgF1Z0nmfm1k4SlsLq7jZP+f3YnCIG7U8q7rW+cLNE4OhqBbLgeQ:tv0imfm1k4SWLqBGf3YG7U9NCNEuBvg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752929200, "uuid": "460e80fc-08de-4a9b-b1f2-6038d0cd33c1", "value": 851396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752929200, "uuid": "eb907d80-f4d1-4262-b758-c325db31c85e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929200, "uuid": "f296739e-791c-41dc-9e35-79691db7556d", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d6db87-64c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946105, "uuid": "bec4f744-c902-4348-8fff-a37f9a27d290", "comment": "Malware payload (Mirai)", "value": "5d36dc8d697304ae7a029d1ffa465c86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946105, "uuid": "737a4cf9-647b-4969-86cd-55cae86650cf", "comment": "Malware payload (Mirai)", "value": "7f26ee0d8e790c348371eb63466515faa140d9dca2277f5ff1934caa2304a758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946105, "uuid": "1f4e06b8-cdc8-4715-855a-1ec879dd8c16", "comment": "Malware payload (Mirai)", "value": "e8208eaf75bbad67815924fb9343505d9cdfb2b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946105, "uuid": "0ad4e937-7b40-4fe8-84c5-cd40835a411a", "comment": "Malware payload (Mirai)", "value": "cb6ecbe254beac4a642db3b985406bafe326ae26cb3849053bbda8030744cffdc8446985d62ad02bc0bc0c05be3ff9b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946105, "uuid": "fa18a30b-8f45-4f45-ad6d-3a1a8a477b2e", "value": "T1C9130956FC8289AAC5D01BBA666F524933B263B9C2CF3303CC585B4177C660F9E6BD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946105, "uuid": "a3396c11-3ca4-4c66-b287-3f55699ac6c6", "value": "768:FEEjtF7VeYauykymX2vA35zAmNPb7+ik0aItuo55o+xMuBN8ZFRgnazG:FfBXeYhXymzMmNPX+UaItuo51op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946105, "uuid": "bb9e0766-d454-4916-9c76-be0783214c36", "value": 44996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946105, "uuid": "90cf504f-4f1d-4ed2-af62-b9c92ee6b3e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946105, "uuid": "be42d7cb-77cd-4582-920b-493a64cd8c85", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25550aa5-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1752932949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932949, "uuid": "333f1696-9488-4bc6-a461-c852a6ed0f70", "comment": "Malware payload (CoinMiner)", "value": "a316c16bc1afa86ee5d47ecb3893f58d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932949, "uuid": "54b16d8b-bba7-4bdd-b546-f8e9c91b8f8f", "comment": "Malware payload (CoinMiner)", "value": "7fc6f8685d3ead471f5d3cb931d4084f351e490cc65af5ff85b6cd4054bb8c5a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932949, "uuid": "66f7e7c6-878d-4f7a-ba3d-7e8a93bc6b88", "comment": "Malware payload (CoinMiner)", "value": "ce11d1a331bad47c775453132ba64e207189dfdf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932949, "uuid": "8df9d840-1476-438f-a105-466fdf560dcc", "comment": "Malware payload (CoinMiner)", "value": "dc3142d512b2a41eb8d2498bc8cd1de5fde8e9df83f3a800b5389853f5da558359e08f28da12d5a13ddc0954baa89209", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932949, "uuid": "ee2cd250-0adc-4714-993d-e97449c07300", "value": "T10F16239293645F96E41F03B8782C80106BF1D83E65DEFF9B5D4476A93C233E29B02697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932949, "uuid": "297ef2e4-c1a0-48aa-bd89-91484229e854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932949, "uuid": "e37d714c-0dd0-4802-b684-d505a61124e9", "value": "98304:3SIsB5cY1DaA4lNChCNZ2Xw81FY/n9+Diayo:3SIsB5cYcplVNZMu/9+DMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932949, "uuid": "fd5eecc5-f037-4d97-8431-c2d9e096698e", "value": 4129936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932949, "uuid": "9746e2c0-1776-4c04-8032-a83dee790905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932949, "uuid": "b5decfd5-14c5-4253-969a-57b5ae152029", "value": "a316c16bc1afa86ee5d47ecb3893f58d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b7749c-64cf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752950262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950262, "uuid": "aa8191a5-5020-4a7c-a4bb-2febd00078b3", "comment": "Malware payload (Mirai)", "value": "0630b3e8abfbeabcb67fa9c340cc55d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950262, "uuid": "97fa9337-ec7e-4aad-b405-0f235306a8c7", "comment": "Malware payload (Mirai)", "value": "80308252bcb82d5fb693ac9c0139e05e2f25d66d9b54e98f799d20a8aceddaf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950262, "uuid": "cd4e08c5-2abc-46e6-8b28-f9b78a47c65f", "comment": "Malware payload (Mirai)", "value": "8d3be3bf28cab64a8f33fbf776aefdccadc4a680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950262, "uuid": "36780af7-27f0-4e67-a14e-eb5a15869e41", "comment": "Malware payload (Mirai)", "value": "0b5eead1aa0fc55a0dc0bc17f1ff246424d3aca44da6b1829f1367207dce9b7dfd2f27f485d95ddbcc39c14877cc2a0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950262, "uuid": "12d5dbea-a05f-4bc8-b1a4-35e751d2b1ab", "value": "T1AA04A8196E228F7EF768863547F78E215B5D23D623E1D684E1ACC1106F6028E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950262, "uuid": "7b2ac80e-4c21-468f-8278-6ecccc29acbf", "value": "3072:pvYdwzibMbuSjnvt86g5OB9DS/rqtA0NB9DHH3Vy9JUA:pvYZmHV86g5Oa/+qC97349JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752950262, "uuid": "661f2705-dadc-4d53-85b3-771e4d159bc4", "value": 181932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752950262, "uuid": "7a3ec852-73cd-45cf-bde5-2da0fb5a76ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950262, "uuid": "f33cc907-c238-49ee-8c63-a7f51924e470", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7039a020-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919760, "uuid": "00e36a7c-8add-48ab-99cc-2a5772576424", "comment": "Malware payload (Mirai)", "value": "f7ac8eb84c7f15e6367bf195944993ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919760, "uuid": "d6e647a4-68bb-43c7-9240-6a0c21757ef3", "comment": "Malware payload (Mirai)", "value": "81404ea762c319399364474e1df107da919a17cd4dccb34881f9cbc878803d85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919760, "uuid": "82f3a38d-1823-4d98-b5aa-0cd637892347", "comment": "Malware payload (Mirai)", "value": "e7d95d66ed228371c0acf0513e3773e88517bc85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919760, "uuid": "5c36d931-9180-48fc-8bf2-1e4fc3daa184", "comment": "Malware payload (Mirai)", "value": "e3c4075439e72362d0d1132d6e6723dc8b329e6f13cbeb4c1aea353f3ecf6a01d02565d590bbeb3e786e7ac45313c4bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919760, "uuid": "96bb6f99-04ba-4494-8e78-a87599708161", "value": "T123835B3179392E16C0D0A47E12F74758B2E21B4E2AE8CA1E7D720E0FFF55A5064176F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919760, "uuid": "dc8863f4-1b77-4cb7-9723-7242775bea4b", "value": "1536:oYfhONKUq1et03jRIxIfR3rS3SjHsw5JesZM3Ar1LhkMb:hhNZrswPr63Suk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919760, "uuid": "51c9a934-e091-48c7-aabb-cc874bf15c79", "value": 80872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919760, "uuid": "3d704eff-75eb-44a4-a4a3-d678e3a152ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919760, "uuid": "ab92a387-331e-409b-a711-aa9f17e402d3", "value": "UnHAnaAW.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ed6dec-64fb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752969357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752969357, "uuid": "18c9e4d7-71cd-4fff-843a-a0d070dcad01", "comment": "Malware payload (Mirai)", "value": "bd39dbff68229609228bf9f30e6b10a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752969357, "uuid": "8c96bc96-1f45-46a6-91b1-cc71972a5cfa", "comment": "Malware payload (Mirai)", "value": "823b25261ac3cb273513416c84cdf061374fd885fee72730f8df9bda684ee8a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752969357, "uuid": "2d51e97d-36da-41fc-90b3-58dcfb7cac26", "comment": "Malware payload (Mirai)", "value": "1247cb2b9c5ef9c645d2308d3d32ef601e3a2ae8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752969357, "uuid": "355eada5-10d4-4e37-a3bc-934dac9f25ac", "comment": "Malware payload (Mirai)", "value": "711b99f94343e77bf4469591afcbd9aca7c4fbb09246debfa968ab9610e73cb264d1cfe08a997e0f649998c034d69e66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752969357, "uuid": "e268bbf9-5a7d-48be-ad26-b9a0999d5172", "value": "T176E35B0A74D194FDC4DAC2B84BABF53AE932F05D1138B15F27D4AA272F8DE205B6C611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752969357, "uuid": "235be52e-73e8-4a29-8fcc-377dc99481d6", "value": "1536:ys7V1UJRz/+urWTFTxrzpFmGxqdLYF83zTQevv+P4OaRcgCn15BMa3sk:/VybhrW5xrN8LYF8Yevv+P2RcgE15ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752969357, "uuid": "06e1a17a-4922-4288-8ff5-18a82d19ed4a", "value": 144120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752969357, "uuid": "8fd1135f-6353-4008-b389-81d9f6db5039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752969357, "uuid": "7e1a2447-eca0-45ca-8601-e006531b8002", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15021db-6460-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1752902797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902797, "uuid": "2737a1ef-55da-4120-b469-6e346dd293d6", "comment": "Malware payload (ValleyRAT)", "value": "86efc1b768ebb93162e32f5474dbc2b4", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902797, "uuid": "55cb6f79-aa27-4d74-86ec-f0088b9b963d", "comment": "Malware payload (ValleyRAT)", "value": "82916434a344f6e94764683ac60475b00f2a8bdc3544f0dd86aa249f327f6197", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902797, "uuid": "65f8e748-2d3e-4f83-856f-d0eef841d26b", "comment": "Malware payload (ValleyRAT)", "value": "29d9e09c424b8a6768708fca0d1e369029a9a900", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902797, "uuid": "481288f7-8d50-4f6a-9d71-66ff425e6c7d", "comment": "Malware payload (ValleyRAT)", "value": "a7bde54ba9cdbc001f3dfc22a052d7f4d5db2963f70cceabf0005b9f8a851e216da3addf5e48252987ad0a4c51a1d4b1", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752902797, "uuid": "882a4e65-3971-41bd-99e4-3b37d60ebea6", "value": "T15FC518BE9E6E93CAC4BAC5F0B532E287F85034059576A7C767C0065C57235B0E8EB2C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752902797, "uuid": "a1f81abf-2d1d-40d4-80f7-137d56371296", "value": "5644e310c62722d746b2f6f87034a0c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752902797, "uuid": "5eaa81c9-3b7d-49b8-b136-35e810c52fe2", "value": "24576:VfdQ1VPrJV8cnyKq7kDRQWF4VLPSp7ES6sBxS3bil4k9TgUDnC2JjOQg4fuGBXTf:2qQssBxS64r+nj7uG9TzeSMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752902797, "uuid": "5f29ebac-213d-40b4-a1ca-8a74ed459ce2", "value": 2574760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752902797, "uuid": "9216d538-0810-40cb-a2eb-dc9da94d7ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752902797, "uuid": "0d4777f5-06a7-4658-935d-69a401a899e7", "value": "u7.18-Signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f9bd3d-6453-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AurotunStealer)", "timestamp": 1752897133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752897133, "uuid": "6b298371-0e89-40cd-8295-e6c00be59450", "comment": "Malware payload (AurotunStealer)", "value": "54c1a2996fa3f5f41c79018fcda15b39", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752897133, "uuid": "a1151a10-fbbb-4a90-8e61-3bd8625ff9ed", "comment": "Malware payload (AurotunStealer)", "value": "82d04762d34a17722a386cd7ba5363f134a662068b21ca690df23e3fcd10fa3f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752897133, "uuid": "b4da4cd6-dda9-45da-83a2-838c3d4097a2", "comment": "Malware payload (AurotunStealer)", "value": "fb6ab4cb742740b3f14d45ca0dd86f7bc3ea0e0b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752897133, "uuid": "102de8c6-0a83-4851-ac82-9c061d9483e9", "comment": "Malware payload (AurotunStealer)", "value": "076dbfd85009d777c2afaa476d865c4f13724f0584ff4b806d02b085fa142c4d4d9ebe99208eee932704e620ac2a5143", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752897133, "uuid": "d4ba833f-62b4-4aa1-b504-b3efa476cd19", "value": "T19AF52300FED198B1E0631AB65E397711A9782D609FB18EDF5780099DEB358C1D932FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752897133, "uuid": "15a46f8b-f732-4380-a6ee-f9df86f9d415", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752897133, "uuid": "c176e975-3fc8-438e-b7b4-c568ad7c252e", "value": "98304:F4AGl0T3RCVLASWCA2z3lsQQPX3GDnX3uZTExL:WALcVTz3lsr3GLOExL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752897133, "uuid": "375e4663-a95a-4bce-a0bb-50a1f17ee4e7", "value": 3364798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752897133, "uuid": "8735f510-5670-4f2d-b6d8-6b99d5697b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752897133, "uuid": "deafe432-79b7-4752-aa87-574e0b4111e8", "value": "82d04762d34a17722a386cd7ba5363f134a662068b21ca690df23e3fcd10fa3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752ae9e9-64c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752945109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752945109, "uuid": "28cf68df-ff16-40f5-8d51-35ebc8811fcd", "comment": "Malware payload (Mirai)", "value": "281231e1856fd1515bc7065a2d08077c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752945109, "uuid": "50c44f59-8170-46f9-ae24-bca39a9b40a5", "comment": "Malware payload (Mirai)", "value": "83150fb716236a81fcf0ac7199bbea2ee49a35af9c22c907f3668c8c19975b18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752945109, "uuid": "26866af7-e080-4ed9-bffb-3e9f7394cc3c", "comment": "Malware payload (Mirai)", "value": "30b9d35780f784dec5d0bfe5e6062b716740934f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752945109, "uuid": "cd0b7a23-d326-4f50-856a-01290a3b3ea1", "comment": "Malware payload (Mirai)", "value": "97772424a49c127894be1dd0eade236dd0f439f08a23b5b5dc55b89c10482bb9f4ad1efa52e2a5cb4868d4f4c98c6187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752945109, "uuid": "14b824ca-f56c-4132-aa6f-403e6d96d792", "value": "T129E34A1674D084FDC4EAC1B88BEAF43BD932F15D0134B25B27D8AE261F8EE215B5D660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752945109, "uuid": "5786686f-082e-4606-a967-e7a97797d502", "value": "1536:tmYKJiNvMTdoxSzn93+9ImlqjIf+8V3nU31Gv+e7t/Nz4rnFD6Jf3Mi7:TKndG0ZLIf+8FU31Gv+eNNz4rFDCMi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752945109, "uuid": "2c41db35-6c36-447a-a0f2-b74f26e3c273", "value": 143736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752945109, "uuid": "85db145b-5fff-4af7-b925-5b4f5a891413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752945109, "uuid": "8dd717dc-2f88-498c-bf2e-163bffb1105a", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02115d1-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925048, "uuid": "96a9d602-e3d5-48b6-a48b-983d1ef22592", "comment": "Malware payload (Mirai)", "value": "92957db23929a4aa0026f84e2628acd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925048, "uuid": "4bbf7faf-3e2d-47f7-a523-633afe0306c3", "comment": "Malware payload (Mirai)", "value": "8413b7a0c77712f2c52e146c59bcf0e77914f7336aad240c6e8be4d79496a018", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925048, "uuid": "bbff9359-3e0c-45fd-835e-762fd261aa2d", "comment": "Malware payload (Mirai)", "value": "5e7a2325decf52a947fd2f8f6b877732b6635915", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925048, "uuid": "2d5e1f30-3281-4ab4-8bc2-2654258969e9", "comment": "Malware payload (Mirai)", "value": "67822fe4b538246cb6a6b37add1fe456ecd8b1756c6bfba777487332f2fc740ff91f120a68b05c9a8a2fcc51256ef49b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925048, "uuid": "8d239b51-6712-4b58-9aa4-88e398cd2aac", "value": "T1AD632B95F8818B21C5D51379F92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925048, "uuid": "21e65461-6712-4a5a-96cf-2a0d989fd8cd", "value": "1536:hgnQFJAnXUV+5jneFjYG14ZVximMQoMBiFRf0a8K+Ja10zt:JAXUV+xn+jYG14sRf0a8K+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925048, "uuid": "34595e36-d867-4ea8-b6e5-11967cd0a878", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925048, "uuid": "0021b895-8c14-4584-96f3-b1b76e8cfc0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925048, "uuid": "a4a07083-5884-47a6-ba0b-b135b1e26495", "value": "uYtea.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35dbd2da-6495-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925246, "uuid": "7b94aafc-a26f-4c1a-b433-31498af0d836", "comment": "Malware payload (Mirai)", "value": "e18c9c56e61a09d5410d24c3ea449757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925246, "uuid": "a311a415-96f6-4a5d-9d80-524a700ddf23", "comment": "Malware payload (Mirai)", "value": "847e2e7a59afaf448b39c9f653931db382e3b64a20ae64f9c595d213dcd1a2c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925246, "uuid": "810512fb-1d6d-4291-b5ed-cbfaf75a0594", "comment": "Malware payload (Mirai)", "value": "3fdda4f917dcb70a7f940bbe5970621fa62a5abd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925246, "uuid": "fd1e12b5-eedb-4675-9261-df6647354509", "comment": "Malware payload (Mirai)", "value": "113580bc4260fc1f021b402afedc01223b8bbbe356790a0997ea9427454d63cb97999e8e4de995c6179e467aa8c9a328", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925246, "uuid": "3c119cac-9d4c-40ba-bd40-1f5cb0c0d034", "value": "T191C57C41FC49AA52C1E856B9BB7F828833132FB4D3DE75074D08CB342B9799E4EBA541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925246, "uuid": "99344d30-2db8-46ef-a9aa-a09e932bc4c1", "value": "49152:DuAAzxPP+KhN+OEua2kUpJSvPsxW731GY1BSsna3VF:DKXhc0aBwJSsxWz1GY1BSsna3VF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925246, "uuid": "6723b9a5-a9aa-434c-9888-ef7ef6853fc2", "value": 2737196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925246, "uuid": "5df7ac29-7511-4015-bdfd-084f02454270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925246, "uuid": "2f572955-8981-4a9b-9e10-e8243762e1d8", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432eaf0c-6493-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752924409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924409, "uuid": "ac6f2a42-6fcb-49eb-8b94-4f5a523476a1", "comment": "Malware payload (Mirai)", "value": "2782be911bf34ae296efeedd24219bff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924409, "uuid": "043704f5-3e1f-4e4a-9df7-799263f7a600", "comment": "Malware payload (Mirai)", "value": "85d0a0a8f6e490d799733d5cfa6aab5329b952ebb4cd59a719628e48de26e062", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924409, "uuid": "1ad4c8dc-2cc7-4416-bdad-4ba58303d164", "comment": "Malware payload (Mirai)", "value": "72969c11b5222699b9242c1ccf232285dee02d5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924409, "uuid": "89f95f44-3bcb-4034-92f7-88d3b062afe2", "comment": "Malware payload (Mirai)", "value": "546c306557ff522a1621b9dfd300da0ee23c447c1a58981cde8ea9c9bdf53e5505830dba3dc224bb6ba4d0a72bd5d112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924409, "uuid": "af310635-171c-4bf7-93cf-43bd47409bc2", "value": "T154735B1375C080FCC899C07597AFA236C473B47E127AB14B27D4EE16BD8EE611E6A6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924409, "uuid": "0bc98532-cba2-4c10-a06a-94f76b3bb9a4", "value": "1536:ZKV2CpcWaNTpROCRBF88SC171GX+LPR91XndvmkMRz:ZK8ZJTpRnl8y171GX+N91XnQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752924409, "uuid": "32244c37-c4cc-415b-83d4-ffc0fa991dad", "value": 78720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752924409, "uuid": "a5ee59a0-3fff-489f-a342-52b6ed4cd417", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924409, "uuid": "9ced0688-b3f2-48f1-befc-9a8bf6fa21c0", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e70ab1-64ca-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752948041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948041, "uuid": "fcadda28-fcdf-4521-bb3c-2bbed09c12d4", "comment": "Malware payload", "value": "cdc0ab23017a653b82b01bde63610b8c", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948041, "uuid": "ffa80ce3-1046-4243-aba9-6b9773820868", "comment": "Malware payload", "value": "86bfae543a957c26d0e89bd38c607b93d3449cee87c309e8bec5477f20388959", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948041, "uuid": "e5d70da9-66e0-48bc-8769-394e3c933ef4", "comment": "Malware payload", "value": "286450d41b3c1cdb65bc87e7973c94139a826609", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948041, "uuid": "f12cad02-b13f-4cb1-af0c-48de03a59356", "comment": "Malware payload", "value": "fda884c72a636af43117460c22a43450bc7eae13baec08e0dcf0e4b475e5cd9dbe908fad22e69e13e9fa0461efe75ce1", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948041, "uuid": "4abda72d-da08-4916-877e-d707d1914fe2", "value": "T1A556CF53A14C0299DA1A817C81737F70A9613DC27B2159FF127C7A6A3E336E70F3A616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948041, "uuid": "74035ad4-ada9-4c2b-917b-0af72f97abd5", "value": "452c9d151cd05e90fe1d91b7e44bff20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948041, "uuid": "2d84be5c-4edc-472c-8428-f6344f88a959", "value": "98304:9f+i//T2kVXh0ghqjMjMGBg4ToI+B8wid0R3gCvVCSGE+:p+s/T2eFncPOwiqOCdBb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752948041, "uuid": "ce1baeef-817a-4a43-93bf-b893467e3100", "value": 6404608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752948041, "uuid": "ab0f4ba2-3490-4a0e-8bd0-cf8be9bb82ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948041, "uuid": "f4e44174-993f-4676-b6a3-4efce2dc3ff5", "value": "86bfae543a957c26d0e89bd38c607b93d3449cee87c309e8bec5477f20388959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1eee58-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Stealc)", "timestamp": 1752932959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932959, "uuid": "291fbd51-312c-49cd-ab7f-7cfa1dbc85d6", "comment": "Malware payload (Stealc)", "value": "ae10e73223972431de9b7ddf26fe89e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932959, "uuid": "6e34cfed-c025-4976-9fdd-8b3a5f57c894", "comment": "Malware payload (Stealc)", "value": "87c0353f123dd8ebf4b7f543dcdd854aa9ae2b968284eebea6d09dd2748717ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932959, "uuid": "b8f80f93-d5a6-4a91-9516-6aec1a8e5383", "comment": "Malware payload (Stealc)", "value": "62a947cf3b7cc735667ac28c5f273c0100b5d42f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932959, "uuid": "a5e8374e-a6f2-43b9-bfa6-75fa685dec8a", "comment": "Malware payload (Stealc)", "value": "8533d883165e8773b2e032bfa5debc7247bade0311445099da8a5d916683f6650c120501128a50b4e7e23fa5f1c929b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932959, "uuid": "3350a09f-d754-4505-8438-095c53277925", "value": "T1EE75010AE66154EAE96710B989636641F07778268734EFEF13D8E2731F237D05E2DB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932959, "uuid": "c74a81e3-b92f-4f25-b027-8fbd9afcf981", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932959, "uuid": "365bec21-50cc-4652-8413-59e03460ab6d", "value": "24576:GagOdyCGcoTMukPJY81mUJO65HBaf+WeSY81mUJO65HBaf+WeU:XgORPGOmq0pedOmq0peU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932959, "uuid": "642b9269-a583-4243-bc15-023b9082817a", "value": 1586688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932959, "uuid": "b24d7762-e3b7-44ab-8d5b-67491e06160c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932959, "uuid": "e16cedc2-1439-4191-a496-f9b5ed32c073", "value": "ae10e73223972431de9b7ddf26fe89e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c35ea9b-64c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946785, "uuid": "7a44c339-0994-4bb9-91a4-40289432619f", "comment": "Malware payload (Mirai)", "value": "95ef8d539286c12a92b86a696e7d6a26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946785, "uuid": "979f9f6a-c1b7-4222-8168-0a5c98091009", "comment": "Malware payload (Mirai)", "value": "88f866570b6d393287a7fd8261aabb61a5962372196362b44d96fa6b5c2dd9d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946785, "uuid": "f38bdccb-d31e-45cc-9105-9f66ec38a61e", "comment": "Malware payload (Mirai)", "value": "0db404fed24dbe9b21263b94da2e24c55d89091e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946785, "uuid": "4c256417-6d0a-440a-bddd-228947175f42", "comment": "Malware payload (Mirai)", "value": "4445a19b4c72080d3bb7ccd86854e576677c9654c62adee93cedf160d2d6298125b8a1e65998c91a2c9272e79ab1eb92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946785, "uuid": "48fe0232-ddd8-4872-9243-d5415fd0a28e", "value": "T19E51A78408D78276AC759F37F9AB8268349E90DB79C1AEB244FD3CF1444DE045896E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946785, "uuid": "17ff398e-c900-485c-9c74-7ed5e917d543", "value": "48:S1dyd81dAdK1dYudY3df1dFd01deMdexL1deRdeUu1dvcvdvgj1dvBdvp+1dvqd4:Sr28rkKrvArb0re4exLre/eUurvcVvgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946785, "uuid": "e8c50483-ae74-48b4-9d1a-315ecdc625e4", "value": 2808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946785, "uuid": "4ae2978c-bc02-4817-ad2e-fe73c45d8fab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946785, "uuid": "75ffad6e-5f48-40cf-b9f1-dbc08cb35320", "value": "giga.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0714a16-6450-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1752895816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752895816, "uuid": "54971f97-67c8-4151-8b1b-f492d0af67c1", "comment": "Malware payload (ValleyRAT)", "value": "68cf77df91ca3f38baee59466c5fcdf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752895816, "uuid": "1dc47183-f233-4283-8c6d-6b5bd30c4f7d", "comment": "Malware payload (ValleyRAT)", "value": "89567d3449c95758e72da6f0a448464f01d57f00a94168476087c5e045a3aa4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752895816, "uuid": "0d18a5c1-0982-47c5-94ae-bfcc31ec1bc6", "comment": "Malware payload (ValleyRAT)", "value": "a1eff0f5ac53339a4dfad678aecc7d44c57635f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752895816, "uuid": "a46b905b-02eb-4259-8e74-493a9b7db50c", "comment": "Malware payload (ValleyRAT)", "value": "df12018748a298b34a65e87a9be6ed9eb9a6f6f9daa634c83e95e381377339a32c98724495230c19caea3517bd8a6e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752895816, "uuid": "270308e8-d950-46a8-b82f-5e167a39faa4", "value": "T1473733ADA0679DCCF8F0AE37D8899348CCB7B85547644A332AB80B505F1F2505EBDB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752895816, "uuid": "54c457ed-b126-472a-999f-b1cc8bf98016", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752895816, "uuid": "13f58be5-56f7-4adf-a3e8-2d74d927b480", "value": "393216:ScqwjRe2B4QM8fS3cHb4qO5vUE6W4/oRod/SE4Y8oSRdQ1nmsVDSnsx:fa2BY8fBLONUEx4gRoxioWwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752895816, "uuid": "d554fbc3-986e-4027-9d81-9df298592e9a", "value": 23336977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752895816, "uuid": "c80bb0dc-3708-4f7c-ad85-6831440cf2fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752895816, "uuid": "515f78d9-b843-4b38-b0c1-b3a7f4bbf731", "value": "68cf77df91ca3f38baee59466c5fcdf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6f0d6f-64c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752947541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947541, "uuid": "720da5e6-904b-4060-9966-f4a61e63de0a", "comment": "Malware payload", "value": "f698272af5c7fef4f084f1255c531e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947541, "uuid": "9bc5da9d-236b-4f53-9c5d-36df3b26fd7d", "comment": "Malware payload", "value": "89e3859c2b85c50bedc4ee804560bbcb29a531e701b96aee4bdbb51ca3523ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947541, "uuid": "ac214c5f-fbcd-4850-b5fa-27934962b919", "comment": "Malware payload", "value": "05ec37bc01a4ca93f7fc64a7d1f0d1cffa5efd23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947541, "uuid": "ef29268e-4cdf-47cd-a2b8-fa4b0f887c48", "comment": "Malware payload", "value": "0ba166839d8e4ae444cb513082ee7dc0d631d09c3860835498374bf448e4a48b6846038d0171b5c9c84947ad467428e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947541, "uuid": "182e342c-0420-44b4-b0d9-6c9a75d57fb0", "value": "T176E39D0131A1816EDC2CB0315B17C47866637C3EA9B9AA5632EAF34A1E7F8D54C6F137", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947541, "uuid": "a6a48bc1-4482-4079-975c-0005ace0da8f", "value": "d2c647938544dcf356106e528686a3a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947541, "uuid": "b625e627-5720-4aec-8051-0fa810791ec8", "value": "3072:DMvyJAjfZFrAVq9owvYyNeab6Ty+yUQvEaDqM:nUhBAi7blWTy1tz+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947541, "uuid": "a2f5d145-0bb7-4984-ac57-837022a608de", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947541, "uuid": "0d44593d-cd0b-498d-8a24-554a19dabcdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947541, "uuid": "bbe401b3-4e48-4beb-bf8c-4a8b00c552a7", "value": "final.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2164f92e-6497-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752926071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752926071, "uuid": "185f24cf-379c-43b5-93f0-2d2e13073954", "comment": "Malware payload (Mirai)", "value": "d88e9982485a114a50f11377e6f4fa0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752926071, "uuid": "ff8df405-8d4f-428b-8f48-916e5c151a22", "comment": "Malware payload (Mirai)", "value": "89eee2ce131f15c99e96944275378d1f669b19a9a122b83de6c6a016328fed6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752926071, "uuid": "bade75d1-e608-42b3-be7e-1a4830b15bbf", "comment": "Malware payload (Mirai)", "value": "eb2b99bf2670f7a963ad97980d62dbc9143d7003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752926071, "uuid": "250aced0-31d8-40e8-b25d-61ba6c2b3c43", "comment": "Malware payload (Mirai)", "value": "648f5e7cdd834c2480249efc1d9ce683909bd224e3031073d12c7b920c7508d58bc1c66c804a7a558726c454725ccf7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752926071, "uuid": "aee32ea0-e3e2-4364-9839-a81fa99eb287", "value": "T15C0523742125AB1A925F15F69D7A0BE7FBE532C6D02A1CAFBC70ADD34031DCB8921790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752926071, "uuid": "192d5f23-39d7-43d4-a3eb-ea54cfca2897", "value": "12288:y/OUvz8A2869Zr4yyfF8Bqzn4AJtcGVRws8Vvn3cZNT/caaUJ7P8T6LES7v01tSs:7UAA2cyTBWUfVVf3cZx/DaUhiSz6td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752926071, "uuid": "ed9fd569-a30e-4994-b452-834d845d0ab0", "value": 835000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752926071, "uuid": "f0512edc-65fc-495c-9f4b-00535acf7f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752926071, "uuid": "2aa81b5f-644a-4c93-a0ea-d267a7fe6af1", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b77bdb-6495-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925538, "uuid": "26ae590f-76a8-4bf4-8c93-df8cb32b04b7", "comment": "Malware payload (Mirai)", "value": "4d8cf5dbba3a0b91855cf4ac3f8fdd5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925538, "uuid": "ee274712-00e5-429f-bdd2-2b7d77b4d15c", "comment": "Malware payload (Mirai)", "value": "8a06125f093b3aca145ce598b4ceedfc11c55d6db4bd320a824a095c2b18faa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925538, "uuid": "b08fb163-b0de-4d9d-9a83-afc225afdf33", "comment": "Malware payload (Mirai)", "value": "304ef86d1840fb259675454ade48515c22bb35e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925538, "uuid": "50124645-c4e5-41e2-9649-a6e54e55dbed", "comment": "Malware payload (Mirai)", "value": "2d1372812234b7ff943c8064cb417e22fd0d4e73153e20758470fba0c8fa1fccaafb6c8415ab6d87df7d8daa30b882cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925538, "uuid": "a35cc84c-5b7f-474d-8f3c-8775a9cf4665", "value": "T1EF05335E5EA0AFC9DC354C1453F4823FD25E5C856C12A7BBA01476A2CBCB856B0A8FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925538, "uuid": "f16af12e-bd3f-4364-a8da-803dcb284109", "value": "24576:KsrRFtOu7J6SBV5I7CKKGN6A/pQlhCz76pi9dSGZLI29wE:1rZFJ6AHIm3o6nlhCf6mVl9wE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925538, "uuid": "12e72b43-fe40-47ca-b5b3-ac96119c2f44", "value": 836388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925538, "uuid": "ddaf34e5-a1e2-40c6-88d9-d46b1a09f94e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925538, "uuid": "b4ddc00d-25f9-44dd-a4fb-857859e6e99c", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61bfa59-645d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AurotunStealer)", "timestamp": 1752901517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752901517, "uuid": "cc0884aa-abe6-4292-aaa9-edcb6c06b4da", "comment": "Malware payload (AurotunStealer)", "value": "4cb103eb4d55ce1f74d434e9acc1e8d2", "object_relation": "md5", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752901517, "uuid": "6d10d99a-d7e8-467e-aff6-2801773c9054", "comment": "Malware payload (AurotunStealer)", "value": "8a340724e426da456a100671b80c0c59324178ef80456eaf64f266b2e8dbd789", "object_relation": "sha256", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752901517, "uuid": "3c749cb4-8b46-4d19-a938-2198d6846802", "comment": "Malware payload (AurotunStealer)", "value": "18d668720f13150282f2d1592115130e18b7043e", "object_relation": "sha1", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752901517, "uuid": "45ee835c-4214-45a9-a52a-cad3fbf2cae2", "comment": "Malware payload (AurotunStealer)", "value": "ba46f6e759c64292fdd4e0826efff09b3888ab218b49107ec803756a3c523b3907226a627c041901732aa3b7b6f86fad", "object_relation": "sha3-384", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752901517, "uuid": "b0653480-f634-45dd-b4e8-640ca3e5911c", "value": "T1C607BF6AB2BC00D9D47BC078C9569617E772781913F047DB26A496E92F23BE03E7E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752901517, "uuid": "2226dbd5-5691-46d8-88ca-7c986e895ce6", "value": "93ec50e27f8fe7b6fd4ec878be75072c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752901517, "uuid": "0ac5671b-462e-4a7a-bf9e-f90810170ac9", "value": "393216:i/lSc3zC9bU8pzlT4EcDHoC6x8kw04rkrjc:Ai8kYrkrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752901517, "uuid": "73610e15-7194-4d42-80ee-5f2520a4a2c2", "value": 16804504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752901517, "uuid": "6023026d-d380-490b-b706-2449cad031dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752901517, "uuid": "3da0935c-409f-42e2-ad2c-e8ad9ce9fc28", "value": "2025-07-194cb103eb4d55ce1f74d434e9acc1e8d2bla.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c69221-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907930, "uuid": "26a04979-b0cc-49f7-a26d-ee28f81af4dd", "comment": "Malware payload (Mirai)", "value": "4086445eef72a4693aa45bb555408616", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907930, "uuid": "32a91d56-2fb0-4423-8026-32c6a79267fd", "comment": "Malware payload (Mirai)", "value": "8a8259b87906be3a3450e7d78ab7a0a45b7b10f40cde965326fcad1c7102e0b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907930, "uuid": "9aa17959-91b6-4443-9a57-1b681b8c6366", "comment": "Malware payload (Mirai)", "value": "32da11c58453148875accdc2055d1c38e7d4dbe1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907930, "uuid": "0d1d8b8c-849f-4c15-9dcc-fca138a7c9b1", "comment": "Malware payload (Mirai)", "value": "af9b9c42291d758d53a12efed819e7c61a29dec50fecbc320d663a01218642b487506243a9f89b7f41c1833a7f636d19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907930, "uuid": "420a8868-943d-4afd-9d90-d80bd905e688", "value": "T1CAA38389E924937EC7E17BFEF75906CE3B390A68B79333155A3559A03BC8B50AD39010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907930, "uuid": "1c1b6c40-8c38-4eba-9b51-16f9c5fa75c6", "value": "1536:v8sO241vyU+vfTpWtm+vgy5EqB9UJ0ZrhfxcnQ7Dv9TTD1a6JJNTW5:v8sc1aUofwm+vgy5EqnMWfv9TTQ6JDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907930, "uuid": "d7581cec-3422-4b80-a898-8af8a30ac65e", "value": 105708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907930, "uuid": "15bd9ca4-80c9-4c25-aa23-af5b3bd79793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907930, "uuid": "6b4d76ff-25f7-48a5-8f55-638fc36c2c77", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f9e2d1-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907924, "uuid": "1941ae44-b1eb-4f44-8e94-f7e2ed2ab135", "comment": "Malware payload (Mirai)", "value": "01c9f23510b9bdd6ef063990471578b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907924, "uuid": "56146086-244b-425f-9183-4c11842b96f2", "comment": "Malware payload (Mirai)", "value": "8c23c73b31e1f43345f5d893bd45d017da58d899177e796da1331979a3da1e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907924, "uuid": "cd8eca0c-3039-49a4-a6ef-401de94efdff", "comment": "Malware payload (Mirai)", "value": "182e2bcccfb7f54b29e4267352b6a4e64f19a9b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907924, "uuid": "d89d5c5f-7b10-4b36-9ac2-38dcfbe8822f", "comment": "Malware payload (Mirai)", "value": "0f910df1481b6d49809cb2af0fa68bec0d444514942226c5d73c6cdde09ca598aa6ec71ee40cd3a019dac4b5e6437fa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907924, "uuid": "f77e3d2b-559a-4425-a55e-6e3d03ca1382", "value": "T1B9730704E742D6BBCA430FF50157E8EB5634A9294A29CD4AF75D2C78F73388472197A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907924, "uuid": "6c60e37f-2d02-44d4-9618-f460d9e07c88", "value": "1536:Hb50tFaFGSQVg3p/0KNEXSEWyMfq2VZF8l:Hb5SaF/h3p/ZEXSk2TFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907924, "uuid": "79d61273-a91f-4f08-aaca-104570c75120", "value": 74404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907924, "uuid": "bcf6a00d-3020-462d-8f88-0815e8bf74ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907924, "uuid": "e0cd8d9b-e381-4406-8d63-1b4eb38fa899", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69222ac6-64ee-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752963557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963557, "uuid": "96d4b4f2-ddba-497b-80d2-727baa5f51fc", "comment": "Malware payload", "value": "4cad308528929a8d20143c8f634cfba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963557, "uuid": "1c34783e-f6f9-43b8-882e-6de3bedc8c6a", "comment": "Malware payload", "value": "8c8965147d5b39cad109b578ddb4bfca50b66838779e6d3890eefc4818c79590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963557, "uuid": "e0088449-f676-483e-9361-2672d984a44e", "comment": "Malware payload", "value": "739d4a37831d94b35b5140e7acdee6e75d3279f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963557, "uuid": "689f2f85-cf20-4db0-b59d-78fa67983fad", "comment": "Malware payload", "value": "f9eb0ea69fe1f1c8cb6c3049d78c64a43dab5c873c8f7fdaa86fb40afc434e777638df1a9523e4ec7a0e1c91e1bd6809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963557, "uuid": "816baa23-b1c0-46cc-8468-c0ea219d41c2", "value": "T19D651846D6BD00E9D1BAC138C6036737FA71385D8334B7EB57D58B921B22BA4A63E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963557, "uuid": "eb9511e7-7a26-4fd7-a605-af1df419dfe5", "value": "7dfaafb6717c0c025ae207a32e8ca712", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963557, "uuid": "e256ee9b-8111-4874-b5a3-600a4cdc2df1", "value": "24576:SoclQsVD8oAQLP4bwQUHA/hXDta8li7ssiZfr2nd/0RmFyrOrAyyVabgBcz:SoclQsh8oAbNUHA/hXhabssiZT2nd/0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752963557, "uuid": "01cac948-976c-4f3c-9b4a-b51130d04ae3", "value": 1462784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752963557, "uuid": "e3347fb8-7372-4073-b3b1-5316c3023b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963557, "uuid": "14865dc5-11ad-4fd0-954b-005871c691f1", "value": "8c8965147d5b39cad109b578ddb4bfca50b66838779e6d3890eefc4818c79590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67823af-64ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1752936307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936307, "uuid": "f2f02887-b423-4980-b98d-7761dba66842", "comment": "Malware payload (RedLineStealer)", "value": "c42e90febad7fd950408e8068c3757ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936307, "uuid": "548fbf7c-3e15-45b9-a98d-9c38947f2891", "comment": "Malware payload (RedLineStealer)", "value": "8d022c8c88bd10175a07d7bed6ed927259d0dc1ae7263875710c568f723156e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936307, "uuid": "536e6634-e87b-4176-8548-9cc75fe2087a", "comment": "Malware payload (RedLineStealer)", "value": "94045dd26b4c90610f958f06c335e24167a123f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936307, "uuid": "08416214-76b0-447d-853d-4f485754fa05", "comment": "Malware payload (RedLineStealer)", "value": "74ad614c496718b2d6a2ba90f3703e5503a11818dc571db7f2bafcabf6e9b0b78690d16d245852a6c446b54e0fffcc03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936307, "uuid": "b07333d5-b3a6-4a3a-a400-73849034f467", "value": "T195A36D2067AC9F19EAFD1B75B4B2012043F1E08A9091FB4B4DC164E61FA7B865917FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936307, "uuid": "bfcb4ea8-fe00-457f-a67b-46f6212e073c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936307, "uuid": "0827f918-62e7-4c1a-96cd-68caf730c8a2", "value": "1536:RqsqFqJklbG6jejoigIg43Ywzi0Zb78ivombfexv0ujXyyed2ztmulgS6pE:/6ScYg+zi0ZbYe1g0ujyzdrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752936307, "uuid": "38aa5573-dfc7-4b5f-aeef-31a50a67b957", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752936307, "uuid": "2dfc6e76-fcc4-47b4-aabd-f901f4591eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936307, "uuid": "84d59207-25b7-479d-bbb0-bd1a1c870dbd", "value": "C42E90FEBAD7FD950408E8068C3757AC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997d36cd-6461-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752903079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903079, "uuid": "5f21de72-9867-4b20-a6c4-2e35e9eb44bf", "comment": "Malware payload (Mirai)", "value": "2a75de8e4e5b017f3aedf72fb596f853", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903079, "uuid": "ae0e2c77-4b0f-44d7-9e8e-e844c9e8eae9", "comment": "Malware payload (Mirai)", "value": "8d0af76138227f3037447f4b9a9d653c6f05f683eed73c8487ae30efe315addf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903079, "uuid": "dca7fb5f-9f33-4bf3-8881-8f547c0ff7e2", "comment": "Malware payload (Mirai)", "value": "5cffec56bdc8c9da7d502ccd4a8aa46e14f91f43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903079, "uuid": "2218860d-de6c-4b21-8a93-c5e425f5dfe8", "comment": "Malware payload (Mirai)", "value": "b50c78da03515696a8aef8b6073aff4f6d4479a85229b8029efea4003e3e0df092052b9da59e96ce78fd588430c90acc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903079, "uuid": "d9917975-ae24-471e-9641-0a8251808332", "value": "T182E32A56EA418B13C0D62B79BBDF424533239B64D3E733059A28BFF43F8279A4E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903079, "uuid": "6daf61b9-e59c-4414-bc09-b833f8989d5e", "value": "3072:C8iyCHJmCi+hHa24EGEwgdkvEMxYuBr/aFtUxlS+5DtM/9tJ1TPmgWe93oS:CiPwHa24dEwgdksMzr/aFtmlS+LM/99h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752903079, "uuid": "8774ac55-45a9-4f85-a41a-2f306f4ecf8b", "value": 152757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752903079, "uuid": "4ddd60bd-c15e-438b-9cbf-60a88416c2e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903079, "uuid": "a1217cff-094f-408c-a72b-b1e00454533a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b9da1c-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919775, "uuid": "e2941cfd-fc6b-4a76-8cea-2bd5dfc67113", "comment": "Malware payload (Mirai)", "value": "269a2d38652c4a6157495ab773ff1248", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919775, "uuid": "1e257862-4726-4ef8-957b-4163faf22e41", "comment": "Malware payload (Mirai)", "value": "8e8ae83b006e68a67e219c89c56353c16c792cfda62b759ac9a06e061de62d7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919775, "uuid": "60df917e-289d-4bc5-8d63-55d15c99ec2d", "comment": "Malware payload (Mirai)", "value": "607c399e92add2a221bf978fd11ab740d43a2342", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919775, "uuid": "5c826e38-22b4-4535-b521-6ad97f2ec39e", "comment": "Malware payload (Mirai)", "value": "4d4ddf48b7223ca392ebd0318c1f4fc1978542f43e63db8c0626fdc7b55cd60a3beb927520e4e51927ab48405364bdbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919775, "uuid": "6dab3729-db4a-42d7-97bf-6a6a6cfc22f7", "value": "T1F783F79278C29A16C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F0DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919775, "uuid": "783ff603-e482-4cb5-8e57-3760c5275bbd", "value": "1536:ssCvlPf6NDyL9Jb0+pHXlzPhha0xT458n6ahWNrPEKW5DnHM35TfC:ssCvlPCuTxC8n1hiRWK39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919775, "uuid": "5a7f4eed-d4ca-4bfd-b0fc-103ca54e4ec8", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919775, "uuid": "53030ad0-0cf8-4501-bf81-6c3d2349edff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919775, "uuid": "499d493b-f599-4c7c-8fd8-f4523fa5c2da", "value": "UnHAnaAW.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de785879-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907920, "uuid": "53e46045-41d6-49cd-800b-1566607ddf8d", "comment": "Malware payload (Mirai)", "value": "6394c7f8c5e3a3105c20cf84de3f1b97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907920, "uuid": "7b8a5101-207b-467d-bcba-e16e6595ec76", "comment": "Malware payload (Mirai)", "value": "8ec5400d8e6eb6179d593e39eaa6bf82cf49df950b9d3cda18883b39d0fbfb80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907920, "uuid": "b6b9086a-38ef-4472-94ab-522d0a05efec", "comment": "Malware payload (Mirai)", "value": "04168846dafd02f10746bac08af8722a8d2bb54d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907920, "uuid": "5f4aa54b-9d4a-44d6-809f-ac520f61eb4a", "comment": "Malware payload (Mirai)", "value": "4e91e938adad4e6ab8b312d616001a26cc3e43dbcbaf579d5ff4e3368638b9ef795159d162e960c40776603d33eddb0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907920, "uuid": "9030488d-2c14-4115-b092-85c3a8d3ddba", "value": "T1A5C3B34EE928633EC3E12BFEFB59429E373A1B58AB9733258B3546752BC4B145D38110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907920, "uuid": "8e9ac2d0-155d-43f9-82e2-a3b1b5e86082", "value": "1536:vdnl1hynjmoTypg6f7L5xeMIwj+QQ0V67X5S288CojMNiGV9L2Ymg16g6SJ2:L1hynjwG6f71xeMIh5S28tV9L2YmgQJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907920, "uuid": "0e823f3b-2171-47bd-bf85-3793271d0944", "value": 123081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907920, "uuid": "6452139d-e4f6-4690-92f3-830c36e289b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907920, "uuid": "6e97ac53-60ff-43f8-bfdb-24e4a0598a83", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dd13fb-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919765, "uuid": "4a7b5650-9d9e-425d-8057-9ae59a6e964e", "comment": "Malware payload (Mirai)", "value": "0bbc0b265e36dd0762f4cb889c4ad09c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919765, "uuid": "478cead2-6f1b-4048-a1d8-7d4cd4c9f1ac", "comment": "Malware payload (Mirai)", "value": "90085d6ff8095c43c8c84803aec82f496d2163fbfb531145f33b861ba9da16d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919765, "uuid": "cd8464da-1812-47d4-a81d-399f0487c1a1", "comment": "Malware payload (Mirai)", "value": "4256a1f5b141c5cf33db0eca5635fd94f12f5b71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919765, "uuid": "6c7634be-6343-4fe8-84f6-970b97c8f03f", "comment": "Malware payload (Mirai)", "value": "a0e434f9a7a86ce714473c5e96098f6d2c404995838b3db3b12bf9b11a618e660c4092fbbe249820a6dc27f557bc1bcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919765, "uuid": "ba1dc40f-51f7-41b9-af02-b8261509553d", "value": "T10993E896B8C28E15C5D423BBF92E00CD331667A8E2DF72129D106F2477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919765, "uuid": "2a99e960-c951-4c03-b20b-4e50a6291503", "value": "1536:1wNn21vn1P0YAvT7C+P7V2o6Ahb0rkHP8UWj6XCw6M1nxkwU856//5DFYchILi0C:1FP1sYu7JPZ2oP0r+0UWj6SXMFBHWUCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919765, "uuid": "25ae3a26-4d18-4dbc-a52a-385f4966a52e", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919765, "uuid": "1e579ba8-282e-4522-a0bc-f5df6bdfc0d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919765, "uuid": "a04594f0-fbcd-4d2c-8557-3ee630bf4185", "value": "UnHAnaAW.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87303390-64ee-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752963608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963608, "uuid": "09d06465-9550-4f6a-a1c8-4277bdee0819", "comment": "Malware payload", "value": "5557a689e03d57e71c6640e9f8b23078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963608, "uuid": "c1c191a1-8958-4bd6-96ec-a25a404ab516", "comment": "Malware payload", "value": "90291a2c53970e3d89bacce7b79d5fa540511ae920dd4447fc6182224bbe05c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963608, "uuid": "aafe6487-9291-4134-a80b-3a65b910dcda", "comment": "Malware payload", "value": "ca2f9a53a33a52ed28bb71b4fb65a4c01e875563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963608, "uuid": "8954999b-5fe3-401c-a52f-cba06344c4af", "comment": "Malware payload", "value": "f541e6533b98b0c97910694af5dec50542c4e3d735f1ad187e1862514d92f4e67ab60794d4ae3e5cbe76d1c40b6cd7a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963608, "uuid": "d46b6526-e033-4078-af4a-2a19f79c5a32", "value": "T1A145284697BD11A9C1BAC03886035327FA71785D4330B7EB57E48B962B23BE5A73E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963608, "uuid": "1a1314cd-29df-4bcb-965e-dbc6c7a608f4", "value": "fe68c0c139cb5780368428461fbbc4da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963608, "uuid": "8a9da397-21b2-4fe4-85a7-b847ebbf256d", "value": "24576:QojdlheyvMG2zjXfyR5QTGvFyDt3SDvOLOt/P/WSCFzVTcvPOkVy3KA:Qojdlheyvd2zjXfyYGvE9SDvOLs/P/W8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752963608, "uuid": "d012e71e-e8b6-4997-b9b8-c0e52b9b0229", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752963608, "uuid": "08427543-97a1-4556-9176-995094592c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963608, "uuid": "a9278d03-3c73-4e19-94e1-4d84eba86809", "value": "90291a2c53970e3d89bacce7b79d5fa540511ae920dd4447fc6182224bbe05c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1cc053-6470-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752909308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909308, "uuid": "db1d7018-f98a-4180-afac-f15e26c113be", "comment": "Malware payload (LummaStealer)", "value": "b402793260007abf3fcee44cabf8f08b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909308, "uuid": "b6f81616-1919-48d4-ada9-5e206be5e6e6", "comment": "Malware payload (LummaStealer)", "value": "9099761b716865dbca9b3973c68b904df16372e12cbdcd75d15a48749478ae9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909308, "uuid": "321e0488-d8b7-4c37-8d9f-2de51dfd9300", "comment": "Malware payload (LummaStealer)", "value": "0f2c791887eff9a78a97a7fb4e2d883fe8fa8de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909308, "uuid": "5665ffde-2e77-4372-abbe-f13c26839402", "comment": "Malware payload (LummaStealer)", "value": "d8d24b2dacb818b5f0b7a80ad42e7547c3fcc17fcdf94ea56718af6daa37080988ce6c45a51a6fbe068a676509491a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909308, "uuid": "8eb4fc2e-6127-49b9-824d-330a9fa9dd56", "value": "T18D350106E61111E9E86741BA8852A642F5B37C3A8734EFDF03D8E3725F177D05E6AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909308, "uuid": "313cd9a5-59ec-4f0f-9993-cc03cec8ed17", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909308, "uuid": "177bbdc0-65ac-4fce-bff8-f5d927b597f4", "value": "24576:DagOdyCGcoTMukP4Euda2eKDWSe+Euda2eKDWSet:OgORP4ECeK6S3ECeK6Sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909308, "uuid": "7fc865c9-8564-45aa-958b-55c55c50ab15", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909308, "uuid": "f7c42741-47e9-492e-84e9-922685876dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909308, "uuid": "c8f9b8f1-0420-4660-a15e-f33d32c951a4", "value": "SecuriteInfo.com.Win64.MalwareX-gen.2063.21704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ae062b-64ce-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752949910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949910, "uuid": "2b4617ce-de6a-4b85-909a-2b37a9a540e7", "comment": "Malware payload (Mirai)", "value": "eb6d4d4c59c4caaae494ab6319e97300", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949910, "uuid": "e5df3b2b-644d-445f-89d5-81b7a223da59", "comment": "Malware payload (Mirai)", "value": "90c4ff8a39fa8e74acdf0e039a2d792eeeca057cd0ae215fb8aba8d2d57137e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949910, "uuid": "3201bb29-c64b-4834-a157-9b9f8cdc0d0f", "comment": "Malware payload (Mirai)", "value": "37177cceae1994a59e30e44e0badb5b20df29b6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949910, "uuid": "e9011924-d8f6-4631-b743-e5b2ea516483", "comment": "Malware payload (Mirai)", "value": "6cf334975729b39de2667dc77308b43fe5fe2ae973c69b28d81fc6cde95121f549726718dfa7ab8e9e6d9889835100f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949910, "uuid": "1b9de7c3-7685-48d5-8b5b-d6632ac85a87", "value": "T1BA731844E742D6BBCA430FF50157E8EB5634A9294E29CD4AFB5D2C78F72388432197A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949910, "uuid": "41c2fe04-4fb7-4bbc-a8f0-7674a7d30487", "value": "1536:HIkHKbFQ717BsilqRj/UYsEIi0I7/utDnzYl:HIkAFQ74Hj/iEIiPWtrzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752949910, "uuid": "07e59bcb-9b5f-40b4-bcb6-107a401ea488", "value": 74404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752949910, "uuid": "ec6f5f27-89e5-4a11-a9bc-8948126d71bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949910, "uuid": "27048acc-a222-4297-852e-7d1bb0c0f215", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c0832b-646f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909192, "uuid": "0b9abcd2-8ee3-418e-b14f-cdff059fbdb6", "comment": "Malware payload (Mirai)", "value": "7188c00d1f044857bea9e4c8e1e29c76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909192, "uuid": "2b28c852-1e27-4a5b-b724-8af3d4c5fbb2", "comment": "Malware payload (Mirai)", "value": "9542a8bef0de0b495c530f0ae676c2d84a8f14aeb5239b33e30a7e3671a37b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909192, "uuid": "a819eadb-1f90-4a30-a2f1-bf9a551bc86d", "comment": "Malware payload (Mirai)", "value": "251a42cc7a05ed9f1395a33311d78428df7ba3d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909192, "uuid": "42ef2a5e-2611-42a4-8b3c-c956ebed0668", "comment": "Malware payload (Mirai)", "value": "bce8f4bd3abfa4e6bacef52ceb207bacbd5b1e84e61faf92979403d0b5b702c893badfd91b90fbd339a4261c683c37b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909192, "uuid": "c25dc357-d03c-4869-af24-3cda66843591", "value": "T172335B41B30C0D47C1936EB0363F6BD2A3AEAAC131E4F685392E9B969575D361085FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909192, "uuid": "48f39bc0-311c-42a2-8285-ce9437e197b6", "value": "768:WSpvu2HWz5rMciZd1T76Op7948IQ0Z63Hix0a0bIFFA8tiu9Iv:tHWN4cC77rR4TQ0Z7x1eII8AyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909192, "uuid": "2c0b7438-bb5b-456f-b6b3-1368b6deda3f", "value": 54676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909192, "uuid": "b345514a-c50a-469d-9d3c-eae079248d5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909192, "uuid": "c08c5515-50f8-472c-a22d-602c74bc3606", "value": "nexusnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e7955d-649b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752928008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928008, "uuid": "9b2fb4e4-0b08-4453-a34d-7014095cea92", "comment": "Malware payload (Mirai)", "value": "3c8e5a3fc8c73d49a40621057023e64c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928008, "uuid": "30ede25b-1016-41cc-af1a-e5d9252f3810", "comment": "Malware payload (Mirai)", "value": "97d65ac4d7ef56c46367a3b4bd6ca5fd3e22c3b45f86f8f377864ec77814c5e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928008, "uuid": "41956a1c-4f25-4e73-bc3b-6153c1a6c4b5", "comment": "Malware payload (Mirai)", "value": "38d238a98dd613fc486a83213391b950c677ffc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928008, "uuid": "939e6ef8-a547-4da7-a389-a80c6c177284", "comment": "Malware payload (Mirai)", "value": "e9652326f19e27f23b3ee612b4a3daa6321ec4e9ceb4ac812f8ed80370af7c3e56d3922bf0421b3bc51fbd14d6f89f37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928008, "uuid": "fdc0b244-e01a-4b73-9c9f-f4e180d7b4be", "value": "T177739D63C8362D68D14881F070B08F395763A92285871EF758AACA79D087EFDF2163F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928008, "uuid": "3d6ef25a-fe4f-460a-930b-480c5d323436", "value": "1536:Dn49haPDX7L4KOL4d+eGU8C+AI6I9oKA:DnSeDXP/OleGU82I9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752928008, "uuid": "d2d75071-3c15-4214-a56e-33c4677ba48e", "value": 75528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752928008, "uuid": "d96c989b-4be9-4b54-b0e7-4f91bfb0fe58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928008, "uuid": "909ac54b-4972-4fd4-a124-d12d7abe3552", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123ead36-64ec-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752962552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962552, "uuid": "ab576562-571b-48e9-94c9-f4d3a850f5d3", "comment": "Malware payload", "value": "ac03d07b04a2d27caa028e4e8637ada1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962552, "uuid": "82a3278c-379c-4279-bc82-2b745dbc411f", "comment": "Malware payload", "value": "984fe1d71850051c3e58a820fe92130ca9e504b9729dd371b30c5e77f36c3af2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962552, "uuid": "094ef14b-efe9-4e36-87f2-75d3ac02ba2d", "comment": "Malware payload", "value": "70d577602ec12af8718e81734264c2768c7a098a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962552, "uuid": "e4c19d6b-0539-40d1-ad05-0efbed9cd6cc", "comment": "Malware payload", "value": "d7dae9d7ba9b36371948e7d0a88808a6beea5b7f64f18e3c364740eac762f90812c6a5aef8ec703c259bd8a4b464ab26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752962552, "uuid": "961773e1-d74c-468e-8cf6-b5dd7d2a8fe5", "value": "T1E546E0B3E4834A85F3C786779A912D400DE0A518E967592E306CCED7E2D37C03D667EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752962552, "uuid": "4b2828e5-2a65-4bb9-98e2-4a1fa6318828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752962552, "uuid": "8e22dee1-2c45-4e09-8153-47705019915a", "value": "98304:SMLqd2ffsb0+oTBxq4g1ZoTsi9UefRrJ+F5vjkYYvELVGDogyVNn7Ntu/NaeqdFy:SMc2f9TTq4EoTsiKeKrAuP7aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752962552, "uuid": "0338380c-c100-4827-bcdd-57102b103285", "value": 5824000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752962552, "uuid": "586bf888-feda-444f-8ad9-a20c444c1dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752962552, "uuid": "78a46253-7c0d-4566-becd-150605aaac75", "value": "984fe1d71850051c3e58a820fe92130ca9e504b9729dd371b30c5e77f36c3af2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195194b8-64b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752940660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940660, "uuid": "38960314-dd21-4820-af6d-6e90cfaecdd5", "comment": "Malware payload (Mirai)", "value": "9265a50ab8ff0091fda7fbed480db4c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940660, "uuid": "a8e164e5-1657-41c0-b6e4-1fe1639323a9", "comment": "Malware payload (Mirai)", "value": "98acdb874c8e103ab3cc44cba975205c06aaee52fdb5996b1109c0f64b9061a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940660, "uuid": "32121f47-e4fe-4997-890e-365d355bc50e", "comment": "Malware payload (Mirai)", "value": "a67dbc50f0666433318d658ecf7dc9a7ca678bd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940660, "uuid": "4983bc52-644f-4630-94c1-c2db9cb9077d", "comment": "Malware payload (Mirai)", "value": "6091e7c1ee7de4a0cc6fc725c1ac624bd2dd6854227a35224ec6dfebf2083bf638e74cebf1203f27c1be07512739d1ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940660, "uuid": "77c009aa-9853-4bc4-8db8-c1c76629d1ad", "value": "T1E6530115CBB63D71CC86DD33EC9F8E86436B8BED9BFA101B14150E2062A3487D6F6542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940660, "uuid": "b7982e97-477a-4ab3-9e90-32d9333fc17c", "value": "1536:dSbFq8x8ivDFrFjvdvCptimfuaJEAtx65M7LA5IlW0MqIeH4NP:gbQ86ivDFrJvBCrLfREOeM7LYEMqpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752940660, "uuid": "8b857d15-6ebe-4dcd-9fa4-e6b3ddc44fb2", "value": 65692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752940660, "uuid": "32c604f5-c667-4b5e-a327-adb5d93d0121", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940660, "uuid": "68f89f36-5817-4dcb-a4df-babf648eeb5e", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3741a8d-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925054, "uuid": "27f6d399-8b48-4752-a36c-bf73b9128599", "comment": "Malware payload (Mirai)", "value": "48b38221cff772a4a4f2878e5a4884c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925054, "uuid": "8d64ebac-1ee5-420b-85d8-82fb51aa31d5", "comment": "Malware payload (Mirai)", "value": "9a68a95ce997cbca00cb93a120921f07ed28ed3c68eab4af9460575aa7fcf3c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925054, "uuid": "79570484-2ad9-497b-890f-0a08846079e6", "comment": "Malware payload (Mirai)", "value": "156837ac58e8746eae06f89aeaa533688fd14b27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925054, "uuid": "2d2edb6c-0167-4db1-8a1c-3d241b4191e6", "comment": "Malware payload (Mirai)", "value": "a3c734c27e4ac45df1bfc9fb9b560d4d3709ae54753d5ba28b408d29d4b33507e41232930437b3f4d135200333124493", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925054, "uuid": "e9c31400-523a-464a-819d-c9e2fb0d5c0e", "value": "T10473F819BF610F77EC6BCC370AA92B0529CC954B22E57B367934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925054, "uuid": "cceabc40-77ec-4452-bffc-a1a93c19e1df", "value": "1536:7J5dbFB4x92nKoI2sa98M26ofWU+UZ9CYXzdJa10N:7J5dxBu9uKovKIUXd4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925054, "uuid": "85b32aba-8e14-405e-9f48-f57da8d0c87a", "value": 77320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925054, "uuid": "f4fc0bb3-bb86-4183-bba5-ab56a97ab8b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925054, "uuid": "786400c6-d282-4c80-8caf-95e70c415b0e", "value": "uYtea.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13d0ba0-64aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752934526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934526, "uuid": "31e24351-c299-4c7f-9daa-e9369fe886c6", "comment": "Malware payload", "value": "0e5f85833b5837f1192cc4f00160fc41", "object_relation": "md5", "Tag": [ { "name": "anti-debug", "colour": "#334878", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934526, "uuid": "f05eeaf5-2b38-4a75-a5ac-f879391310a0", "comment": "Malware payload", "value": "9c3422dbe4500c8ed8929feefd3cd13003418bed2c3190c2875ef61052f4aa6c", "object_relation": "sha256", "Tag": [ { "name": "anti-debug", "colour": "#334878", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934526, "uuid": "f4a5521b-e517-4226-9d2d-1c2b49e32311", "comment": "Malware payload", "value": "aec49208a1687e07cf78e068d46772ccfd9d11d2", "object_relation": "sha1", "Tag": [ { "name": "anti-debug", "colour": "#334878", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934526, "uuid": "9129ffac-4789-43bf-a91b-9553e58ddd17", "comment": "Malware payload", "value": "185b92cc4c0f41af4f17e6b671d8366500cb0991ae8dad2d7beb62e70b78b3b43f089c0554de09a22ede3eebf002b9a0", "object_relation": "sha3-384", "Tag": [ { "name": "anti-debug", "colour": "#334878", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934526, "uuid": "1902d87e-ee78-4b6e-ba31-bbcc89dddc58", "value": "T17565C056B241F0A5E7970270CE6E4B6AA224EC604F975AD3732C7D9EF7312D0A47B306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934526, "uuid": "95acf058-95fe-48d0-835a-d3e4874557de", "value": "11c7e25b00489347bc7a27d18f04c078", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934526, "uuid": "455ed4d1-9a5b-4040-9dff-fa992442a063", "value": "24576:w7lE7pJkchw/gc4kmkQHIE/QUjpRmqaR7PAgbLbgfif:2pocTGHIE1p4R7PA8k6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752934526, "uuid": "0ef3bf84-2e6d-40ca-b37a-7e921819520a", "value": 1506816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752934526, "uuid": "ea6b7ced-283a-4205-8e1d-8b702f11cc63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934526, "uuid": "d554c04d-1c28-4a49-9e9d-0f9cef2044d0", "value": "9c3422dbe4500c8ed8929feefd3cd13003418bed2c3190c2875ef61052f4aa6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaad8a3e-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933280, "uuid": "dee30590-53ff-48c3-bb52-27c63d6abe11", "comment": "Malware payload", "value": "ec80cb40c6c4280349f3773d25e2e2fd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933280, "uuid": "2bc3ba80-ac40-411d-8be9-77d22c953afd", "comment": "Malware payload", "value": "9cc3a43497044ad88e424b82ffb0801a4c9e3033c34ddd32fe282c996ca545bc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933280, "uuid": "2a169393-4225-43e7-98f2-2fa0b4fdcfae", "comment": "Malware payload", "value": "e512f6f08f275b6260b53b801e4c7710f7b42102", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933280, "uuid": "72ce2f16-9299-4cec-8c2b-38c3fd3b6f66", "comment": "Malware payload", "value": "19d5b8942070f8ae9572ba80e797607019a15dc06c55673e680250efa4431d47c73195f1a75c2fc78fc64e71d2cc10e8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933280, "uuid": "2ac14e3d-5041-4a03-9a4a-6f794ddee1c2", "value": "T141126C3883B2242DE33951F4521120928B29F6BA81472D377F709F1DA9BFDE7232D655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933280, "uuid": "f66ca069-fdac-4aed-a817-7211b7b47400", "value": "192:VdQMe+9OV8vdQjmdUpr6uXSzYu6xwf3o4H9TjLaK6qVc5O9AiOTAd:MMw8qme2uXTu6xwPLrDVcAai/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933280, "uuid": "0d4048a5-aa74-4c03-97f2-47ed6ab70d71", "value": 9265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933280, "uuid": "bd3082d3-9ee8-4874-ba16-0492f26cf899", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933280, "uuid": "de630a8b-ee3e-4d7e-be4d-018eda1e17c5", "value": "PO.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9af8fa-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752924771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924771, "uuid": "1af593df-756e-4843-8df1-519f8d37a1e6", "comment": "Malware payload (Mirai)", "value": "f60343e1a73c462f591f430a1495bb89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924771, "uuid": "142a2b32-e6a7-4e29-b151-bbaa62a4f2be", "comment": "Malware payload (Mirai)", "value": "9cc58d8a6b03107905e11c16a1727d8e6eced361b89661ce9000f102ebd6a576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924771, "uuid": "dcddb58f-a9b8-4068-a4d8-01b920d8350d", "comment": "Malware payload (Mirai)", "value": "daa73c7193e71e7281fcd7781b0a88d98db6c350", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924771, "uuid": "988d6f33-0997-42e9-9f3b-dca52044dc95", "comment": "Malware payload (Mirai)", "value": "181d001b0ef0999de04e889dc73e1dd8472fe3c4a40627fed65d59edae3ac8e2c554fab97a79d04539753fa06eeb63e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924771, "uuid": "7cfaf73b-cb41-4232-ad0e-6f308837a6eb", "value": "T153A55A125BBD0A1FC4C4A2B5A2F74372F1FA9B8510B8E5077F918C8D8FA5650366B3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924771, "uuid": "e13c653a-9c9d-45ef-9ba6-bf307cbe2a9f", "value": "24576:p8P/sggoIyycJQ1OKOITXHdlQYBPGW2xYyzeSaiDc99yITAhPP15qZPvYe:C5hu3lxyLhPP1IPwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752924771, "uuid": "46eb2beb-f49c-4416-8978-a7330e5a91e9", "value": 2195700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752924771, "uuid": "ec7bd730-7a0c-4116-b6b9-0adaeef10fd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924771, "uuid": "cc5f6297-303d-4727-80d3-7a692fd353e8", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baf571e-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1752933067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933067, "uuid": "90eb96de-dc03-4934-941a-54b14354f110", "comment": "Malware payload (DarkCloud)", "value": "90ab2d721cd90ae86bceac3725d33d21", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933067, "uuid": "74aff5f9-ac1b-4942-b12e-4638f88c146f", "comment": "Malware payload (DarkCloud)", "value": "9e495c516cf0a63bd4023ca9cc0b24ba29e9eff5c2bb3779a17cf6b5d30fdd61", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933067, "uuid": "0f29fd32-1ee5-4726-bb4a-b4043b0e4f4d", "comment": "Malware payload (DarkCloud)", "value": "a9637af3574eebb21e150fc05e6c44677e3062f1", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933067, "uuid": "11edd8d6-7b09-4313-8b75-fd9e3faf41d4", "comment": "Malware payload (DarkCloud)", "value": "57fe7ec749e1fd7b47617ca8d782fde85bda2d9096965ec0b19aacf6a7b80bf88d8b4b761fc5868b72ebffef6056326f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933067, "uuid": "0ec45355-2deb-4e7f-86b1-e95499bb83ee", "value": "T1CD450106A71165E9E86741B98922A642F833B9268734EFEF03D8E3730E137D41E3DB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933067, "uuid": "457af06b-fc6e-43c4-8234-b42d66a9e1ec", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933067, "uuid": "d90b7071-0c08-4372-8967-ee99b724fdcc", "value": "24576:zagOdyCGcoTMukPOiZzkwi1IH98iZzkwi1IH91:egORPdrMIprMIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933067, "uuid": "6d570249-9f9d-4283-88b9-6c75df2ab88d", "value": 1239552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933067, "uuid": "526d0e34-1d3a-4d6f-bf44-28c7b3bb8c7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933067, "uuid": "2f00e018-b046-4a5d-99fd-502a50dfdf2a", "value": "comprobante de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45656e8-64cb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752948678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948678, "uuid": "aeb4f183-9e20-4830-a455-cfa983d6ef15", "comment": "Malware payload (Mirai)", "value": "01e2eea5ada813934e1500097ccfca89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948678, "uuid": "f63ede02-ff61-4e36-b42f-659c2c6df0fb", "comment": "Malware payload (Mirai)", "value": "9ea2afa5a67c80c1e6fd11eee2ce6021c8d48356e40cc2f9d23c0b34a2692d5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948678, "uuid": "34a3f430-aaac-43e1-bd9e-52a217fafa0f", "comment": "Malware payload (Mirai)", "value": "786fd487ee3829aad602abf6bb9131f91bdf428f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948678, "uuid": "26ef82ee-d667-4704-ae36-0d031a78df10", "comment": "Malware payload (Mirai)", "value": "79c638d7d1dada9f1ea1e6ef94b6108b0d112bd6de6df6d6f6ede4c814660e25076d10be5e6e46f4106fcc8f2eedc049", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948678, "uuid": "306e3643-431c-4fcb-9d41-d63777552dfe", "value": "T14BD31A45FC515F13C6D612BBFB4E428D3B2A17E8D2EE7203D9265B21378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948678, "uuid": "d1d88288-efe8-4b14-9b91-14f909b9cb2b", "value": "1536:P9kzBj4OzlqfHlIZbJUemCmAPBo4VrqcUT891muxPNjbXHvoFl7hwywcRYYwwYLr:lk9JlqfFhdCmR4wDa1muvLP2JmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752948678, "uuid": "020ce6fd-0ca0-4365-ad9b-febb7ef818f9", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752948678, "uuid": "1b4af577-27e9-494d-9be6-b7207d506864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948678, "uuid": "f21f7b98-4cd4-444e-ad6e-2b0bbb7cf768", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4589067c-64ee-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752963498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963498, "uuid": "90edddbc-d668-411e-aff0-f8f20be7e78f", "comment": "Malware payload", "value": "fb2799e1d76a5897bcc2675e90f22869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963498, "uuid": "7c7b5ebc-6a83-49d5-907d-7d770556e5dd", "comment": "Malware payload", "value": "9ec86514d5993782d455a4c9717ec4f06d0dfcd556e8de6cf0f8346b8b8629d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963498, "uuid": "9c635e4d-40f7-4259-a68b-69249ea2de05", "comment": "Malware payload", "value": "96708c84e07d058b5f0012666e565617907add99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963498, "uuid": "eb649e4c-f34a-4b52-bdf3-0a02aee3f382", "comment": "Malware payload", "value": "91d9558ee74176f837bfb17376d4f8b6d9fd0a0e46d51f283f3c828a26a7c180527a813ddb379bcbcdf1dbce7e1c2df6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963498, "uuid": "2799f9ad-ad9a-44e3-adc8-d8b7e3178273", "value": "T184452846D6BD11E9C1BAC138C5035327FA7138598330A7EB57D48BA62B23BE5A73E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963498, "uuid": "cab24467-418f-4c01-8177-12d2eb5566bb", "value": "b5221037e5ba7439ecb20248616bb259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963498, "uuid": "962f7f4f-d436-4fd8-8914-63cf216b03c9", "value": "24576:3ZokVvATc5Xo8op6PZ6h225GpEiCMV5gtEAoVJqPA0hqFxgyj4jij7+E:JoJTc5XNop6PZ6A25GCMV5+EAoVJqPnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752963498, "uuid": "d30c2e03-c7dc-47ce-89b3-5535fb5e1664", "value": 1187328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752963498, "uuid": "4319b73c-00f2-47cb-abc2-d4a577277561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963498, "uuid": "5459da9c-8ca1-418c-a48e-a064c2fdd46b", "value": "9ec86514d5993782d455a4c9717ec4f06d0dfcd556e8de6cf0f8346b8b8629d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711ff428-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907736, "uuid": "cf8c5328-f1f1-4207-be0e-d2123a20c21a", "comment": "Malware payload (Mirai)", "value": "6f4f893f590de5db772622c03e253825", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907736, "uuid": "5d528a7a-dbe5-4878-b37e-94ae6e5d8b00", "comment": "Malware payload (Mirai)", "value": "9eccb52c55a4f46ff937516b3704a99d1f206d16fc42748eb26c600aaa5c92e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907736, "uuid": "f5f821a6-74c5-4966-87cd-b54c7766e8f8", "comment": "Malware payload (Mirai)", "value": "1d211ac1c180dfefd6985a336dd71196acd9f0f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907736, "uuid": "8c7480f3-1e30-4e62-939a-ba50986809f0", "comment": "Malware payload (Mirai)", "value": "e58e4e699be1e4d90ae19301fb1bbefd12cd8b4dd54117a9b53eefac9a3c27004741c0a37a6062630e02f44593eccb82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907736, "uuid": "1f55902d-8df0-40b3-bcc5-77b12ad6ca8d", "value": "T12C630856F8814B22C5D5027AFA2E118E332357FCE3DEB2129D216B207BC696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907736, "uuid": "4cd2cbbb-d8af-4d1d-b8e5-741b39fe2d7d", "value": "1536:Tln/3OF1CSj+bwzpRrEJRTGRaSGaXchzLIPiQQ0F+uNjL52YonO:RO1jOOcTa3Q0F+uNjLkBnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907736, "uuid": "9c7355d7-19fa-419b-9286-b23891af4a40", "value": 71236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907736, "uuid": "8bd8542c-2fe1-4136-881e-650c60ceb94b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907736, "uuid": "04fc4e37-6c40-456c-adea-937815d5c483", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2565fb9-646a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752906960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906960, "uuid": "93405dc7-2812-465a-a01e-9d09ae676956", "comment": "Malware payload (Mirai)", "value": "37243b7ebf00872ba64b66b5b1d95fa7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906960, "uuid": "824fa87e-cf8e-4ee4-86b1-99d0463eaf79", "comment": "Malware payload (Mirai)", "value": "9f959d256804f659608994a453e80f7e124fe6b0dfcce72048a8f86d0568e835", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906960, "uuid": "cb095aa6-ec12-4133-8226-ce0b147946e2", "comment": "Malware payload (Mirai)", "value": "af4ef69ff4959280262e4963d376182314257bd5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906960, "uuid": "d402c6fe-e7d6-47b2-a075-e0bb4380a99c", "comment": "Malware payload (Mirai)", "value": "b8833996bbe8ae809ffaabef569318f424e89a3f7a3ba1c1015f734aa714a1d056ae37005390b861e01c6814ca5491df", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906960, "uuid": "2a8af18a-0940-4a70-ab99-257a8e487587", "value": "T14A7151AE20B319762EB0AD37737B459472D1E58A50C55F95A8DEB8F880CDE083470BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906960, "uuid": "78edd94a-fded-47c6-a29a-ff1c90dbda1c", "value": "48:vgQwtHqkhvvhvJAYGCGuYhZYKDJoPSISL1Hq5fN:vgQwAkhBAYYwwoafL1Hq5fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752906960, "uuid": "e15e1c84-f082-46b0-9d42-4551c055b2be", "value": 3722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752906960, "uuid": "cf18216b-9b1e-46c9-a81a-42e8ad263fc5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906960, "uuid": "9980878b-424d-4217-a83f-32a90c2a231b", "value": "faith.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078203b2-6495-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925168, "uuid": "7c417c44-8c0c-4004-bb48-4340f2f7a6a0", "comment": "Malware payload (Mirai)", "value": "4407b7149d77139847bf0b14c2871d7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925168, "uuid": "c528713a-be4e-437c-9fd4-c15e4fe8ee24", "comment": "Malware payload (Mirai)", "value": "a0b07281d78b77ef45eae7053de7c5d4bb05123b1aa9b6499324b471783141fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925168, "uuid": "1d1e6231-cc64-4f60-ae4c-b2fdbce74f6d", "comment": "Malware payload (Mirai)", "value": "171a49b0064c4c2fed6ad219a61c7ce36d8d3e16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925168, "uuid": "08c9bdf6-150b-49ab-b9d2-775c2d6acbc0", "comment": "Malware payload (Mirai)", "value": "48ee8cc322469d967f841e53a843f34cd6e899fcf87ccfac981579de47f6576143782a1e22d7a25493d5718117f16d47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925168, "uuid": "4b6aab1e-fdd9-4fe1-84c3-0c64ed66e86e", "value": "T1E6438EB4E42A9D54D0850174A8748F750FA3F2C883621DF72BAA46B1540BEB9F60DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925168, "uuid": "4fa565b1-7922-4bd4-9278-112bfa672978", "value": "768:f3Dm+BLr3pN3b3xMmWQZ7YnYhJ2wGQDmhMOfaA1eCHo1Y4dbC2WwJZY10U:bm+JDpP/Z7VrGQDRA1eb1dbC2PJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925168, "uuid": "dfeb80d2-b06c-4481-9889-2a711486d4fc", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925168, "uuid": "c6c2e483-1a6a-49aa-8f1b-1007717bac4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925168, "uuid": "1048a729-2549-48b6-aac5-e334abd974b2", "value": "uYtea.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19e3f7d-6489-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920380, "uuid": "fbe58178-ffff-432a-85b5-7343df952a80", "comment": "Malware payload (Mirai)", "value": "836f9b9d621fa7d1e0727a4e89cf1de4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920380, "uuid": "3a1ed242-6124-4525-9bdc-c2fee7b2cc2b", "comment": "Malware payload (Mirai)", "value": "a16d26317b8d3354d9adff5655c158d518db7d8278d46886110893f5db0e9335", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920380, "uuid": "029741a8-51e2-4821-bffc-648faa6dd63d", "comment": "Malware payload (Mirai)", "value": "d75548be35afdb230ed53d7d18c739e840e4e6f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920380, "uuid": "8cb35ba7-f674-4eaa-9fb1-7f5407804927", "comment": "Malware payload (Mirai)", "value": "6496116ccc03060d0889ae19aa28db1f2ba62bf1f3c34603477378b6d3605b116ef6ddca277c9821336af2869cd7eee1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920380, "uuid": "4190c098-121d-430a-b656-e63ff13654b3", "value": "T1BE04881D6E228F7EF668873147B74E25976C23DA27E1D644D2ACC1106E2029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920380, "uuid": "45b4b56f-ab52-4886-af84-717fe0151d2b", "value": "1536:PDaieHaEaL3XqxYZNj3VScvWnOLH99LKjoS6CeGXw3ed6FFmYcPHTOl+spwWaMuI:LahaVLnUo91jS5eGAG6FQgnpwW38kMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920380, "uuid": "f10d8ac4-4933-4c5a-afc9-2f6e3b17912f", "value": 177828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920380, "uuid": "fd6cace6-aa34-4eca-ad46-37577938b0ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920380, "uuid": "f6b590ef-907d-43ce-a653-b8e57c48413e", "value": "iotmirai_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dd16b6-6473-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PythonStealer)", "timestamp": 1752910742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752910742, "uuid": "a01f4f5a-0fb3-4b8f-ada3-c7d51c54ef87", "comment": "Malware payload (PythonStealer)", "value": "0b2ccae9156cb2616ed8edc2a11c25a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752910742, "uuid": "55bfe8e4-670e-4563-8f0b-14aa5c6004b3", "comment": "Malware payload (PythonStealer)", "value": "a2b833b2ea56a3a260149a61ccdfbb22dc53bbc9086735a67eca4ff7eeb6281e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752910742, "uuid": "7b6eb8e6-12d2-47c4-84b1-fe29d8928a96", "comment": "Malware payload (PythonStealer)", "value": "228f984109393aceffb3b41bfe06ba6537c6a19e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752910742, "uuid": "2ccb5621-e4bd-4ece-830b-9e5563a248c5", "comment": "Malware payload (PythonStealer)", "value": "532c7f4aeb195253df069ef751c8b9548a1e20759257094eecb63cee296809d872e21c2d8a04e04007cec58e42e9fd46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752910742, "uuid": "b64fcd2d-52b3-43a8-8d7f-187ac1aae8d0", "value": "T1CD863399EAA228FDDA8EE23D441967A2F5737D451321C9FB07E0D5702E13BC04E3AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752910742, "uuid": "4d931e29-347b-4c6d-a145-c99f539390a3", "value": "02a64bc3ebcfd648c1cf8122736ae6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752910742, "uuid": "3c2f4662-041d-447c-a9be-401225f83c98", "value": "196608:bSfiI7ysO0zM9xie0AFVEfN41eY0FxG4Qhf8TRuzScX:bSfi2XzMLicjEfe1e6K9un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752910742, "uuid": "b2a80dbb-0614-4ea7-8799-3812b221bdf6", "value": 8305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752910742, "uuid": "f70c4fe4-3243-43d1-89f6-1c4192d31f70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752910742, "uuid": "80be1f08-1ad6-4d2c-99f8-125f8897f853", "value": "word.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8c5743-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752932933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932933, "uuid": "129778ea-04ac-476a-b9c1-8dfb928ebc29", "comment": "Malware payload", "value": "a30d5908ce25563ef4162d07d230f9d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932933, "uuid": "acf45d70-66bd-4f07-a1e5-819c556e1c99", "comment": "Malware payload", "value": "a5336080fd9ac50ed735757b728710995b5c6cc2cfa498b9cbc0f8d410b4ed79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932933, "uuid": "3ade3ad3-73e6-4bcc-be7f-f881e8e9e982", "comment": "Malware payload", "value": "1db46a38cb8a66dc54c19292c971abaf42f911d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932933, "uuid": "edb0f722-a7bc-45aa-aa55-ebdd21daca43", "comment": "Malware payload", "value": "141e87630a800c27cf1ac988f21c90a7c46314be243f126ac54564a007118e49556290a05356f1f0b68bc2f599335a68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932933, "uuid": "a59aed17-717b-4699-85c9-f15ec2b9228f", "value": "T13092E19BF6531024F4227AB22B317CCD5DFA5D2750F01099C626A06730B3B58E99FC0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932933, "uuid": "6aec43d8-a104-4c4a-9049-467bf34a196d", "value": "384:yazVeUhzgJ8kKcZa3cljRZ1YCYgsy2aGn2J6JOYt7ZGeIk:yaACEJ8L3slVllsHfJOw7HIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932933, "uuid": "08df607e-5603-411f-8dd5-e3b74b1a0856", "value": 20310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932933, "uuid": "1644f71f-8774-4d76-8c71-0bb12cdcc994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932933, "uuid": "b4c9b808-e216-405a-a67a-7c7ca320faf4", "value": "a30d5908ce25563ef4162d07d230f9d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfdea68-64ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1752934868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934868, "uuid": "87a4b42c-2317-4f2a-a43c-cbccd70d0d8f", "comment": "Malware payload (MassLogger)", "value": "97ed7f4c50f11cf1cc65199ab8df5c81", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934868, "uuid": "02fa6adb-15c9-49b3-b329-d29a60970482", "comment": "Malware payload (MassLogger)", "value": "a56ac3a2b9082866257234de1ce3713ee1d9fc7e6f21f8d754f034f81a981cce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934868, "uuid": "48626a76-93a1-4abd-ba2d-49a10404ddb5", "comment": "Malware payload (MassLogger)", "value": "fbf3859bd1d33e2f4089eec77866bec4f5467c9f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934868, "uuid": "41f9b9a3-a011-47c4-a3e6-0af86635025e", "comment": "Malware payload (MassLogger)", "value": "274d59158b5d6e6302ee1a5252cc77ac9589d8b363fb5cd3049c24c3c1b28437e604d89f1caf26e3eb2eeb71d9263197", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934868, "uuid": "1138fe95-0b58-4890-9061-650b92cdbd0a", "value": "T1E683682D090C32D02A27C728D7D58629AD294D03ED673C593EBE653AD3EBE4E54316B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934868, "uuid": "b359e42c-9cda-40a0-86f7-aaddc24a3653", "value": "384:iSnkg5RUdwxg54sJ6/zHHM+lg+1pxk0/f9F3oj90YmxUl9F4jXsJ/TDV4lQe:iggQ9F3G90FxUl9F6sFTDG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752934868, "uuid": "68c04267-3fa8-4762-b3c0-144d569c15ae", "value": 81169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752934868, "uuid": "9a4be0e7-2fbf-40d1-adb5-547720fb1bf9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934868, "uuid": "33d59281-2a27-4f66-98e6-787d9a4df772", "value": "TROMMEL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b63f06-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919771, "uuid": "337de160-197c-4fcc-ba1e-dbfbf4c94a4c", "comment": "Malware payload (Mirai)", "value": "4772d1fec705d8f681d569f6d65b28da", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919771, "uuid": "075da725-f6b6-4966-bbbd-2cb69515a71b", "comment": "Malware payload (Mirai)", "value": "a573824ccb2bfc1ed950fbe4dc817d314a576c1cf6e880a2daed8748c61f1deb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919771, "uuid": "fa36959f-d562-4534-be7b-a3fa8a959f5e", "comment": "Malware payload (Mirai)", "value": "cdb22c3e0e1a49f4d52957694977c6d89e196f8a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919771, "uuid": "3c8189f2-aa39-426c-9a15-79a7c03ff5b0", "comment": "Malware payload (Mirai)", "value": "f367de36f4d695e81cd38b7125187cde867cc83e7465e62179ee73ee3be5a92335a4314b835ff56511ae461031f8bd2d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919771, "uuid": "f7a1e5a1-a596-49e4-9f3d-0e78bb39a0c4", "value": "T1FE2129DA0020D024580C7B6070564839ADEBFBE030221AFC95BED4B3A5DBDA97306F38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919771, "uuid": "f65be42e-962c-4515-9dc4-0af440c89913", "value": "24:mQG1GnNIrGMKTG/50F5GrGJ6GHGBlGJ0G3gG/HA:mQG1G2GMCG/507GrGJ6GHGBlGJ0GQG/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919771, "uuid": "39ebd7c7-5872-4ee5-8910-cebd6a292f8d", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919771, "uuid": "a8949102-40f1-49e9-b05e-f9622a181c3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919771, "uuid": "dc0c716f-1c56-4c52-a0a6-52bdfd11d9bf", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e4dacf-649b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752927796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927796, "uuid": "054875e6-46af-49cb-8448-537f009efb57", "comment": "Malware payload (Mirai)", "value": "b578ed98a64b1204065a8ff7d2ece4fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927796, "uuid": "33a8e9ce-ad51-452d-a247-a4604daa9fe9", "comment": "Malware payload (Mirai)", "value": "a6ead5ecc5a093af2dd8f9cd7b44db97a3077e888ed6fed6598a68ecad756df0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927796, "uuid": "47306a9b-6f8e-4649-bead-677daa59474f", "comment": "Malware payload (Mirai)", "value": "d23434e6ad5c6d3ee9ba02b77ca3cebcdcad71c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927796, "uuid": "46a13ca8-52fc-4af3-b119-9ca5171f4b5e", "comment": "Malware payload (Mirai)", "value": "d89cfc221c04b78283a66023df0414aa0a4927bb7a2a9d209ffaf13f685fd23eae3f950264fa0a96899cc4b3c27f1c00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927796, "uuid": "797d1ffe-d13b-48ed-93b2-8dcee8661dc1", "value": "T112D3AD93F78B14A1D81206F007C74B9D2E932111DF2FE9E7AC1D663A9A3A5DB5A073C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927796, "uuid": "b7f9618f-da25-43c9-aebf-e726e968f26e", "value": "3072:OCYdP0zvAPdm+HlNsn6EkRkr45djxbZgbgq:OH02w+HjO0R71q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752927796, "uuid": "2dec1a32-cb8c-4c29-9e5c-a4e23284333d", "value": 133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752927796, "uuid": "38fa2c4d-e0bc-4ae2-8220-23dae9ff488f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927796, "uuid": "2574d181-fa9b-4372-aabe-9868ac4ad37d", "value": "top1miku.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41ec43c-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907929, "uuid": "c33236a6-f69b-44ca-b231-7f49c17ef56d", "comment": "Malware payload (Mirai)", "value": "da80b8b342e147fb59cfacd455320ef2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907929, "uuid": "635cb518-cfef-4789-b2c4-8220d53b9198", "comment": "Malware payload (Mirai)", "value": "a77660eae41036d24467b79e7c5997774f25d7dd85ecce15d2fe6b6e83bcf8dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907929, "uuid": "31b69749-9d30-4dc4-a01d-949f79d417be", "comment": "Malware payload (Mirai)", "value": "b1f814920e49e3ded05ba8bb92235c2443e549db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907929, "uuid": "c4e47ac3-73e7-4bcd-bbdb-03dc6fd8db73", "comment": "Malware payload (Mirai)", "value": "1f85d996e7f4f2bed6fd69b5e17b469c638f7d32221b0f1b52caf57ddf77496f1f14020beaaabf0d1961055a2810a5c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907929, "uuid": "5ee30cbb-da06-44de-bda2-2b0fb79ee998", "value": "T15493F7EBAA3D17A7C4EB46B23C5737F48B6DF92102E412C89105ABC91772A786031F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907929, "uuid": "6010da8e-f0be-4b4a-a583-7e098f9bdd99", "value": "1536:Zz3UovGBR9HJjNOGF9sx9E11D1k51vslTqX89eVLBFrcBh4e3PkS9npSDHrZkrv:ZWec+XoTqO3VSDL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907929, "uuid": "3659801b-d175-4b63-9d1f-5356b916638d", "value": 90738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907929, "uuid": "3537a55a-d999-4eaf-86d2-f9e16b0f491e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907929, "uuid": "93f67e15-864b-46b6-8d8c-993a432386ca", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4ec8b3-649e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1752929201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929201, "uuid": "be18945f-b968-46c7-9418-73f0f5521084", "comment": "Malware payload (Gafgyt)", "value": "d6a8b80ed6b4b1b267d943c3ff74d438", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929201, "uuid": "3fe2d657-9b60-494b-b569-9099f1e2aa64", "comment": "Malware payload (Gafgyt)", "value": "a77e7186ad2e7b858f23a9f1d3d5d6365481fcf8bf212a6d49b50ba9f9ae046f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929201, "uuid": "ff141d63-97dc-49bd-8763-e7ab6865a007", "comment": "Malware payload (Gafgyt)", "value": "4b8032b51a28348daef4aae7fb4ddb16abc6ec90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929201, "uuid": "59609567-1f76-43ee-b049-f0e456e21816", "comment": "Malware payload (Gafgyt)", "value": "80c1d44b39fde2db9a8ff57b5b7b1fa5421015c4d8cd35e66f6412731fd40d87eb4a871ed0782630fb69a58694d1a666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929201, "uuid": "82820248-3ca3-4f41-b0ad-85810c1c0579", "value": "T1A424D85E6E328F7EF768873047B74A30976923D626E1D685D2ACD1101F2039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929201, "uuid": "eb3e68d6-de67-4c43-be4a-5f841f3b5e90", "value": "3072:M45PdzG6qb4GrR9uddZZ6AM8MbAfEFSbz8wRZOlgC3olM5QYaK/:MIPxJqXRNj8Mkrb4eO6CaM5haQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752929201, "uuid": "88b0785c-a687-4953-8e40-2633b4b25efa", "value": 224712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752929201, "uuid": "b36bed9f-9e21-44e0-8384-057c29f2f372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929201, "uuid": "74366de6-02d1-4b40-9ddd-254d25d9185f", "value": "top1miku.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf39df4-6435-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752884323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752884323, "uuid": "f2a7a929-014f-4451-a17a-4ea4b863da6c", "comment": "Malware payload (Mirai)", "value": "d5d1834389f3873182b342c372b9386b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752884323, "uuid": "044e3b03-6477-4c85-8488-c44a94452d66", "comment": "Malware payload (Mirai)", "value": "a89f62fd0ccfa50d578db6d5eb9b1765df950dfbfcf6c80c00cfe6f5c639705c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752884323, "uuid": "7258e163-471a-4a45-9624-2769b0952444", "comment": "Malware payload (Mirai)", "value": "8f1dfe74008ed60db1c3845a0c960d6c36138fc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752884323, "uuid": "26733b9b-fe48-410d-aedb-6e65446e8400", "comment": "Malware payload (Mirai)", "value": "2553792bf8cf20cba40d1e4c8b9a451e67a353d14e964304831005c322a63a2d8d4e8dce32a790400344e94d8a0b396a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752884323, "uuid": "9036a8d5-6840-4248-8eba-6579f57dddb9", "value": "T178932A85B841A726C6C146B7FF5F028D371A57A8D2EB7303D9281FA07B8785B0E27746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752884323, "uuid": "868bc245-be31-41db-a286-a0bda32e7c65", "value": "1536:PCDhrt7Lk1LVnQvfoTkH23vzRfU2+93F78/8CzXP5olaOux+2brjR+5vwWnD:PCDjY1JnQIZlM2eV7kHzX+e2fnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752884323, "uuid": "348ae3f2-a45e-456e-b547-8e69bc0c3d9b", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752884323, "uuid": "f1d22e84-290d-4c44-bd6a-8719d023731f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752884323, "uuid": "845ab91c-e7d6-49da-927d-6e412237b048", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0e4a3f-6479-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752913236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752913236, "uuid": "c103a09d-33e6-451f-a2ba-5aba59768346", "comment": "Malware payload", "value": "f6c18f7b51605e3e07a0396bfb4f1013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752913236, "uuid": "fb632b98-9e28-4ab5-b9bf-c45e4a2c4570", "comment": "Malware payload", "value": "a8b50cc76fd80564920d6b3fa07f5a73fc135a156d73a80e27cb1fa83022af36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752913236, "uuid": "984559d2-eab5-4ef3-a97c-d469b390e99c", "comment": "Malware payload", "value": "0a7c827fbdf238781056e9e73231fe348c730cd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752913236, "uuid": "b52f4521-9424-4a53-8d65-41e49c92331d", "comment": "Malware payload", "value": "dd984cb71866936cc94d05471b09cecfc21490e6c8f38f8439ebc33312709df1db47bab92ef7faad60b11fdc09c9f402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752913236, "uuid": "7f371061-4be7-4f7d-a423-af486f6ff559", "value": "T193763843F66291F9C16AC174831A6232FB31BC4947247AEB5BE08B213E55FE06B3DB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752913236, "uuid": "f4b0d44a-dbe6-4f20-b7db-604e074780ec", "value": "c8028845ee6a58877de89bcaac4a34c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752913236, "uuid": "dfc1df60-dd2b-4e03-a4b3-692460ce34e4", "value": "98304:jegerBfBnSkkhhdqT38PRSxs+6I0rmfXOjFFvUuD3j66x3pq13GU5RIrRxvnuuYV:irSFS6I0rmfOk950nuPkR9Vttz/zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752913236, "uuid": "117d6c80-9a34-4737-b72f-fd0042469906", "value": 7234048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752913236, "uuid": "ec95c7ce-52cc-4cde-ad95-de5f00a8e4e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752913236, "uuid": "6badef78-3008-4c08-8375-240d0e2b5007", "value": "downloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9033e681-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1752933129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933129, "uuid": "361f7ac1-e73f-47b9-ace1-6cbbd16a49a4", "comment": "Malware payload (MassLogger)", "value": "841526e0e8336f29033ad925b8cc1b8f", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933129, "uuid": "e833aa23-e5a0-43e1-b3d7-25c70c550a7b", "comment": "Malware payload (MassLogger)", "value": "aac30dd7294c585502696af1c75347505541a6d0afadd79c221ec0a5bf13ae98", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933129, "uuid": "165e1e3c-5b27-4f24-b74e-368e5bbd6eb0", "comment": "Malware payload (MassLogger)", "value": "1affed9ed9c7a7b74b6c7aa838638d86ace6d2b8", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933129, "uuid": "56673469-84ef-4602-b069-015bed8929fd", "comment": "Malware payload (MassLogger)", "value": "82c14810604049211fe481fb7eb4ca6ab8cca82deb15a5e0bdd15f7e9da0a9ce466dbb63beb89208a6b7d37e97746b0e", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933129, "uuid": "6d0986d9-4bf5-4453-b3e5-2811cb79a95b", "value": "T148254A9D9471ADC2A014FE70E540EB97CCDB4789122747221FE2A4AA6213C43FF9B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933129, "uuid": "1a03d77a-09a8-4130-911a-56ea5e74c32d", "value": "6144:D4JrhojcJwgeHwneJtesNPBpeGVturBGdTcgoAQ9pJmoG2ZQ7y/eaNtpYU1R9OwG:MUzx2r1XIt4Rkt7RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933129, "uuid": "0183b53d-a17b-44d3-a8d3-5688f1f87f41", "value": 990356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933129, "uuid": "2dccf0a1-1c6b-4686-8c2b-c0765b150a70", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933129, "uuid": "afb1e08a-b198-4ec1-b610-e3d4f6fc2f40", "value": "ro990477632.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1ab4ba-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907921, "uuid": "a62f802c-2269-4054-bd73-6097d1464444", "comment": "Malware payload (Mirai)", "value": "50abeb9d586c9ff4bb18e284be94aedb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907921, "uuid": "a335af0b-a239-4be0-b1b5-bb37352dcea6", "comment": "Malware payload (Mirai)", "value": "abab1ff59308e72da5cdf3d90555169b6b83006ff3e5e2c1a4ba47850859da35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907921, "uuid": "21f3be22-d476-4923-8a7d-a139f019ff92", "comment": "Malware payload (Mirai)", "value": "1bf2e175c80ed5f36f7e1fde047dd664bf4ce0dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907921, "uuid": "84127139-f5a4-48a7-aff5-290bc6b33bd6", "comment": "Malware payload (Mirai)", "value": "185297a3c11b4da2505535ba6001f1d847dcf9bc6390aeed35e04ee5187ebd67997a17d326ffa66a7301d78f31ad7f9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907921, "uuid": "0dbc2f21-a448-40f8-90c6-b5f222be69b6", "value": "T1EA83192BA7A1DC2EC04753F026C7D8A2D412B63C1737615B77A47D69AFA79D02C2A307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907921, "uuid": "7a4712b7-05d1-434a-8494-5b299b399eaa", "value": "1536:9rurTVoIMDzgJYiwR4kBT/1FIMGhPQPc8slcmsi/Ca1:9r7DzcYTR4MAn8s2hia4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907921, "uuid": "648017f4-f263-4ff6-b113-dd8f091b260f", "value": 82801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907921, "uuid": "e776293f-b05d-4c20-928b-71875d724468", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907921, "uuid": "f19fc85a-ce10-42e4-b3ec-eeb659f84bad", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92f9f1c-64fa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968872, "uuid": "0f601b90-4e5e-4e5c-9657-fd214447d283", "comment": "Malware payload (Mirai)", "value": "2c797773c86a68d7739b614f01e89a4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968872, "uuid": "3c407dbf-c9ea-4e18-96a1-a98db83d86b7", "comment": "Malware payload (Mirai)", "value": "abd6e242320d953a9821b457985fbb2681c725dc148027ce55f11e4da680d179", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968872, "uuid": "809b8faa-3e1a-4201-93a6-7470fe5b1cf1", "comment": "Malware payload (Mirai)", "value": "10b3df79de8d62c89a14240e6185b906d894f039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968872, "uuid": "1ed703f9-8984-41fb-8360-a2ea54a46981", "comment": "Malware payload (Mirai)", "value": "351fb30c31000c89b4770a25f043c6e189673f66540e5a9f3255ec589daa89197e7e00e78904bfd806190a87e5c6cb2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968872, "uuid": "4de288b1-7a8e-4786-9627-60aaed96bf7a", "value": "T132144C46EB408F17C1D61B76BA9F42453323DB64D3EB33069928ABF43F8369E4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968872, "uuid": "c0c95a4d-fa61-4395-9773-0f3e352110f2", "value": "6144:hH9vMialpDo2N/PnSPr168yS3J0/HL/KsNXm31wPc/0Jdkj:hyialC2N/PnS568y0JS/VNXm31Gc/0J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968872, "uuid": "3786df8b-3c65-43d5-b038-70a44fd81d2b", "value": 208735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968872, "uuid": "68e6c2ed-5929-47a8-a310-7cd1d6ce2f78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968872, "uuid": "84c7bc8a-8e3b-470e-891c-efee71abfddc", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfab0e94-6489-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920377, "uuid": "968edbfb-34f9-49f4-8483-cc1b08e6163b", "comment": "Malware payload (Mirai)", "value": "82ba5a1320dc3316808870c26e77e317", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920377, "uuid": "dbc7136b-0037-4116-bc20-30c77778663e", "comment": "Malware payload (Mirai)", "value": "ac5c736e7496779d527805e065678903cb5ac5221dd73a7017149b51fbdef976", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920377, "uuid": "69eeaa94-a045-4f33-af62-93dec1af93e6", "comment": "Malware payload (Mirai)", "value": "143d583cfd9c3871a6fd2b0c4a3f4f4f8031e939", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920377, "uuid": "78a7ba53-667a-4efd-a33b-c57f462703ea", "comment": "Malware payload (Mirai)", "value": "2cc9c25e4575af54f0e5b019c3407a85f9dd87a9b957b985119dbc17dfac2dab4fec7387a06488bea63347d7c61e975f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920377, "uuid": "097e99c3-c9da-49b5-a24c-987637884405", "value": "T190C36B77C8256F68C595D170F0619F792B63A59082871FBE29B6C2788083DCDF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920377, "uuid": "a945eef4-6aca-436d-9938-64d344ddfa6e", "value": "1536:G/Sjq/HDIFiZgX8egqac++CCGKzKdr4O4Q2C27mWvZznFS/Cue7H:G/S2PDItr++j5zwuQ2hmWxznMKR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920377, "uuid": "4cc532b4-763a-46f6-9219-ad6979b6ba3d", "value": 121760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920377, "uuid": "02d8c001-53a4-4a4d-a292-a1fc01f13bef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920377, "uuid": "379da026-5daa-4e14-81b4-af3b4bed7aaa", "value": "iotmirai_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44723041-64f2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752965214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752965214, "uuid": "6c9b6407-bb62-45d7-9a9a-1962347317cb", "comment": "Malware payload", "value": "88d383f50c4b1bc3ca664a315d2a30d4", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752965214, "uuid": "1133bd2c-c7e8-41f9-8317-9d4b983d2c58", "comment": "Malware payload", "value": "ac5cb6e23b989a183369a7bebbe2c9cab407fdeffa1d89aa3933d281c4399fa5", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752965214, "uuid": "eb3d7433-70b4-4801-b8be-1f53ca0c7231", "comment": "Malware payload", "value": "20af1096ec84b63588f2ff0e5c6dfd8bc75db34c", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752965214, "uuid": "b96433a0-d8aa-43fb-a59e-b46d6003913a", "comment": "Malware payload", "value": "bc7412c016cc3cd8a0d6b0f3cad063688854b9f9c3b7df5f593088cbc08b4363b6112bb5a4285575c6fd44f3daaec03f", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752965214, "uuid": "9c5de966-a3a9-4912-9be2-7d0f83a3dae5", "value": "T10914BEE3C61AD78CF45054C1E12B2D1807DF73BAB48A25A50D6C4E9FB85CA24D8E35BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752965214, "uuid": "fbe6a806-7cc6-4e1b-baea-9c139ba1f279", "value": "3072:OjMtP+jZew1qqAa8yhsnNkUwFd1uvLej9gL7prRcaTsKRvIcUpeN7gFk:jtWteMq1aNa9um7pvTsKVIDq7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752965214, "uuid": "3b30befc-621a-4711-b0bf-815d92ead91c", "value": 193686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752965214, "uuid": "fdcd80c4-246a-45b6-b003-496864e9d49d", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752965214, "uuid": "cd631116-a181-46e6-9df9-d96db4b85d2d", "value": "WATCH_MOVIE_GO_LBYEMSY63.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10855ac-6460-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752902743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902743, "uuid": "1610c88c-6aad-45c7-8351-5b7b7f59fe81", "comment": "Malware payload (Mirai)", "value": "9c93e3de45369468557223bc4a70d85c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902743, "uuid": "102b4ff2-457b-4309-a745-d195774afb09", "comment": "Malware payload (Mirai)", "value": "ac82b86ae028ebacab7d20067c97513ed8ee9d19ce18e8d8dded484e4c850da5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902743, "uuid": "bcf4af32-ced2-4c81-a20b-f3fe5524d1c9", "comment": "Malware payload (Mirai)", "value": "5f47cdfcbf8de527eeb2a9f6d02e7c73a6845379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752902743, "uuid": "92d8af54-8a49-4d74-b94d-6f4c098baf59", "comment": "Malware payload (Mirai)", "value": "67b3280659624d80b25a3ab7371629813f97707590754aeefec7ba9c7423dfb5754afa159d612350e888737ede6d8e8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752902743, "uuid": "96449d31-409c-4d17-adc1-78d33f66bd15", "value": "T17C630995BD819712C6C255BBFB6E424D371B03B8D3EE32039A25AF31378B46A0E3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752902743, "uuid": "481e564f-8074-4fe0-ac4d-841b45da12f0", "value": "1536:xxw5/6xehHN9olO0zzzsIVlEOiYG5F+g92jEl1vH:xxw/FrolpzzJVdE4Z+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752902743, "uuid": "04e6d0f6-a724-46ac-83b5-27fd33a623fd", "value": 67056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752902743, "uuid": "de346f0a-4d7a-47f5-982d-641c5a91120f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752902743, "uuid": "ff47ddb7-6b77-4fc1-adb1-dc0c08e157be", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5771b1-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1752933120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933120, "uuid": "af49cfe9-1046-4dcf-aff3-c4c6228a1457", "comment": "Malware payload (QuasarRAT)", "value": "42641347b9f9b709fff36e8a928c8023", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933120, "uuid": "0214bdf3-629f-4700-8b04-268968bcbd28", "comment": "Malware payload (QuasarRAT)", "value": "ace3310f949dec39ca76b98fd12af49d3f7b57ef5eb0b4b536973f4652bb6668", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933120, "uuid": "36e66c7c-3c2a-4eda-8f08-ddbe71b0c2aa", "comment": "Malware payload (QuasarRAT)", "value": "604a4a00fc5d62898bf632c3779afe6acd9c17cd", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933120, "uuid": "6f075b71-bea8-46c5-b05c-9b45a643bacb", "comment": "Malware payload (QuasarRAT)", "value": "ead4f2fd9886201ea77239e61bf4c26a59f62ab980ddc2aae1079a64255e015381fb0fd8471295f201cc47a698af347d", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933120, "uuid": "6d3c773b-8d0b-4e9f-b52c-427b0cf84a51", "value": "T13B2502154AC83FB9DFAC5A18D0FE1B1F63E04A8A401675CEEB33BE8A9FE75444507198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933120, "uuid": "c9e32a72-7b1a-4c25-9e6c-fd0b91463ce5", "value": "12288:l9Ft7R3yYPmWzZTij2lmebHQ5+fPiLWLdTzRsyk7MLFBMRzG0H2/bVy5QSE7:l9F/yYvZTi6jbHMUPaoTap0OdGFbVkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933120, "uuid": "75ad3659-2f25-446e-9020-f044bcb23ce0", "value": 1035793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933120, "uuid": "d71a0078-b37e-44fc-b9a4-3792a5b5d7a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933120, "uuid": "d33a6dbc-b835-4931-af6c-7d66d7a82b20", "value": "hbdzos.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1422e75-64ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752941371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941371, "uuid": "85fd5c51-d14c-43e2-90b0-c10b7c0ff198", "comment": "Malware payload", "value": "ac5c033fe5f66a863723670851f98141", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941371, "uuid": "18e69701-c81a-4294-bab1-939e2e89e25f", "comment": "Malware payload", "value": "acf78180397c79942613a9893da2626155161f1b147aee2f22fdef578b562777", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941371, "uuid": "373a2ddb-4c43-45f0-ba99-f5583f47c3dc", "comment": "Malware payload", "value": "190b0623a8007df0a481ebc61ddaa08cd323686d", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941371, "uuid": "870c2d8e-1473-47ef-962f-da36df6a3f47", "comment": "Malware payload", "value": "eef8449c88564fbef62e0a1fe3dce98857c41104ce8b93c23de7e80df4a3a02e466814ec741cf5f1da5c2b1645581f01", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941371, "uuid": "37ebf6ab-0d83-4561-85e4-6ac97fe06ce2", "value": "T1542733C2BF16259D937B19EF329D02DAB16E472777FA1C85E04223464253318C3EB6B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941371, "uuid": "ed68ca35-bea9-499b-866b-b7d9c2e9c926", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941371, "uuid": "d33d9ae1-4bee-48b5-aff7-20a67969a20a", "value": "24576:WzZd8Yx07mcEYE+yRRqmrGCz3BvE2WikCFyweqVHws09RAk:WlxPtbF8mhvaCFAqlQXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752941371, "uuid": "874f831c-64f8-4ddf-9d46-176f8266d2e4", "value": 20971505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752941371, "uuid": "67a8409c-8b7c-4a56-8239-07151cce5edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941371, "uuid": "8b70befb-6f73-490a-b7ee-719b3a3f98be", "value": "\ud835\ude68\ud835\ude5a\ud835\ude69\ud835\ude6a\ud835\ude65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e70bc77-64ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1752935112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935112, "uuid": "6437d527-2326-4217-b1b4-398eea05d52a", "comment": "Malware payload (DCRat)", "value": "c346c56f8c839f815becca2acfccca14", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935112, "uuid": "95667c8d-5a93-4ebe-bda3-02c922f923f0", "comment": "Malware payload (DCRat)", "value": "ad8a9a7b26fe9302ae52ff26fbb84efbb129f28aa37c5de62c7a04905bee32f9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935112, "uuid": "40229e79-c734-4030-8e43-aa6786b49d0e", "comment": "Malware payload (DCRat)", "value": "75a19b3a266424cf7b81d3c00914a355b10dd3d1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935112, "uuid": "7ab904e2-d45e-4cf7-a5d5-3dedc9561f21", "comment": "Malware payload (DCRat)", "value": "b511569505a45e325c7a602afe59549bf50f133c575b46f9a4cf4e270b02736bec41a3a00bf34a28aaba29b58c445857", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935112, "uuid": "d325410d-945b-45b7-ba66-336a8bd575c6", "value": "T1DA759D06BE44CE91F0191233C3EF454847B4A9516AA6E32B7DBA37AD15123A73C0DEDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935112, "uuid": "823c5929-787f-4aa2-b827-5d560a5eed08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935112, "uuid": "10607dc2-a379-481e-8a27-622abd35f14b", "value": "24576:KUManoGojyGz3d+SdtP73clEuwRalmsVE4x5HzAUs7s7xjh/PZnf4ZAmK0Iq3Lc:Kza6jpdJVDcGHAssVFlsgNWW0T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752935112, "uuid": "eb498c32-acce-4953-85b0-aa0dfa1409c0", "value": 1702912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752935112, "uuid": "8feade4b-bcf0-4d84-8e22-0651483ea302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935112, "uuid": "32356894-3753-4982-b3f8-e410b284905c", "value": "c346c56f8c839f815becca2acfccca14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86e93b3-64f7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752967663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967663, "uuid": "a4507b6d-3c0f-4981-9d08-ef9245a65c94", "comment": "Malware payload (Mirai)", "value": "69f5cbecbbff1247cb12f079431780a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967663, "uuid": "1ae61d06-600d-41bc-85fb-f00c680d1d93", "comment": "Malware payload (Mirai)", "value": "ae339e0f3a136f1f000410330bda96d67c5fd413be04be622338eef579122353", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967663, "uuid": "075f0c37-69ab-432a-9996-298c0de06a5c", "comment": "Malware payload (Mirai)", "value": "a8a6402ca52da656a3f571dd1540acd14e4d62b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967663, "uuid": "5df68219-9aba-4504-b512-db42af5e79e6", "comment": "Malware payload (Mirai)", "value": "f9495c60b62122fbc2846d13f45e26d2f78171a75b1d8a1dd4805fcbe54ef0539f1e42cb5da0556d3693798bc7ce5b12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967663, "uuid": "210b4aea-1dcc-459d-8b32-b0b60a803869", "value": "T17AB31A96F9819B21D6C215B7FE1F518A3313077CE3DE32139D285B607B8B86B0E3A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967663, "uuid": "d4123bad-bceb-4a32-b981-f81ddf75f21e", "value": "1536:uAnz0DAlddD+9ilMfhjC86qHAfawEfUfXIQY9cMpiL27mQ6HkynrL5bZYumWwZ:SKddq9+sPHAfawU6b27mQ6HkynPn9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752967663, "uuid": "98abf97f-1b20-403d-ab1f-e3e2a7d1fbec", "value": 112076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752967663, "uuid": "bd719741-cc23-468a-8789-8953f005de33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967663, "uuid": "a5fbc5cf-81df-4a61-9b06-8e31617e6912", "value": "dbus-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682ec99a-6492-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752924042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924042, "uuid": "f22a2c31-4389-4073-8149-a2a3be4d9418", "comment": "Malware payload (Mirai)", "value": "7cca40c26d8cb957886e6df76a22b52c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924042, "uuid": "aa5633aa-67d8-41e3-b37d-e66850a19a9f", "comment": "Malware payload (Mirai)", "value": "ae478fec126ad5b9e5f9c39c1112e14832e16d1866917e71a9e7aa6a6ad884e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924042, "uuid": "3f3aecf9-1662-44ab-9f02-f53524d788f5", "comment": "Malware payload (Mirai)", "value": "3e3ada1ecb97369d101e2aaca70ad2542b6c3efe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924042, "uuid": "cd8bc536-32b7-4a3b-b649-a94791536c1a", "comment": "Malware payload (Mirai)", "value": "9b35bb0d7e931f9e71cc3cacd2ffb1de979dbb338c92480900127f113b9d577871dc54b6ce1f8de54ecbb67a500eac53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924042, "uuid": "c757a069-4c5c-4c19-8264-6bb6b651e03d", "value": "T1345180E59117D23A3CD1E922A1A7803DF1DE699935D53E02B9EEBCB991CCD04B050B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924042, "uuid": "040dbd0f-6294-4533-a352-55d511a713f2", "value": "48:ivKozLvc8zLvDgdzLvH4zLvVEzLvfk1zLv7ahEzLvwQzLvzszLvUmzLvV8zLvx08:iv3538d3w3O3k13kE353o3T323y3K3R/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752924042, "uuid": "8a7bb54a-66b5-4d65-88fb-d7b7ce5e4933", "value": 2869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752924042, "uuid": "1af74db0-b813-48ec-b939-88bf42943d05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924042, "uuid": "640f20c1-cd9b-43fc-b5d6-72fe9dcf23c3", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b4bba9-64c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946179, "uuid": "b5d9d2ed-b299-4e72-9d7f-313581939e19", "comment": "Malware payload (Mirai)", "value": "62556cb71ac86c77246618d80504a3f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946179, "uuid": "054acf19-9911-48db-910a-84f98c57ce2f", "comment": "Malware payload (Mirai)", "value": "aea80c6568ebb35a7e721b6bec0e896e3fa5a8034d94d51abd9dca5c9a84dfc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946179, "uuid": "a63e19f2-8553-4d6a-81cd-0d632607a820", "comment": "Malware payload (Mirai)", "value": "bc769a2784fcd89540609ae9eaab93d39062a196", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946179, "uuid": "96721c4e-dc60-432b-a0a0-fe2a6a012af6", "comment": "Malware payload (Mirai)", "value": "d7c46b38eea709bbece0d730200610e23adbaf578e68eb0e5701257fbf9d66e1753cfa9331c41f865c260cf8784b0029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946179, "uuid": "eab26dbd-5177-49bc-aaab-4b071df8ea43", "value": "T1E9B3AE87F74714A0C8668BF007C74B9E6E232221CF5BE9E76C0E293A59794DF191A7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946179, "uuid": "c080ea23-425b-4a7f-b052-8056c856ae69", "value": "1536:ptFl7KNT5cLY2aOLxnCyN/Wb8TwEV1BSnlx1h78RZUX8cx8Jngafy5/LWB:pV7CT5cLY7ICgg8kGBSn5hYRZm8Zgpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946179, "uuid": "e7b26282-aab8-4e2b-8329-33cb189d1fba", "value": 116392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946179, "uuid": "cfff2e87-120f-43da-811d-496219d20383", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946179, "uuid": "6227068a-9ff7-4cee-aab6-38ccceeb85e0", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbd4afd-6438-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752885507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752885507, "uuid": "a81f97c4-ba62-4f26-9d5c-ab33eebe10b1", "comment": "Malware payload (Mirai)", "value": "31cca6dd540064acaff5dc1ccfcb9b94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752885507, "uuid": "36b1ebf9-cb04-4cc7-a793-c0a4f3208d35", "comment": "Malware payload (Mirai)", "value": "aeb7019538d25d2852959931b8dcecea0d897d0d5a3889f99cd3b32d18d3b121", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752885507, "uuid": "d517f6f9-de57-4f1d-b4f1-1cbc98a50f75", "comment": "Malware payload (Mirai)", "value": "ff53c9f3ef815eff67e46f1ca169f19380bb72f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752885507, "uuid": "cdf37997-cf72-420d-9256-1b2150d3f741", "comment": "Malware payload (Mirai)", "value": "948f264f81daedc2efb163c3bc4baa71cfe82a6b57246d13125bd5999ca9b0e45839d31629f8e79b80222aa9409b3f89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752885507, "uuid": "84a5b94d-86f8-4ad5-83ee-14baa922719f", "value": "T108933985B841A626C2C116B7FF5F028E371557A8D2EE3303DD286FA47B8785B0E27746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752885507, "uuid": "a30a7a24-350e-4bee-b3d2-a8545475c18e", "value": "1536:8N1WaaApnDumqOIt5Pp5UOvzRfU2+/uSNNoYywJryl1ObTBdDicfbJYWnD:8N1dJDumqN5YcM20hNuYywM8iEBnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752885507, "uuid": "a4f5dfd6-2480-46cf-ae67-b7cced598450", "value": 90200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752885507, "uuid": "d3988bd0-8646-4c9f-a95d-e6850c0a4727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752885507, "uuid": "e74319b2-a591-4e4c-a952-48ce8fe39fb1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8301a0da-64c6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752946421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946421, "uuid": "f9b85387-1b5a-44ac-a8ff-f4eb419d8f2c", "comment": "Malware payload", "value": "ad2cd3d5dbf2f5677e892cec657e183a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946421, "uuid": "52513d70-8746-4e5a-b3fb-e66f5bade320", "comment": "Malware payload", "value": "b0eb200c589a78e19d17b196e22d217694e95d2152b3c760ffc74e68c809f103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946421, "uuid": "39018f66-0c5a-412c-98ce-81e9bf527117", "comment": "Malware payload", "value": "993662439c5ada6ec80fbb18f45c0c4d3f6e79e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946421, "uuid": "ef8d8837-f8c9-4936-bf26-1b5950b18521", "comment": "Malware payload", "value": "0e696ce9be40b1e980778d73e173e345096fcceb3869d848b41811549ee85b209b181736bc9738c01e870ac109aa35df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946421, "uuid": "97566428-2f7a-4859-8958-366015b1a529", "value": "T1C13309D7F800E9BEF80ADB3B84570406B130B3A50592173663A7756BED762E50877F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946421, "uuid": "c3a8237c-2211-43c1-bbf0-d09f990a167f", "value": "1536:w9FxZY4Ex8Iyv39T16Gm2mT2nDsxeymoKK:8ZY4Efyv39gGLm6qzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946421, "uuid": "7378e4fb-7eba-4470-b734-89e671c6f422", "value": 53948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946421, "uuid": "b2fca50c-1994-4378-817c-c4ac7c0f8ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946421, "uuid": "0353f73b-4afd-4da0-afb2-c12dd6444900", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab4dad7-64f7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752967667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967667, "uuid": "f2a84df0-a202-4df0-8601-87d672d1cf87", "comment": "Malware payload (Mirai)", "value": "e0c6a249e0467d42f5a98fb160d8f4b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967667, "uuid": "c36c5145-23de-491c-93ec-9183c00bb49f", "comment": "Malware payload (Mirai)", "value": "b0fc4bef48e5109478919a5b63475d5ffc8826a8946f6f2ebaf5e9e1c21b22ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967667, "uuid": "e0bdedd3-7aa3-4169-ad20-8fdfdbb06907", "comment": "Malware payload (Mirai)", "value": "8f6bbfe9aff6c60cdf1dbf319fcade240fdf0a45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967667, "uuid": "235ff9e7-a011-4543-b98f-5f0455c48c47", "comment": "Malware payload (Mirai)", "value": "d9b0fe22d0dd51a652902ec4abc1821a4de6a362eaf0449530d0df336866393b06ca9e8a0df78e07c13e43ef9ac7d9a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967667, "uuid": "e33c99e0-4e08-4250-84f6-6e7ced18ef92", "value": "T1CCC3C70E7F219FBEF6A8C73447B34A20975923D623E19685D2BCD9141F6028E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967667, "uuid": "74dcba98-2757-42d4-bc2a-91a73937e963", "value": "1536:FX4fQfgwHrIfvCJaFsavvUtD3SJLRfJ4ZIAh9+7RQ+5nCePhcv2W1qejdvXPmWRF:FX13avcTSJLRfJ4FQ5nx+v2SdfP9RF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752967667, "uuid": "9d52d311-1bc4-421a-96d5-907c7b176afb", "value": 126688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752967667, "uuid": "10de0173-5eff-4445-b1ae-97949cb0519d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967667, "uuid": "c399d247-73fd-4580-a3f3-27c21b4a664d", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b23e8b4-64ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752935053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935053, "uuid": "5c3fbe1b-5d37-4e1e-8111-ade469a98e2d", "comment": "Malware payload", "value": "1b599093750d55ebb9839260bd3d78b9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935053, "uuid": "4ecfa301-2b8d-4ea0-b0c0-c32c853cb27d", "comment": "Malware payload", "value": "b1b9ab4c00a571dbd60efb68a9cc580615a5f645018683708c1c713774186e77", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935053, "uuid": "cfb23733-24d9-486e-b43a-6c242e435137", "comment": "Malware payload", "value": "7b5c426d621f2127cdca95e009b10481cc9f47c0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935053, "uuid": "d8003f0f-d2a3-4165-b3a5-01a618146dbf", "comment": "Malware payload", "value": "f7059a3c77da03c7dccbd0a88d81f7a304256f57a0980f0e85cd22089331756bdb8f573623fbe346d81cebb40d7131e0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935053, "uuid": "31224e06-c604-46a7-aa00-63db31522c5b", "value": "T1EE51860326489234AD66039F563E5DF4FA0795D4528124BE20FF645914037EDE1BF0BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935053, "uuid": "21ff96ff-a36f-42cf-aa18-541287f0da80", "value": "48:Mk4kL67qKMHJm2Mu6pwKGpk2shWE9KGnKGIH50h3wQohJBncK4rehiLK48UP+7K/:Mk4kL67LMpO4KikRKeKvZ6wQbKmLKfK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752935053, "uuid": "1657cdb2-a704-430d-b081-7ec51f45a902", "value": 2797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752935053, "uuid": "6f6c88ae-a8fa-441d-bb29-8a1db0452cc9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935053, "uuid": "610d6aa6-4610-4f1c-bcee-75ef4e1731ac", "value": "vin.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74afac0-64fa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968869, "uuid": "4f67626e-158a-4e4d-b729-e2ca5571489d", "comment": "Malware payload (Mirai)", "value": "3302d7721a68867ebcb409c058553be9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968869, "uuid": "f267a61a-31d3-4ef8-b93b-c1d25b327ffe", "comment": "Malware payload (Mirai)", "value": "b1ce8e37e5125d0487f0409eb82c4f4d27ff2862fdd8ba12be8896a47970ef61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968869, "uuid": "1c00c2a5-96ed-4a06-9c1e-2122892599b2", "comment": "Malware payload (Mirai)", "value": "963b08a3b418829e6957ba74a7625ee629ce4937", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968869, "uuid": "faca6a2d-19be-4409-9570-0dcebd6463fd", "comment": "Malware payload (Mirai)", "value": "b9236341ccb0e79fe152106dab27cd186d656821a19ec7df175675c4301db135f6296caa0299703f8f8834f03ff362fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968869, "uuid": "da878b3b-5586-4e0e-b0e9-a094834c27fa", "value": "T111034B17B7693A07D1D0527F10EF8B1699696BC468D0D62FBE320E6E4E723402D16EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968869, "uuid": "98096f8d-a29d-48cb-8ebe-b914da2282d2", "value": "768:jH/pqy1434IAgBZIlcX4ZnBVE8k4sjENKlDa4:jhdZgBZIlG6Pi4sjrDa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968869, "uuid": "a8efdbaa-b491-4f51-9d13-b8ed6861cb16", "value": 39520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968869, "uuid": "f488ed4a-f16b-49fb-8537-2be52f01baa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968869, "uuid": "1562b70f-e068-4109-8c46-543dcd89db58", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94fa864-646f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909253, "uuid": "751a858d-824c-44d9-b8b8-6278efba3370", "comment": "Malware payload (Mirai)", "value": "5669dc9ffe6aec4eda803945ab5b6391", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909253, "uuid": "9cab0099-cc27-41a9-973c-13da489ebd1d", "comment": "Malware payload (Mirai)", "value": "b23b9e4879d84c049c2244baaa36ac07e632d9d99862c5f166e6fbfeda667d9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909253, "uuid": "bccbefcb-1e18-48e8-a545-9146e3793e0b", "comment": "Malware payload (Mirai)", "value": "7206785a566d2e111aaa1550510d3ba407468431", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909253, "uuid": "955dd444-7df8-4b20-91ad-0af8f101b8e4", "comment": "Malware payload (Mirai)", "value": "cacf78b395d41b406bf3c0148ecc2d101bf6b0870ac7b6f7b4ca4eec073cacaa4d7617e4ce65bfa783bc994bc649e9c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909253, "uuid": "7e030bb4-4177-40a5-ac42-8bfaa1198afb", "value": "T17AD32A56F7408B13C4D61775BAAF424633239BA493DB33069528BFF43F8679A0E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909253, "uuid": "fa49d104-7176-42be-9d81-f95d74b814d2", "value": "3072:5E/0qw7nPjaZE6HrE8ZnRmgBaqDmT/nM/9gL65N:5U0qwrjaZE6HrxZnvjDmT/M/9Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909253, "uuid": "48e92bad-081f-442e-bd7b-a58cb597c6f9", "value": 136521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909253, "uuid": "853032d8-108a-430f-9a37-81a0ac3bfb7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909253, "uuid": "5b8aece9-b5ae-4dc9-8a11-8adf13a13e2a", "value": "nexusnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14b4548-64ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752934875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934875, "uuid": "b30a4cdd-be82-4365-bd73-08f582d38a73", "comment": "Malware payload", "value": "b12607a60448cdfd498f5074254ebf37", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934875, "uuid": "b44bcf65-6391-4058-938d-1bcbd1015fe0", "comment": "Malware payload", "value": "b25c7c09f095ec01b437e2c8202fdb60c026a5538768bb3ab74bb64712892e1e", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934875, "uuid": "f557bdc5-0c53-4e58-9d4d-a7b2da445631", "comment": "Malware payload", "value": "76dbed024e5d832cf6b1fe6969ad7992c6423abc", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934875, "uuid": "7d5048eb-b30e-48a2-9bca-14a6cce73092", "comment": "Malware payload", "value": "ece3ad03608cc41788c82e1bd3d9fced7102b22faeab2856f8db8cab110aa5cb749945ac8076bd64b99da979afd71415", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934875, "uuid": "999c5347-74fe-4535-b650-31e6a60ff4f1", "value": "T10A049E6D7F176753C4B7425085BA88D899E32241AF5BCE3A107B8B6C7FCC18A723A147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934875, "uuid": "4b85a7e7-735e-4d96-a3fa-786a79b12244", "value": "384:jehRoCYDmPHdMKcCq4PQ7qlbkTYmydtn6ZG87cYbGpTEhJ+hKTIwn5kCW5PtGEHv:w3QJXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752934875, "uuid": "5c385a99-7838-48ae-8762-4adb532609c4", "value": 174096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752934875, "uuid": "f3578067-bae7-4118-b5c8-061a38a70c0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934875, "uuid": "d6d21ce6-bcc4-4211-b189-173e1130beaa", "value": "HSBC25250094.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ba9cf8-6470-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909323, "uuid": "8e78fc1a-c163-4cb6-bd53-3e26c154589b", "comment": "Malware payload (Mirai)", "value": "682fd4847c880d09591c10db7d03aac0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909323, "uuid": "cfdad1a7-7713-4c2f-9ef3-6d9cb3b291e4", "comment": "Malware payload (Mirai)", "value": "b35472390d2b802000920260e0f50af9449c027a8548da6da94a49bef4ec273b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909323, "uuid": "a05db5fc-c7a7-4a1f-aa3d-44911ba4fa77", "comment": "Malware payload (Mirai)", "value": "45d8eb7d1d305d8e7ab81d4e19765b09d4320bdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909323, "uuid": "79e3986d-b29c-4ba5-ba02-fa9107a095ad", "comment": "Malware payload (Mirai)", "value": "f9250cc83c5203a417331c4febd1df0d41347d7d2eabf7cdfedb4e123c19688013a41bd0e9b2ca4570ccfa14a7d4dd8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909323, "uuid": "9a38ff7b-4bee-4cce-8df7-d09761a54584", "value": "T11663D615FF510FBBC86FCD370AA91B0239CC558B22E57B352634C968B65B60B49E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909323, "uuid": "408b2537-f19d-4cb5-bf0a-37bd44bfba6d", "value": "1536:DFfqgA3Ew1quYhY9l2FWcYgZKTo77guy:DFfqgGEk2UcYgxDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909323, "uuid": "f4b39ca6-579e-4239-a539-b05491b5b62e", "value": 73328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909323, "uuid": "a3b36518-2f18-41cb-8929-07e49534a2eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909323, "uuid": "becb90d4-b3cd-44c1-9a36-231ac94f9e53", "value": "nexusnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1561fd-6461-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1752903005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903005, "uuid": "36d2e581-74bd-4fdc-8f37-75bd462a524a", "comment": "Malware payload (RedLineStealer)", "value": "78b0feb3ca5ce083a5de769450825fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903005, "uuid": "2c5f4caf-a20b-4f4b-8e96-7561680d4ef4", "comment": "Malware payload (RedLineStealer)", "value": "b38da7b718e5c321db22878da1bc0a0bc40fa55d81896fceb82812814fa9ec63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903005, "uuid": "e71d9e45-6b8b-451c-8fce-51e41971f13f", "comment": "Malware payload (RedLineStealer)", "value": "3e775a100c3ffa50996b4eadb333e93a371527fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903005, "uuid": "e6cff07b-c2f7-46d9-bee8-758e79b68874", "comment": "Malware payload (RedLineStealer)", "value": "83dfb5e2da11ecf263ed15cd75a0a08e26aacfe90a622547d3cd04984f3f1e216c86d68e4d42bc3e7f85eae58cd08682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903005, "uuid": "60bb9b1a-7e7c-40c5-8d4f-1f6d3552a295", "value": "T188E4BEE4BB40C425C85B5B79C4379663A473A25EDD68DA0E28D6FF4B3D32346801BD8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903005, "uuid": "b0ca4cf8-8496-4d96-958a-7858b720086a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903005, "uuid": "d7d6e422-33c4-4a50-a4ad-c4a70b22d5f6", "value": "12288:xpc6iumXfEV8xdgea3fIbDCA4pY2rMNPGNYNKd7Tvb9OhidAA:cRvg/fIyArPpyY4tFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752903005, "uuid": "18a9f4e6-3327-4833-ab7e-12d70632196c", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752903005, "uuid": "aaa5f9e1-0b72-4bb5-ab9c-60892cec9d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903005, "uuid": "aa83469d-48b4-42e9-a840-ab5795f6697a", "value": "78B0FEB3CA5CE083A5DE769450825FB9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ac59b9-64a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752934044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934044, "uuid": "2b6c3986-3fb8-4936-8494-02b97727bbf7", "comment": "Malware payload (Mirai)", "value": "a9412642cbb00016f6a2525b3c48034f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934044, "uuid": "4920e65b-1bde-4a89-8d49-0025b340adc1", "comment": "Malware payload (Mirai)", "value": "b3f1e7014dfba66c06190cfa803ea2dc947f59a0b6f437f3ec6f9263b34cb4a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934044, "uuid": "5537f3e2-6efd-49c3-adf8-d8bedff9deb4", "comment": "Malware payload (Mirai)", "value": "d4f5f79f9cbe0fcc79623ff3607c33c1dadd1ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934044, "uuid": "a38085cc-22da-4b50-8425-ae64ec069fcb", "comment": "Malware payload (Mirai)", "value": "10d3cf05e21ffe878ffd6218a40a3fb2c2fe850683c202eaee29a8ae9ab9d454f4c2ade39c9008f597488327583cb11e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934044, "uuid": "72a67909-5724-4493-95df-6a1bd75fae40", "value": "T131E37C73D8356EA8D210C9B0B0609F781B63956485872FFA58ABC3759043DDDFA4A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934044, "uuid": "0f2b95e8-76a1-440c-ac4b-5935c47721e6", "value": "1536:4qGvWhsWtBu7gqRnFjoYfDC2FKWQKQ4R0unlFtqWVaR1jyI/czo93W:4Rsft47nzoYrjMWx0ulbqWER1rFtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752934044, "uuid": "414eef85-906f-4d18-9ac4-77592ce89031", "value": 154052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752934044, "uuid": "1bf4118a-d818-411a-b9db-bd4317f5bf5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934044, "uuid": "9aee013f-04df-414f-b7fd-03fe1ab4deee", "value": "top1miku.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d8db1a-649c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752928358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928358, "uuid": "f5b13e07-78d7-47dd-acdb-67040624a71b", "comment": "Malware payload (Mirai)", "value": "b6846a96fe4256a75312f8b32505e114", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928358, "uuid": "4091e971-d944-4e1e-8aab-dfd9b78d1b0e", "comment": "Malware payload (Mirai)", "value": "b40189b56d6e902a21d45b28a9a5aeef87f311628872922e510cbbfd19b6ead6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928358, "uuid": "60e8d0ab-80f5-4ebc-891b-b88fc7eefc73", "comment": "Malware payload (Mirai)", "value": "777bae3d80d55d1c1a142835f8e87268846650d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928358, "uuid": "ab9c38d0-2192-40c5-84a8-3f2ba7ceae9e", "comment": "Malware payload (Mirai)", "value": "692bdc7ed8d0c2b7a6250bff85d2a95d4e52704e3c4eb792726d589800cb66cf3ebc65e11054bcd8943dff1c076508ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928358, "uuid": "0a945398-6d37-4af7-b8e4-fc2d962b2ff9", "value": "T14B043B46EB404B13C4D627BABA9F42453323AB64D3EB330699186FF43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928358, "uuid": "c7e1abe6-77ae-47cc-80a4-8b5c31f41cfc", "value": "3072:0FbsXpGGV2f+qKYvtadHbZbzoK7VC6Gokk98GQvF2RM/9abIsHcmhwwD/Y:aIXpGGV229otadHbZbzX7VWob9FQvFAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752928358, "uuid": "de97eaf3-007d-4af7-8c77-01246670d53d", "value": 173447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752928358, "uuid": "7b46cc06-fa4f-4118-a9ea-d0219e9a49be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928358, "uuid": "25035790-748a-4ca7-bd9e-5c571d4e85fa", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fa6d7e-64f7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752967666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967666, "uuid": "bba0f7f4-9fce-4805-913d-ee2448c3ba3d", "comment": "Malware payload", "value": "653e67bd7cc6e032db9d350c5c93f63d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967666, "uuid": "6e183676-48f3-461d-ad52-4488bf5f4ab7", "comment": "Malware payload", "value": "b4c32f6a64802b1f208f15f2c7969265ce72ab707ad9a9aa53cb4d22503451df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967666, "uuid": "23702707-d5d7-4bca-9296-78cff088581a", "comment": "Malware payload", "value": "b06b08ae9b142f8a3db97176dcfc504a89c0fdbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967666, "uuid": "ffc48d98-e087-4938-8938-5038b8628492", "comment": "Malware payload", "value": "a31780c70028cd32e2237d892976cbdba93e18386dc7fca1c983f033d7b9a781f83e6f2b292867339a25425008dbed53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967666, "uuid": "74b06aa8-cb0e-46f1-bf9b-0e28df63326d", "value": "T1C3A38289F924937EC6E17BFEF75906CE7B390A68B79333159A3549603BC8B10AD39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967666, "uuid": "c0a56f1f-6afb-4304-9db7-3f15bceca433", "value": "1536:LrS2LvQc5NtN9cFImev3HQvziUXZrhqWxcnxE6The1cCnsR5:LrScfNb9zmev3HQvziTZE6Th6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752967666, "uuid": "eea2af6d-001e-4132-be11-181e1dc1e9b9", "value": 105676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752967666, "uuid": "e8cdb4da-e2f0-4946-ac21-3e75445f9d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967666, "uuid": "0def8fb4-5122-438e-ad55-78cd7b1814c0", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c3f2f9-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919768, "uuid": "09f50c70-296c-408f-87ce-9acf6c4237ee", "comment": "Malware payload (Mirai)", "value": "5277fca2e69093a1818e103d8d2c05b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919768, "uuid": "6c27b427-bbb8-43f5-ae1a-c51612f62e3c", "comment": "Malware payload (Mirai)", "value": "b4edb067bebe60d57f1a7a608e9177e9e5af3d87e18a15689adad7e58ee095cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919768, "uuid": "91ea7778-df83-4a93-b856-96be445b9aff", "comment": "Malware payload (Mirai)", "value": "2e491503656bfebe3202321aee1233e27ebb1d97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919768, "uuid": "18644951-76fc-48cd-b385-930cd8112d24", "comment": "Malware payload (Mirai)", "value": "6a7c6ce53d29ba88b32bd2d01532af91ead5151130e875599a603ab90ecab1272e33441baf8722e26a0f69d093628985", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919768, "uuid": "1726deb2-4a44-4d70-a9eb-0b0976ec99e6", "value": "T103734CD9A8025E3CF85BE6BD94220F49F920231557D30F2BA5AAFDD3BD731549E02D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919768, "uuid": "8f2e223c-5f55-4381-a052-6d7d74a22964", "value": "768:beV8Rybk/IC0kYqyZb5KwXpTjnq1kex6O2oUX2AvDqhud4amJsSrjPKP88gd/K8+:bv7Gqyl5Kwv4kXHqwWaQrjPKE8gdS881", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919768, "uuid": "55d6254f-ea12-4952-8f79-d7ca8d5e6402", "value": 78804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919768, "uuid": "8bf6ca43-b3e0-4247-b598-2122b87acc63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919768, "uuid": "421e5954-a4c5-404d-b77a-e34252bed62f", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2db38c0-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907927, "uuid": "9eee18b5-a47a-433a-85a1-aa26e87d4abd", "comment": "Malware payload (Mirai)", "value": "70965c7cc36b75eefbe6adcd87a7716d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907927, "uuid": "f7c3689a-cddf-4285-8bb5-3b2fd73f26bc", "comment": "Malware payload (Mirai)", "value": "b4f74e77b171c6a4315f6eb7eeee52929042680b1a88f0cbba070a80a7aaa09b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907927, "uuid": "342c7c33-85dd-486e-80c8-bcfd49db5612", "comment": "Malware payload (Mirai)", "value": "726266b8944b87ceb038259e98e181cce0bd6766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907927, "uuid": "7af3a2bb-0ec5-4318-9720-99a5abd964e6", "comment": "Malware payload (Mirai)", "value": "f3efa176719a3fcdda30d7f79024deda912238d5790f3b02db12117a862220eaadbe448fab02152bb7fdfc5c7339e238", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907927, "uuid": "46465af1-a259-458a-aee7-fbf054a3602e", "value": "T188732901B650D673E14326F61096CF621131FA3E1AAAD81FF7696C79BB31084B271FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907927, "uuid": "c64bc097-eb43-4715-886b-549aaeb9cebc", "value": "1536:YvWvBCBzTs5s5g4lUSmw7ZB5pR+wdjxpmbEAEl:BB8T/5g4lu4ZB5pRn1o4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907927, "uuid": "aad4ee5a-4331-4d02-8fbe-97f34f9b5f30", "value": 74404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907927, "uuid": "9d6be7d5-6f5d-407d-aebd-10ca53fa2462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907927, "uuid": "449e5e0b-571c-4e76-8885-e1ecf245d7ed", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c390fb59-64a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1752931067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931067, "uuid": "d38eb417-a5e5-431e-906c-f2a4956dd20c", "comment": "Malware payload (RemcosRAT)", "value": "af76642b39a14bbca8e5801ecf8a614f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931067, "uuid": "46bdfb37-0373-4adb-81c2-6629cef689c0", "comment": "Malware payload (RemcosRAT)", "value": "b51adf73cc39dc963e09c44bd58800e43cbca9eaa689f49076b216b622e9efa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931067, "uuid": "ee3726dc-0612-405f-8296-2eed81d05200", "comment": "Malware payload (RemcosRAT)", "value": "d82b58fe0878c920b9f7a45230bd6b5c269f5f91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931067, "uuid": "b49d0064-a759-42f6-8adf-951bc3f2e620", "comment": "Malware payload (RemcosRAT)", "value": "32c72311d51890c192e4e62dcc7198ab5744b2ed0f6568ba0ed0b91b0c009f548a6fd8c6ffaee1b2e9b8f8c45e68cdb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931067, "uuid": "65aa0fd8-3618-463f-8608-60088a08a139", "value": "T1A2E533E9F9A0434EE765A7F49DD3BB036C705A0245299792B0B2153C2B0915F8F3A7F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931067, "uuid": "53e3bf77-7b7b-428e-89cf-ffe2a9a03c2a", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931067, "uuid": "e30c0fc1-5c62-4c72-9f8f-bd5243bfae45", "value": "98304:WZXJ1iyntHLBA+sxNfU29jWa12IC/cjB/Fu:Wp196+s/U2As2IC/mFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752931067, "uuid": "d131ed75-a588-4041-93ca-da1c4289ef60", "value": 3225328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752931067, "uuid": "8bd030fa-6fba-4703-a266-9591742c0b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931067, "uuid": "c2cc9282-9c1b-447d-a1b2-26cc175b34b5", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.44448.12264.24043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2747522-64f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968029, "uuid": "72cdcdf8-4a06-443a-9480-35d880c49cdd", "comment": "Malware payload (Mirai)", "value": "0f60ec6e23b1a4bc431fbef93f31e95d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968029, "uuid": "e30bf613-b289-4ffa-a78e-c54d9c506313", "comment": "Malware payload (Mirai)", "value": "b5a34520ae86eee86ffda88139e31238fc29bb9b0b3da634fa95590e09d6a036", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968029, "uuid": "167624e2-654b-4c27-bc60-1fcb7c981a4f", "comment": "Malware payload (Mirai)", "value": "cd9c01a32be064ff5b0dadeb497966b498320c05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968029, "uuid": "7af2f0ce-9e57-4dc5-a646-2d32e5de7d8d", "comment": "Malware payload (Mirai)", "value": "e3f74fef55e677192e12d786b6b65b15edc5801bb6c35ed2dd70d0f553f2d588d4acf9ce7b352aa0af5cc652577eb37f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968029, "uuid": "a916e0b2-bf6d-4fed-a74d-1843fd56f90e", "value": "T1B8142B46FA414B13C0D627B9FADF42453333AB9493E773069528ABB43F8679A4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968029, "uuid": "ef427465-907f-482c-94a4-994fa3ea3b85", "value": "3072:FbGSTvVsjmQy7mqSd+a5YRLxxRKOfw7UAHPTAovM/R4Wz/L2/uO:LONy7tY+a5YRLxxwrUAHbNvM/R3zcuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968029, "uuid": "508e436f-84ab-4a70-9859-0e1450ae8ff0", "value": 192039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968029, "uuid": "3aa772f6-cc7b-4c14-b24a-f6d8fd5668aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968029, "uuid": "ba3ef2f2-c7a7-4025-be7d-120bb5c097c2", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd44c1d-646f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909257, "uuid": "7c77e3c6-d279-443b-b432-e466ce9f704f", "comment": "Malware payload (Mirai)", "value": "1af0a051ed37386228f5a2c5f7ecffbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909257, "uuid": "b7bdf11b-e542-49a7-93c6-27555e2ea751", "comment": "Malware payload (Mirai)", "value": "b7c1f88020aeb2f0941bfcf4fe1bf2b87785f01c7ac4bbcd6bb9e8caa18a2db6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909257, "uuid": "c7b85160-3a3f-4ecb-a49f-485ed0471cce", "comment": "Malware payload (Mirai)", "value": "5c3b414f800068f67f541d64babc7db2a65f32c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909257, "uuid": "dbadadcb-f59c-41b2-b001-623141c74270", "comment": "Malware payload (Mirai)", "value": "a8b160ae3e1f5d2e42f9658b1362266529ea358883e3248a0506cdd4d90f21d1421f97a1a7a02362d5dbc22395aa1e5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909257, "uuid": "016374ef-d257-4f55-a648-f2fb9c7bf952", "value": "T16E236B3AE4356E54E08685B470385F751F73E0C083877FBA16B0C27A6053E99FA49BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909257, "uuid": "38a2ad4b-f3a7-490a-9950-bbc2e29b03ad", "value": "768:Sk1hwmXOqKUZc5ebl2JTQo/SKKezYkaBo9s2gCuC4PgZJfAIu+I:Sk157Bmgl2xkKKec32u8uC4NIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909257, "uuid": "e065313c-a81d-446d-ae86-4c31c793e005", "value": 48584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909257, "uuid": "bbcf8255-dd04-49e7-964d-777132b6cf1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909257, "uuid": "694d90f1-cd2a-46a3-b5b2-4b0f79038237", "value": "nexusnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c89d478-6478-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1752912909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752912909, "uuid": "74167236-46ec-49b5-803e-76f98733f2b8", "comment": "Malware payload (DCRat)", "value": "89edcd96dd316f5ffaeb793c289fdcf7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752912909, "uuid": "cebc6e4e-f528-4dea-b5d7-32c54b71e40f", "comment": "Malware payload (DCRat)", "value": "b86a67a7dea558bd5719148ecc93ecb2c4f9270006ff304d860c866519c8ca15", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752912909, "uuid": "69a6735c-e9e8-4340-b352-ff94be087d6f", "comment": "Malware payload (DCRat)", "value": "c207726c271803087f86c3c334f11fca0c9d8ee6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752912909, "uuid": "dfcb8e2e-29e8-4ebd-828b-6ba691e16e41", "comment": "Malware payload (DCRat)", "value": "1dabb651623683ca0a12561d1ea960537215283e8b14de0d3feb6c2347d3ab945e6c030b2dae854adda7c055fded5f8b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752912909, "uuid": "f96463d7-f334-433a-9f7e-062ff9b619ec", "value": "T182F5E0417E488D02F0491A33D2EF29448BB09D517AE5E71B7DBA37AE65123937C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752912909, "uuid": "a579bfbf-bf11-4230-82c0-77fa21977a5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752912909, "uuid": "4c71c80f-70bf-4afd-9bb6-2d4454897f6d", "value": "98304:JaBJV38SWF2AYzVUgeDNupIscRfxs/rIEdM:6ByF2RZU3upyxs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752912909, "uuid": "fb15f371-efe7-41a4-a39a-161ce598527a", "value": 3549184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752912909, "uuid": "71aa4f12-28c5-4eaf-99c1-bb89d3d21638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752912909, "uuid": "d8c3d5a2-9c99-4189-b9b0-1f15f95bb752", "value": "89edcd96dd316f5ffaeb793c289fdcf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e409ee-64fa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968874, "uuid": "6d2ac7d4-54ad-45a3-a109-4cb62c2bd926", "comment": "Malware payload (Mirai)", "value": "bba6dd0478854a8e84f4b48fe7de904d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968874, "uuid": "2ff8f7ad-b1c0-4508-ab44-e24f55ecb08a", "comment": "Malware payload (Mirai)", "value": "b9aa3c83e96f436f8c71006b731d080d9ab524ff6f8c0b576a5689c6bce66fbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968874, "uuid": "b2da3212-3e5d-482e-8c81-73866d88ac0b", "comment": "Malware payload (Mirai)", "value": "80b5d21c5e81617d5af8df9675658cc9e7dcc5cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968874, "uuid": "cecb34d6-01fb-4f0f-9f83-3ab8bd868e03", "comment": "Malware payload (Mirai)", "value": "1884f5834b6f0a6ec044d080ccf101aaa288218ad204cb212ae9064d77ff923571a1406a8c16e75bf716e760b50c3850", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968874, "uuid": "6604da7c-2f60-4d73-9852-10bf829f81ed", "value": "T115937CC4E783C0F5DD5B01B2913BE33A5332E43E5029EA47D76AED319C52951EA2A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968874, "uuid": "089d392d-0b09-4b91-8405-5b20ab05c8ab", "value": "1536:J48valD0RTypzg/Ei160jDe6w/gjJ7W20jhrq8nSwgp:C8vfR+p0/zAKD/Ogl7Wvj5St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968874, "uuid": "386a1ff7-b868-41d5-99b8-4ec1e37500dc", "value": 96648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968874, "uuid": "0b2054a9-39e8-4ed2-9be9-4120f6872c16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968874, "uuid": "3bf492c0-9e11-4071-b319-65f946e729c8", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e15203c-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1752933071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933071, "uuid": "e9916420-91bf-41ca-bfe4-14ad9bceb173", "comment": "Malware payload (DarkCloud)", "value": "92d01d3ef98467c3e02d17af9025fae5", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933071, "uuid": "a307b96a-48f1-4015-8ff5-8043bb587133", "comment": "Malware payload (DarkCloud)", "value": "ba16f831c4bb4dc9a38e767d554ea8e4ca83b071c9eab4eeb942ec6f610ba1d3", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933071, "uuid": "b45b889b-1bdf-44ff-8022-937fbba9c46d", "comment": "Malware payload (DarkCloud)", "value": "9576800ec75fb6205a53b898ebd4a32dab0e065e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933071, "uuid": "6eaff83e-5b65-456e-868d-fdca8cb6160f", "comment": "Malware payload (DarkCloud)", "value": "f76dbfdbcb157d7b4b01707bd5ce47f77d0e1476c9c65e27622b042dd4e6cbb652df5cdc3cadb61a278135d669655ff1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933071, "uuid": "e47842ef-6856-44ab-b843-b899714a1182", "value": "T11045011AA35154EAE8A741B985235646F97778368734EFEF03D8A2321F177C02E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933071, "uuid": "951a7f8a-ac20-4632-b058-b4614697721f", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933071, "uuid": "6e37c734-61a0-4cf3-8b97-fd3c21c88162", "value": "24576:TagOdyCGcoTMukPA3dZ2ikRrHl/Ub8EHtmS3dZ2ikRrHl/Ub8EHtmZ:+gORPeUi+ZCHtmkUi+ZCHtmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933071, "uuid": "0ebea4ad-a013-43f0-bbe3-8d55b0435058", "value": 1231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933071, "uuid": "83c6fb19-1832-4605-9f68-b88799fb623f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933071, "uuid": "59da29ac-63b2-40c0-beaa-5fc9fe641a3d", "value": "COTIZ8899900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81497c6e-64fa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968752, "uuid": "b2f5bf1b-bebc-40f2-b4e4-b66083d73f3e", "comment": "Malware payload (Mirai)", "value": "b79f6ed5d021d602cb1a2512cfb6e219", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968752, "uuid": "62047983-5e56-436f-89c9-c69e29ee669d", "comment": "Malware payload (Mirai)", "value": "ba7b2ee6208068c8dd0dda19239aa6b643ac832284156a239ba41be2f23f3879", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968752, "uuid": "862b8a55-a160-4c16-909f-6b62fe7c954d", "comment": "Malware payload (Mirai)", "value": "8bc0ccdb350dabe2364e48bea9ef4cd22a9e1a09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968752, "uuid": "963e5235-7091-4474-b997-f95d4d48c15b", "comment": "Malware payload (Mirai)", "value": "74f26317ed8670f6ba52a3c0f8889e342f752bcc9cec2fd1b8e85258b31b759cdbc33aae7c961bc5b1f95249030f7d73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968752, "uuid": "4ad430e8-cf5f-4aa6-957d-53b49649f281", "value": "T18A837C82D683D476E55204B5703AA7B1DB33E93B503AEACBE35C6935EC26401D31B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968752, "uuid": "d649d94a-c23a-4548-9e2d-375b652eff4a", "value": "1536:Lr0bmyic9ATw3MLV76AtUZztg8U4avlI5AW8+Dme8F6utWmNg:USDc9ATw3RAwt4IaW8mCcm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968752, "uuid": "5007a77a-90d8-4292-8f22-87087a501744", "value": 87204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968752, "uuid": "65e5a3b2-a56d-4b88-b789-bb7ce481fd5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968752, "uuid": "07e65b6f-a28c-4d9d-bb62-e6ebce8381c6", "value": "getty", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7cda40e-64fa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752968870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968870, "uuid": "752c22ca-6d89-47d1-a2f1-1496b756bdea", "comment": "Malware payload", "value": "9286546a2ad56cb04f731ebf301d00fa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968870, "uuid": "b0faec05-4b90-452b-8e3c-33094a48269c", "comment": "Malware payload", "value": "badb70a5e39efa8d2ffe8ed4c9cd96da21f51a1075e0a4c98bbbe03933375d5c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968870, "uuid": "20d85c57-4e19-4922-b069-47282ad31968", "comment": "Malware payload", "value": "566916a7b94aaa0d6f666ef20cc4add4d48ff17d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968870, "uuid": "67790fe4-52fe-4dc4-a1d7-2ebe62cdfbae", "comment": "Malware payload", "value": "bebfcd55704212ecf8696302830c17812e10293763cce0456801632aea61c8071eeee392ff5b565416c4a97a4924a348", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968870, "uuid": "9a895828-d6f4-45a6-81ab-e8e8d331b570", "value": "T11501B1DF41A5AD7228818DEE75975D2968C6C4C907CACEC9A09F0439A4CC90C71A2E79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968870, "uuid": "8740689a-d58d-4a40-add2-4af035040090", "value": "12:3UkWK3qq15ZMoLF7+MB052ui9vYui9MDNkfN+uiGyTYuiGygDNkfN8Tvn:k9q5zLt+MB0IgmklWkl8jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968870, "uuid": "faad728c-0a49-46a4-97ec-36e48ba42e51", "value": 718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968870, "uuid": "e815636b-96c0-46c5-8460-736b68a10e8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968870, "uuid": "e0b3bd9f-1ce9-4424-b6be-1f1389674868", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a395e814-644d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752894506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752894506, "uuid": "f176d932-cd30-44fe-bb1a-db7857776a4f", "comment": "Malware payload (LummaStealer)", "value": "91d0e777ac0038b77f5e37eb541c095e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752894506, "uuid": "38896f24-d615-48ab-980c-bfb9eaf4370d", "comment": "Malware payload (LummaStealer)", "value": "badbf65775ddf265a3dd2eeb5dae28d29b13158a0a5f153bc6b80320eaae9766", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752894506, "uuid": "6dc91c22-63a3-4247-ad46-d2334f1ac6af", "comment": "Malware payload (LummaStealer)", "value": "273f52428e7c42a400c322a36f89ce4d331be9f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752894506, "uuid": "6f15e3b9-5790-4ea0-b06d-813e9d9d199b", "comment": "Malware payload (LummaStealer)", "value": "cb1a22e6ddf83dcb5438a40b27dc8d9afd98ce781f53f4ac2d8e61dd635a76cbecb0a27449e800cb1155403e40879d4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752894506, "uuid": "ba6c49f0-9931-4771-aeb0-c16ff52eb459", "value": "T1B43523D19735DC03F7F71132A0946C11EE7A2F6827F9C74E96824899E763AC28E2DB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752894506, "uuid": "fb633699-a429-4156-93a7-1a23a79ef405", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752894506, "uuid": "f415c7e5-80eb-4f5f-8d5a-8c4b9727af40", "value": "24576:ozZooByoaMjxN/5+LB/f+fS2foyJ7aYI9x9dGdQXlvsL:offHx/MB/f+fLbd09GdQVUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752894506, "uuid": "967d26a7-d54d-4f9a-92bc-64d98fc4c9bb", "value": 1076043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752894506, "uuid": "d40bece7-beb5-47f7-8bf0-c043631d83ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752894506, "uuid": "9d45d902-33da-443d-bb41-0058c229195d", "value": "Aeternus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c8763b-64db-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752955316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752955316, "uuid": "2a65bcaf-f36a-42e9-8cf7-e15820e87949", "comment": "Malware payload", "value": "df07519de8d718130f541731261192af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752955316, "uuid": "c84632db-5a48-4d58-bd50-0fc724179cd9", "comment": "Malware payload", "value": "bbabb706365891d15462cb70039a46ef5d4f3142e07a182e07347b79443d9eb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752955316, "uuid": "adc0b9e0-5873-4472-b9cf-3c05b8d52329", "comment": "Malware payload", "value": "44391005d718f4fff72f9e4d8c45fc83d0d0e149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752955316, "uuid": "af66b38d-ecb0-4c2b-9d7d-7d07f27fdbb0", "comment": "Malware payload", "value": "9843a64b316f84d72ba16dba4e9c040f0090358c0f001e531b4db738cf3b36925302d3ee5e1ed728990fadbd068d48ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752955316, "uuid": "040d6228-8915-4c4d-bf73-c3df9a8c56aa", "value": "T12935E05E965260DEFD2D00BA46969101F477B83683349FFF27A4E7B20E136C9297C728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752955316, "uuid": "527e86f8-f825-4202-9821-101dafb56e3c", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752955316, "uuid": "f8df0ac4-c8a5-4e04-8907-c26ff0fa5b6c", "value": "24576:g+2C0CnMJ5kGHP/Yz6IlB9sqHP/Yz6IlB9sR:gM/nSkGHu6S97Hu6S9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752955316, "uuid": "940f27e5-a35e-4d2e-8fd6-88e581cbc0c2", "value": 1154048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752955316, "uuid": "ffcaff75-708b-40a1-b405-f1394f7e2651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752955316, "uuid": "331c8ba9-5b29-467b-8a2c-d5ca5cebbdf7", "value": "cheat_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fed89e-64ca-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752947984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947984, "uuid": "770ccb46-7106-4f9d-86b0-ae8313427823", "comment": "Malware payload (Mirai)", "value": "c2b6f9f0b5a7af944eb5413c15e0bb2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947984, "uuid": "761dc2d6-87ae-43ac-9e90-aa7d46716904", "comment": "Malware payload (Mirai)", "value": "bbfd89b8e5789aea24faabc0ad57cfc040c2380e8cc7bd2c37bf6f9fafbed785", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947984, "uuid": "52c53516-61c3-4ca4-86b9-ee23b62f83a8", "comment": "Malware payload (Mirai)", "value": "4d7f8ed05660492b89c0bd22fbfff17008602a85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947984, "uuid": "ca553cd0-1536-4dcb-885f-94ec30cf808a", "comment": "Malware payload (Mirai)", "value": "2f8e9cc70fd3c836f15d64b353112dc9b44dff0ee1cc722d706881ec2fded2974e2c6f8c2f16d0183c7bcdee6a24188c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947984, "uuid": "8d5f69f9-9d5c-4b4e-977a-0929b3a3ac26", "value": "T1DA833955FD818A12CAC116B7FB2F428D372317A8E2DE72039D295F21378B91B0E7B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947984, "uuid": "e19a1ef0-2f73-410e-9441-99c049ceb0c2", "value": "1536:c2r4mZQAR7mqAt0G2xt2yrma3Xze6SlCWS7R+vGwK:c2zZQARKkG2xtZCa3XEFrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947984, "uuid": "2eafad9c-377c-4b2b-94ee-4ff20cb39e00", "value": 84056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947984, "uuid": "e3a3df23-2437-46cf-ab01-117c1ea9adcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947984, "uuid": "e0b15b7b-0574-4493-bcee-6c75bc790f28", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c33d7c6-64ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752935081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935081, "uuid": "028eac4f-c450-4ef2-984b-9d5a3a2bfa6b", "comment": "Malware payload (LummaStealer)", "value": "517c8372783c12b600e23429407fb479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935081, "uuid": "78a0309d-496c-41f3-b8b7-5731ec5a6a40", "comment": "Malware payload (LummaStealer)", "value": "bc7bf26711d0bad8a51f903f75b59015a3c7d0662f1f096b0d4775af3d2bd965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935081, "uuid": "55f1a5e0-f364-4bf7-9be6-cfbbabd74147", "comment": "Malware payload (LummaStealer)", "value": "7fced98b59bba2b8084262d5e994e6082ec2dba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935081, "uuid": "084f95bc-ea82-444e-84b7-422f0e7d33b3", "comment": "Malware payload (LummaStealer)", "value": "59ea665b6039c474c85d5d581d8590e06065b19fd69f9a62ae6dd13c4e41800e93ce5bb9a2ecfb0b4741b47b1eb2ff92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935081, "uuid": "c4b2450e-e9c7-4c79-98b1-0c5d8b9e1be7", "value": "T1E255D035929193D6FC36407B44B1629AB572B633C22D2BFF8250E333AE076C55F6A358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935081, "uuid": "b38d89bd-20e6-46ae-a383-ce537d35014b", "value": "a7c4b62062a898c7859aeb5101fe98e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935081, "uuid": "8fe8529f-6eb4-44d6-ac88-3bcc7dc553de", "value": "24576:aNl4o8fxNHchT88eqsdobs72ey4zvc57s72ey4zvc5j:OqpxZcQq44O2X4zk1O2X4zkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752935081, "uuid": "f79734b8-b64e-4fea-8bf4-522d849d5e79", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752935081, "uuid": "59eb186b-3899-49c8-b827-cdd501ea30e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935081, "uuid": "f5ea62c4-7147-4d4f-b697-109a1ff422cb", "value": "alex12312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67d2514-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925113, "uuid": "08fd1117-d812-4d8d-84fd-df1edb6b1351", "comment": "Malware payload (Mirai)", "value": "7d8be47f0e88eee13905f533b80b6f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925113, "uuid": "965a2ab1-ae68-426c-9169-7c76dd770cee", "comment": "Malware payload (Mirai)", "value": "bccd011561589c1d9a444cc509400debdd6832ab228e74ce29e40533ada10267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925113, "uuid": "4736a757-59a5-4a08-8787-5a05e9c61e28", "comment": "Malware payload (Mirai)", "value": "a2546bd5845bc6cdffcd4c77671592577f095e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925113, "uuid": "de1bc410-1c12-4edc-a7e3-b48b78524969", "comment": "Malware payload (Mirai)", "value": "06bbfbf74aaac6d5d258313ccef3072dc6ffe27ea8cda116ba9e6897e90befbc3f5d298a03f3e7a0e3c895c184a04568", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925113, "uuid": "b4f8d847-27cf-46a8-9b12-4e17da82c12a", "value": "T1E8B57C56FC809A51C5E056BABB3ED18833172BB8D3EF71175D049B306B9B89B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925113, "uuid": "bc0dd986-2d40-45cc-a74e-be0648730d4b", "value": "24576:J73VvULufbWhDlE68owiGWcf1OSAMW9z270oYyyrozIzkQMszBTsCoRsMVP8Gv0r:bV8uiG/A34ssiVoP5ZSvPsxcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925113, "uuid": "9c05fc74-400a-4fab-b09d-d7336c7b9962", "value": 2348404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925113, "uuid": "8ee184c5-152f-409f-b3a5-c0deadbfaae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925113, "uuid": "ac5ae0a5-bbd5-4641-9d48-0a26f9df949f", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262d0e91-64f7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752967310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967310, "uuid": "c2921906-0d46-4203-a6a4-73453635066e", "comment": "Malware payload (Mirai)", "value": "2cf13ef986c3c5e4ee63bb605eb2b996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967310, "uuid": "27853d61-d3ac-4b47-afb6-c40a72ab5961", "comment": "Malware payload (Mirai)", "value": "bd06e72a60e882f5412d7a34fc8855321d7b72da01e917e274051f2d1d66ae56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967310, "uuid": "a9f687b3-d17f-4d13-96f4-f04e7fdd7091", "comment": "Malware payload (Mirai)", "value": "6b4ffcb069fb0ae2bed9e440d91b5ef7d52daabf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967310, "uuid": "63ed7ced-cda6-4e49-936d-285081b3c497", "comment": "Malware payload (Mirai)", "value": "e1992ec49497e3752a3e4536127642d5fc695877cfcf2a006dc71455dc0fe0740192d6b377c9a9ef38fd7ef96e0c30da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967310, "uuid": "bafcc822-5116-4ca1-b4a2-b6028d9347ab", "value": "T1C9D33C05B31C0A87D2A32EF4363F27E193EF9AC121E4F640295EAA899172D335585DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967310, "uuid": "cedcc284-2684-4abd-8532-91fcb96f7d83", "value": "1536:0tPS6Ofc4UM7aNbq+BQpRJlcUbYfr2W+N2NtxvZxm91setaVyoao8ZBZQvA0DAo3:LzFSNe+gpchw8txy93foaFBr0MBWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752967310, "uuid": "b70b27f8-33c6-4fc1-b4a4-6ac230da6a63", "value": 139092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752967310, "uuid": "d78ec94f-f5b8-4e36-9166-d83120166893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967310, "uuid": "d64e6014-5c0c-4f3e-87c7-29c635072402", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48c61f9-649a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752927633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927633, "uuid": "358295e6-cbbe-4f37-bdf2-17f31938b1f5", "comment": "Malware payload (Mirai)", "value": "b7fe3551052c1eb3916218f55d793dd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927633, "uuid": "a7fa3d9a-93e1-42e3-bdd9-f4052ab55ae1", "comment": "Malware payload (Mirai)", "value": "bd9a2d16ce0e564b24f5c72c732adbd8f7d0fe7f5c97384b52fc16ca691e6870", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927633, "uuid": "bb36772d-ac30-47eb-857b-0a1d0ef17a78", "comment": "Malware payload (Mirai)", "value": "a7ff47ee47202f890ecb773fd25939baa48f1edf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752927633, "uuid": "84cfd479-6743-4ef9-b387-c7cb603740e2", "comment": "Malware payload (Mirai)", "value": "9f869004b7d7758d56f270b661ff889138a60d47bee3ae18859b08a48f0e2dca82f639c4348c772b870ae1bbea5a5da6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927633, "uuid": "8716f530-9bb2-410a-804f-47453e8a52c1", "value": "T1A4533A51F8815623C6D1127BF66E428D3B2613E8E2DFB3079D225F20378692B0DABE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927633, "uuid": "f6bc227c-a11f-4a04-97ea-7ac6affafec8", "value": "1536:ajMBUggHCtsa3dYxqh79k+cFwDGgbgvOnz:KMHnx9gFwitOnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752927633, "uuid": "7a59beb6-f5d5-45ca-ad7e-dcc2448b7753", "value": 61260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752927633, "uuid": "9b9a21b7-f432-41d2-a1f4-9e558ecb3fdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752927633, "uuid": "1841523e-0d83-484c-8899-cd92a752bdce", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b590fca1-6468-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752906133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906133, "uuid": "7386f149-c63b-4d6f-8125-f4670e73556c", "comment": "Malware payload (Mirai)", "value": "6b12c1bd2c62692d3341e3db46f4a1d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906133, "uuid": "a3abe819-24ea-4c37-9486-664335fcbf75", "comment": "Malware payload (Mirai)", "value": "bf449fea04b3be909121b1609a4099cc39a1d60848afe1041c341005729ff22b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906133, "uuid": "d56d7881-9102-4e2a-858a-45098145b766", "comment": "Malware payload (Mirai)", "value": "a8edff7353b596005c4d93b1cb2130ec93ecce33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752906133, "uuid": "f56451ed-3ef6-436c-8b7a-3a3901a07a15", "comment": "Malware payload (Mirai)", "value": "d6e7cb18c3ada872872376f4403dac7cbce114a1336076df59b2af960e5f7f0001d3b7c00ca35c043d67ad21656f5e88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906133, "uuid": "c3553c67-8c00-467f-bd1c-68ce0c72cea5", "value": "T1AA83D606EF910EBBCC6FDD3346AD070235CC555722B57B3A7A34D928B60A54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906133, "uuid": "6c547cbf-91a8-4746-b8fc-e9e775a5927f", "value": "1536:jqiDnYhvo3BLtApRqoOL8z+Vh65p9m79lIRx45lXzwpI:jqpvWPTVwp9EsX44pI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752906133, "uuid": "83acd90d-461d-472f-9457-e7ec4307dc20", "value": 85112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752906133, "uuid": "d003c8b1-5c95-47bb-b9b0-9a468a65d3bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752906133, "uuid": "7a446300-5740-42d9-a24d-f6a014408bb8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bd4dd8-647e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915337, "uuid": "1aa3853d-92a9-46bb-89a2-7ed9d4b7554e", "comment": "Malware payload (Mirai)", "value": "31619f951d125b2aba6ee233658cd402", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915337, "uuid": "1606ef19-33e3-4f49-a224-10f5fb13bd82", "comment": "Malware payload (Mirai)", "value": "bf65115e1a25d9f9f2c5e24c2462a948113ed9d60e11b0157502b8b2d793fe93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915337, "uuid": "105da652-6efa-41bd-9d79-42bcca4be482", "comment": "Malware payload (Mirai)", "value": "89aada3df82eaa2a91f111a11c8625090dd56b59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915337, "uuid": "747e588e-ed6f-4ba8-bfd5-c2ace03b0acb", "comment": "Malware payload (Mirai)", "value": "6194b9a2df916d0af641a49e4a24b6dcc897f3fd1bde3f085edf3003df86f26bb26717d9baec7fdc8cb98a5f28580a69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915337, "uuid": "83135fb7-c238-4586-a6f9-d0969d4f46cb", "value": "T157A2E019BF1C868BC8323A7955D9EAD21293FC61F29CCC0D2940D16FF0A33A91830F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915337, "uuid": "3aa17ac3-2740-48d7-abeb-90401b0a1266", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oT9:O98o08kxofBE+ZkXaITbp2F2TWul0c5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915337, "uuid": "c1dbb90f-0536-40a4-9286-96ae85978714", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915337, "uuid": "dd5ef3da-6544-4d37-a1d7-14160814e45f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915337, "uuid": "2d2e7490-3de5-4399-aea2-cb70570b893e", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcecfc9-64c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752947623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947623, "uuid": "f6deba9c-3518-480c-af6a-4f323acf7247", "comment": "Malware payload", "value": "1779b5ba16ea68d13f3b91bf98182145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947623, "uuid": "0b000498-e983-4bd9-bbf3-593a3a0d935a", "comment": "Malware payload", "value": "bfd5da7ddb101b6d00d444ca50c2fc5dc92884510811a7cecf419b5130c35226", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947623, "uuid": "5867af9a-0264-4a46-aa3c-3297d1f2f8aa", "comment": "Malware payload", "value": "85b0b9ec35d1ec7ca62725c7ef65faf6bdbc38ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947623, "uuid": "affc82e4-640b-46c9-b4b2-33c9b43592ca", "comment": "Malware payload", "value": "a624e12a298cfad31a97ec23a72ce36a9db9653b869285c05394f4e229f892a9aadfdde7fa91f882b44d0280ebf72067", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947623, "uuid": "5716ae37-1206-4c50-ac72-65ec22c7350d", "value": "T1B1333C36BA72082BC5C4A97661F74775F2F6438624FC4A1A3DA14E8CBF54B4032577E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947623, "uuid": "1cc312a2-1107-4d4b-b8ef-7ed8b1a16780", "value": "768:CrjwAp/iFolnt4PdeO+ok5VgaT1xDtrpjt9SIBf:CrjwAxblntAeok55vXtYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947623, "uuid": "c7ffaadb-02cb-43c3-935b-a9e7d73dccf3", "value": 53236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947623, "uuid": "822c2158-6850-4db0-8c9f-df1e68b1e4dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947623, "uuid": "4d38fdd2-05d3-4ca6-b713-896d55c8dbcd", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c878c03d-64fa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752968871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968871, "uuid": "8e275924-386b-41af-8e29-1a297a2d8c4e", "comment": "Malware payload (Mirai)", "value": "560681d82e43e8014d09999d88548160", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968871, "uuid": "bb3e5b78-b13e-446c-bbe5-e55cc457deb4", "comment": "Malware payload (Mirai)", "value": "c01ffac0b3a58636d4be9795ba0efc3f2ef6c89591f0b33cb50f190c98d631af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968871, "uuid": "ad107aff-aa0f-4f40-a6e1-a4c23d06ae53", "comment": "Malware payload (Mirai)", "value": "d166a3de9ff3853983ba53c2cea561b910fe15b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752968871, "uuid": "b0a99886-c766-4365-a11a-4f4639da70d8", "comment": "Malware payload (Mirai)", "value": "8b94fddeae2e80df3fad1e22535137b43e6e9017efeffc339406b219bcce427c0582af09ef92f3c17bd90ca21971aa3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968871, "uuid": "6d8b94dc-2bc9-4fd3-93f6-1bb0022f8b35", "value": "T16FC3C349E928633EC3E16BFFF759428E373A0B59AB9733299B3546742BC4B185D38110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968871, "uuid": "ce0cf94a-5ba7-4d30-8116-6a51640ac2d4", "value": "1536:Edn481dpPm2jR6V7iIDvR98QQ0V67WdSgG9ITKMAivyzLdjm6xSlxDJdSJ2:h81dpPt6V7iIDvRNdSgGmyzLdjm6I5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752968871, "uuid": "6accb1b5-bcec-4aa1-88c8-ce391a0a483b", "value": 123081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752968871, "uuid": "4ca05022-3e8e-430b-9ba5-71754c3dea66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752968871, "uuid": "1a16b3ca-1a63-4f7a-8f93-3fdc0bde12d7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8b7b8e-649c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1752928210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928210, "uuid": "376444f5-acbb-4c4c-882c-6be5cb784713", "comment": "Malware payload (njrat)", "value": "b6adb4e47c05b468328074e2cca3de8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928210, "uuid": "ad1479ae-01fd-4357-852f-7bba40837449", "comment": "Malware payload (njrat)", "value": "c02d152142ecd8e45608a8ccb4228361936b83da2001b4dfe370dc171376a1a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928210, "uuid": "8a39b064-9a26-4b70-aee7-3473bc31252c", "comment": "Malware payload (njrat)", "value": "826841341f40c78e19d6b83a0d21ada1a2b56fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928210, "uuid": "0596090a-0d29-4c03-82b2-aa04d3e16745", "comment": "Malware payload (njrat)", "value": "a40eff0ea466b93c45c10ebbfe335141b11a5a9cebd1702df14dc91c5b7ba9b396ba772bad9f016c56c10f6a60b5dd86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928210, "uuid": "b5206b1c-a1ee-4887-988d-795d780b6aee", "value": "T10D052C9BF9715B3AC63A1633CC678C7C81E9C56B5B42FB0B81F8653863727DC6A06148", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928210, "uuid": "3f5dd319-60a4-4261-b131-cb4cd1c9f1ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928210, "uuid": "2b09fa18-0371-498f-bf83-0c62688b8ca2", "value": "24576:nykI4F8T+nvq2oxQeEMLcwj6qKl5264g:nyMF8T+nC2oxQvMLcTqKl5Jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752928210, "uuid": "916e85a5-5b4f-4ca4-a113-0512c7f4af35", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752928210, "uuid": "24d6157f-820f-4c35-a9b4-38cf30f7280e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928210, "uuid": "1db88795-f7db-469b-b60e-9a873c73f5c7", "value": "b6adb4e47c05b468328074e2cca3de8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761823f0-64cf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752950265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950265, "uuid": "8f7150bb-8de1-4b16-bc74-9bed9ee3d85a", "comment": "Malware payload (Mirai)", "value": "40644ca8d30c8e1c9677cfc341a7527d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950265, "uuid": "cd3f7037-9a8b-4bb7-a8ae-fd241a15900c", "comment": "Malware payload (Mirai)", "value": "c10605a24ed19c7d44debdcab83e7f041e8d6cd77acd9c5fc0680566ff4f3716", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950265, "uuid": "5c7fc6d2-fa01-47c9-8d96-815207bd6fa1", "comment": "Malware payload (Mirai)", "value": "0e6e097e2ecdf8ec85061c5704a1f8a96ef9d769", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950265, "uuid": "b9c61271-1419-4877-aff0-2469754fb477", "comment": "Malware payload (Mirai)", "value": "af348560d298a77722102564fc1127dabc2487f582920ae28e8765372fb239b35326a3845701b574db187d89a12eb09b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950265, "uuid": "a8c43d89-5ff5-4235-bb7c-d63956bf3d68", "value": "T16FC3C44AE928633EC3E16BFFF759428E373A0B58AB9733259B3546752BC4B185D38110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950265, "uuid": "8522fe89-952d-44f2-a8f7-49796ca0c456", "value": "1536:vdng81dpPm2jR6V7iIDvRFEQQ0V67WdSgG9WTpMviCyzLd5mcxXJGA11SJ2:+81dpPt6V7iIDvRtdSgGxyzLd5mcbZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752950265, "uuid": "5590a051-9d26-4460-8770-45aab0d968d5", "value": 123081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752950265, "uuid": "f4dcad87-8893-4113-a100-3b4b00ba36fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950265, "uuid": "fedc16a7-dfc6-4b10-b0f1-74993c6f1781", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6deef8f8-646e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1752908590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908590, "uuid": "3c1b8689-0b0b-468f-a667-07bb0c53482c", "comment": "Malware payload (RemcosRAT)", "value": "5230bfdb6bd0bb7b24345fc92897683e", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908590, "uuid": "f17bfb44-7d7d-46b7-ab9e-9e0ba16e3ce7", "comment": "Malware payload (RemcosRAT)", "value": "c2099ec83b7199d586d64e7055270c1a7e86ec5a1dfeef163b2f3084f0ee106e", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908590, "uuid": "e00f6bde-0912-4089-9a7f-707db5193855", "comment": "Malware payload (RemcosRAT)", "value": "cf5eec9094c037ed61ca5d46945b2f7538d8f9b9", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908590, "uuid": "26928d99-7933-4c13-9f5d-9ed41c29de78", "comment": "Malware payload (RemcosRAT)", "value": "dd010f5e612d22e5faeb7904f696312b8b9f50cc131961e865d9d914082c5f0a0aaf98147794a8bd2016462b4329d95f", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908590, "uuid": "9b0c6bfb-31c1-4347-8b3d-925414fd2570", "value": "T1B1C5BF5D94B05D926024FE34AAC5F793CCEA17851A174B930FE5E2A67202C43FF6B362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908590, "uuid": "854cc1dd-981b-49bc-8e29-7e093617ae11", "value": "24576:KjAwc5V0/RUzJ5Qw5FpEjsdj/5G4zRHA1dnpkLY57:uwtvA4C7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752908590, "uuid": "f4426ecb-26b9-4bef-a8e7-99da57cbef30", "value": 2598036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752908590, "uuid": "e13001a4-7786-48d6-9b5d-cba7fc2a297f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908590, "uuid": "5afa55a3-001f-4d30-a882-96202e5b2222", "value": "3260275198ES Swift transferi.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac5c492-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1752933066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933066, "uuid": "677f3f70-f068-4f2d-b5d6-fc42da1f46e6", "comment": "Malware payload (DarkCloud)", "value": "04c2f1ddffe3dd25bb00dac51bf8822f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933066, "uuid": "dafc104f-99e1-4eb7-885f-a37d72c42f99", "comment": "Malware payload (DarkCloud)", "value": "c28c2f8d4237183ec5d893d0bc73937e3adb45ba4cc82ba3d6829f79e4db03c3", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933066, "uuid": "53cab418-9570-463e-b682-b6cf462f3216", "comment": "Malware payload (DarkCloud)", "value": "d5ab8ae1c71e6eb14a047397f4d7a2703f2b8e54", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933066, "uuid": "3b2462ef-30b2-403b-990b-89efb3b81896", "comment": "Malware payload (DarkCloud)", "value": "7babb11ca871e0d3c77ef48a04a7265b17f466e6ef13c041c39652b417d503ff73b428fdf3aaed22a2f811a0e3b41e88", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933066, "uuid": "258ab85c-5ad8-4098-8fb9-72689d4437b9", "value": "T1F145F106A35114EAE97740BA8522A246F977B9268734EFEF03D8E2721F177C01E3DB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933066, "uuid": "eb4dd229-684e-478a-b726-01018ec78845", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933066, "uuid": "c7c33a9d-0b65-472f-8c25-b845453851e5", "value": "24576:TagOdyCGcoTMukPHFELj/ClalC8EHtm9FELj/ClalC8EHtmZ:+gORPlELYpHtmTELYpHtmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933066, "uuid": "727830ee-ed63-43ba-b9f9-88180ef689cc", "value": 1231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933066, "uuid": "d835e2c7-6c91-4e52-818d-a33760de852e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933066, "uuid": "76ecbf3b-275e-4e3d-b361-ea29305de9c9", "value": "COTIZACI\u00d3N Adjunto RFQ No.42545452____________pdf(~22 KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fab4ce-64ee-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752963654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963654, "uuid": "c7331999-d279-402e-9c1a-0d30f8ed5640", "comment": "Malware payload", "value": "19acc6fc9bfb0bb1bfb6179fc37ff5b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963654, "uuid": "71662b79-3917-4cf0-81a6-76771ce4743e", "comment": "Malware payload", "value": "c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963654, "uuid": "ba945a77-a7a4-4d4c-8c97-08a0fdc47df5", "comment": "Malware payload", "value": "60fca6ad18c8574f5234fdd47963d6fb9a6e113e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963654, "uuid": "17f5711a-01b0-41c7-af35-3b902656a110", "comment": "Malware payload", "value": "cf0f9e749da533913c2d641ae956f1c48fd7ff3e6a06d4e0925da9d9b9a2f3fd146f803bb9dfaf7d5c8701581a47d6fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963654, "uuid": "558b5da7-7d63-4ee3-8ba7-102cb72bb0c8", "value": "T10963644AD2FE15ADD5FA803C494BA772FB20306D522077AF96D8478627506B8AF7C343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963654, "uuid": "b7cfae35-5272-485f-b51a-a4433f4d21c8", "value": "3079a432e680790a643ce9503fc3bb76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963654, "uuid": "957168d1-4a64-4bf1-b398-1c75aad6e232", "value": "768:3Ha1XYbBWnr/HzznDrg4xIIGvgfv80/g7SigwmuwQN+XnACAmDFvsLbnIFAgWJEE:G58BCSGJAKwmWr88a7f2/yT9JkoZcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752963654, "uuid": "b30d1a66-3713-46dc-9193-37e4dd281fad", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752963654, "uuid": "6e09c50e-ccff-4559-9db5-3bc83e2bf9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963654, "uuid": "536973da-3619-42db-a221-6f9dc25ef200", "value": "c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4e676c-6483-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752917853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917853, "uuid": "1172f7ce-5e25-4bba-b048-0061da0ede32", "comment": "Malware payload (Mirai)", "value": "b746b526aab6f72de6d3cce2727687b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917853, "uuid": "15e5d162-1035-4801-82db-1296dcae6ffa", "comment": "Malware payload (Mirai)", "value": "c378185b0f76947eb0183861f4d01ef7df4964a68640d7280ca312ee4280868e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917853, "uuid": "f737867f-e47f-4a56-996f-4daae2968bb1", "comment": "Malware payload (Mirai)", "value": "ef616bf8a22f2f5ce6a05bbfbdfdd16e5fad3d9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752917853, "uuid": "dadce70b-fb0c-4762-9bb5-383b31db7b09", "comment": "Malware payload (Mirai)", "value": "e5d5d8af94126b3492f3649b35b85477435c6086c2479d896549a376c80d6a71cb2b16cc7dacfd90ebcf13a3d35e27e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752917853, "uuid": "4971c3d7-98fb-4b14-8db6-c8492bef0ebc", "value": "T1AAB39E87F74710A0C8624AF007C35B9E2E2322118F97E9E76C1E7A3E5A794DB491B7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752917853, "uuid": "cf490016-b116-4300-aaf8-d760b6b96651", "value": "1536:WNrZSvfwBgb3PR3JL+FjTWGbTQ5b1qklUv94QZJBxclog8oyf/LWK:QcvRb3+FP1bEB1qkmqQZJjg+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752917853, "uuid": "3b633ec5-c715-469d-97e2-3ab37af2f97d", "value": 116392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752917853, "uuid": "d1cdc1cf-aa59-4613-acb4-aede45bc2dc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752917853, "uuid": "32156397-792a-4ff1-bee7-0ad781c11b56", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3440628-649b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752928007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928007, "uuid": "70b2110b-76cd-446c-84f5-e7453d19769b", "comment": "Malware payload (Mirai)", "value": "222bce70e2d1220312572187abbf6b58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928007, "uuid": "58d1a7e5-e16d-4ca0-84b6-93a51d8b1eea", "comment": "Malware payload (Mirai)", "value": "c44654c0042badf458ade7afa222c3cbb941edeb9cc2930b301bc2b8cbcfcc3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928007, "uuid": "57c2acef-c350-4ed0-bbde-d65e9b69a401", "comment": "Malware payload (Mirai)", "value": "01892542175f8d4227f343af391b6e10d4610d12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928007, "uuid": "e0396be4-6572-44b2-90d0-5d422b24cb1f", "comment": "Malware payload (Mirai)", "value": "17e147c2ffc7361c84d611fe84f443af1a80f0d9d36010954b53d40bf99e9b39715a78cea220c15ee118c8f44fd0b2c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928007, "uuid": "dd229dca-aa9b-488f-8b2a-2ccdb7f46cbe", "value": "T1C443181BF581C1FDC09AC174466ABA3EAD3371FD0238F2A677E4EA222D96E215D1DC44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928007, "uuid": "9350cfb3-3f04-431b-ac26-75ec65ec9e45", "value": "1536:fzYOpW1Jq+n5BKforamophEHMa8f66YfuTeDR7CYJ:7YQW1JqyPKgraVVPrY6eDR7CYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752928007, "uuid": "0a55d14b-24c4-4d6c-b818-fc5e40a7e1c2", "value": 59200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752928007, "uuid": "d79c25eb-42b9-4e39-9efa-b7ce8081620d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928007, "uuid": "55d39b4b-d40a-4475-b168-7a13f8a2eada", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec7cf59-647d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915275, "uuid": "444623cf-335e-4399-9bff-cf4d28c10bf8", "comment": "Malware payload (Mirai)", "value": "ece32a1a5c1f3d2c8b023699d6202432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915275, "uuid": "f5f8a56d-3fb5-4b70-b548-3acd2403f064", "comment": "Malware payload (Mirai)", "value": "c485764f6d5920479f8d70ca284004ba77c2fa8b2f903a40706435cf55062774", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915275, "uuid": "6403165c-8e5e-4098-8fe5-b51f328a78a0", "comment": "Malware payload (Mirai)", "value": "7d8f798c7f0ead68c079cee1b7306ca3fdd3314c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915275, "uuid": "1d205756-a9d7-4e66-beab-ef7337bf268e", "comment": "Malware payload (Mirai)", "value": "bdf4cef6123f3563460db7e5985953f4d5424617c697b181c5dcdac0baec2f14ce685deca641ef4a08c1b00b2e8e0cde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915275, "uuid": "39acd3e8-df39-45ce-a4eb-636435333ae0", "value": "T182431891BC819A23C5D4137AF56E56CD372033E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915275, "uuid": "38aba066-91fa-43e0-a3aa-d1398479b415", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915275, "uuid": "806ff9ff-81be-40d3-baa8-de0376631af3", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915275, "uuid": "6163088d-bf79-41d3-9cea-c1bc5738c175", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915275, "uuid": "e0d3c9bb-6caa-43ad-8683-5f1389029d90", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4794f3e-64a6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752932814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932814, "uuid": "1594c954-7c04-465f-89e6-935940625c07", "comment": "Malware payload", "value": "62c02ddd5076e06d2666a7c8e38570e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932814, "uuid": "4423844e-e027-4cde-9abb-943ca3e2f91e", "comment": "Malware payload", "value": "c4a7075c2b69205680a38e31de706f441ccf0fbfa85d41c0dec8953eb11c65f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932814, "uuid": "baf75b78-da74-4321-8af1-e6b5adbf2706", "comment": "Malware payload", "value": "5a151a903ad8f5205d8803a9758666cd8d205152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752932814, "uuid": "fd315667-9ba6-4136-a130-a4e71e741202", "comment": "Malware payload", "value": "d603d4e9ed52848f51dec7941c133c85f8855a2937bc462f2923171477511b921c221d36cb7871ac4368ab542e9cef32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932814, "uuid": "921b862d-882d-4835-9685-acdea7ed1dfd", "value": "T1BE524A2365D6CD72E8A1283502C57D769BFDEA300D26DB13EB590D0613A9583EB2B2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932814, "uuid": "e07aa27c-9462-44fc-bd5c-b090cab54158", "value": "192:XaC7a2KRh3R8ncDtQN5LfMqdlE3W9Uhl3n6BBMHqTSVFtySQ6yTGFfGYLhatsAPC:Da2UhMLf/+3Wyhl02qasTGFvOPHMqsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752932814, "uuid": "ad41c8d1-34df-4359-9ec6-5de2a4109ce8", "value": 13545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752932814, "uuid": "ad8a238d-75d9-40c3-b48e-b9d5a70e6107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752932814, "uuid": "50b6b111-452f-479a-8637-e33881ec4947", "value": "62c02ddd5076e06d2666a7c8e38570e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83e5024-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933276, "uuid": "7f403806-e6cb-489a-96de-2c69f9bc7743", "comment": "Malware payload", "value": "062b8c1a7a6cc624718031d1aa29f3d2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933276, "uuid": "9af37666-5da0-49b8-a6e9-0f52d3f68200", "comment": "Malware payload", "value": "c4ceb409a8c7f63c039565a035ddb2daaad865ca92cd7fbb0811f64cc42179cc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933276, "uuid": "d8c3a1cc-1eab-45cb-9bb9-6d56b134e2ca", "comment": "Malware payload", "value": "153ff5856b4d789a989ae08452d1b4a02bd20735", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933276, "uuid": "efd5243e-db60-4ad8-b2f4-d18b6f7d20cc", "comment": "Malware payload", "value": "6571137be92ca955dd01feb700014bebc3dc35e4d1653925a137281e98d3c568aa711b6504a78b5375e42e11ffa36e7c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933276, "uuid": "cd3108dd-0754-449e-aeea-d9130151cadb", "value": "T1AFA5334A57A6F03DC22665A746C49A4EFF171EDD1A5EDF0B8D3042242607FE3B6C9B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933276, "uuid": "02b458c2-cf65-4106-b436-8f5646682efd", "value": "49152:matMXVdR1I42OlVBOaJq7kz6p0NrwZzUAkh3LG7tuZSTOD60/oY:ma4VdPI42kC01aHk0UG0/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933276, "uuid": "e6f20068-365c-4ca5-9270-3e5b96db19e4", "value": 2239338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933276, "uuid": "f538739b-b753-4264-a0d8-4660c33478dd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933276, "uuid": "cb93628b-3543-49aa-860b-09ed7147775d", "value": "IN97000000.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04024571-649d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752928598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928598, "uuid": "de209387-bfec-4423-be64-e160354c1519", "comment": "Malware payload (Mirai)", "value": "fd0d7a14d039fcf6ad1b7b5b3d5b5f86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928598, "uuid": "c9481eb1-8ead-474f-85bf-9e24162969b4", "comment": "Malware payload (Mirai)", "value": "c5d88d5e642f0a451b13416e3012989867396be756de9d0586bbc0e2850146f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928598, "uuid": "e04acd71-80fa-4bcb-af9c-f9f0ea5f7391", "comment": "Malware payload (Mirai)", "value": "40ed720582b52ae16de19efb6c5995c58fa2c552", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928598, "uuid": "287d6200-3f7b-4530-95e8-2a6f4518a822", "comment": "Malware payload (Mirai)", "value": "5da379ebe8fc7765f940dc208c1a06ddc9b34dd7e2784acea32b2a4e9165de7ddad0cbd1d6fa22e675e0077648946320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928598, "uuid": "67dd7479-5ab2-4150-b9b4-15d670e9f477", "value": "T1E1335BC8F543D9F4ED471570117BFB379A32F1E61228E653D3A4EB32AC93601A906A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928598, "uuid": "6492f077-73fa-4b8b-8895-affff9974f5c", "value": "1536:L58qi4Si4A/qh3E2pMLxTvDTL4P+bSTCYF:L58qi4SiJihbp2pbHo+OCYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752928598, "uuid": "677e03bf-4f21-4c55-a6b9-b57f289d5a14", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752928598, "uuid": "41a7afd5-701f-43fa-9a21-a5334fd12551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928598, "uuid": "693d447f-4515-4461-89cd-08af6a4e96e2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3db8b56-64c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946905, "uuid": "f0792120-8ce2-4bfe-aa1e-64558b6f45c7", "comment": "Malware payload (Mirai)", "value": "5b5c66a71b23b246503673f23d9b5ba1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946905, "uuid": "ce2d295c-33b3-4b25-95a7-254dc4706fb7", "comment": "Malware payload (Mirai)", "value": "c66d5c7847bca5084f180bb39043059e137f50b4e10cd92e82b286876a80244e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946905, "uuid": "49788831-8b46-4b57-9de2-d438c132aaaa", "comment": "Malware payload (Mirai)", "value": "b913ea8c12b6138734b923744f56be3e85bcfc87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946905, "uuid": "b349a1dd-9f05-4ae3-bbfb-e67acb4a7f21", "comment": "Malware payload (Mirai)", "value": "cc697c4b55b264ac49ca4d7860f7a8abf6ee4d7f0bc351da13db9f01ba7620a69de4b0417d0b823bc11965b3a3698b29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946905, "uuid": "422152a6-8748-45e5-847d-349c2dd97e4c", "value": "T12903E15D1949519FCFEE81BA0BF50BC02C21CF71A107A7963E4E666BECD68E136219CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946905, "uuid": "8575bdc4-43e9-46d3-a1ed-c2f766af519c", "value": "768:ET3k0vzcXb38KJMHP39hOh7anffxQ86kHn/vaxTEIefFn3AkJgGlzDpbuR1JH:ETOb2v39TnnxGiRIefzVJup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946905, "uuid": "81c19555-f9c0-477e-9cd7-0cf6cbe5cfdc", "value": 41036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946905, "uuid": "746e566b-05b2-496c-9aee-fb38f10316a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946905, "uuid": "8c434be5-824c-46d6-a8f0-89635d5b7b94", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e009a2c-64af-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752936346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936346, "uuid": "7c8e469f-0605-4f8d-ae3c-2b6b7f2ceb09", "comment": "Malware payload", "value": "b11a5e45d5384812e618d1e49ff02a6f", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936346, "uuid": "653e7e2b-e034-48bb-8a59-1f99a7b02c90", "comment": "Malware payload", "value": "c8905399ff3cdc004596d873e09609313764dfa774e54219984aceb11f781771", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936346, "uuid": "879e7c04-48af-4496-b3d6-518e66fdbd85", "comment": "Malware payload", "value": "c0704105c2a194cd52f070dba600384b66f01305", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752936346, "uuid": "bd2af2bd-fa16-4999-9003-57024133c59a", "comment": "Malware payload", "value": "9cb8d71ddb7a62ac1cdf1c7f0cff08eb2703729444aaab353bdc9323734c32b4e9ab32d4e9cb754534b50796518594b6", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936346, "uuid": "7d69af66-f018-4f76-b5c8-0eb83d3ec083", "value": "T1529303DC765076DFC8ABD4729EA81C74EB6024BB531BA243A02315ED9A5C997CF180F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936346, "uuid": "31860850-d984-41fc-9619-8f42d5fa8668", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936346, "uuid": "a80c50fb-1e99-4301-bf0a-225e8eb033ec", "value": "1536:1eIU6TB8TsI8L9DJ5yLz+bhYi/fRuKAPWg9V:13xTB8TWd5yLibhYi/fRuKAPWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752936346, "uuid": "d09ffaec-9bfb-4424-888e-545239d98402", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752936346, "uuid": "6173f74c-fa45-478b-932d-4903b42d371b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752936346, "uuid": "aba6fa43-f68d-4b3f-b389-bb894581a98e", "value": "addon2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f9f550-6489-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920379, "uuid": "7072a61e-8f9f-42e9-aa6c-95a289e93276", "comment": "Malware payload (Mirai)", "value": "a31b463cd488601440b8b2f8596be735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920379, "uuid": "5793ce54-02b5-4a3d-9520-1941b65262e8", "comment": "Malware payload (Mirai)", "value": "c9a0988091883891a4e6f5d4cc68eaaa7164835e383e17bebc96365952131573", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920379, "uuid": "299567b5-51cd-4e5e-90c4-66ef91287de1", "comment": "Malware payload (Mirai)", "value": "ab12ef01eb0f1787352c10d1ecffe1aedf588c21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920379, "uuid": "6ab7ff12-5b6f-4d7d-9eb5-910007382f52", "comment": "Malware payload (Mirai)", "value": "9e73b7c318d4c985889f2ee51789f9d56b7112f094731fd39f5c6f77fcc4198d1188dfc7b540ef5dea2ba8a5db53211a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920379, "uuid": "4defb418-0b03-4c36-9ccb-73fddd16f4c2", "value": "T107E32AC7F900DEBAF80AE33B48530906B530BBE115921B372257797BEC7A1991573E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920379, "uuid": "a60ac72f-1a10-4c4b-b65e-1a8f3f28e246", "value": "3072:BNOFZTtfpHV/jsR9yWmdJ+pK0cVvjbi4LXvsHy55lzl:BoF1BjsR9yzdiK0cL2y5Dzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920379, "uuid": "da2b32ab-2ad4-4b4f-80c1-090555afa3b5", "value": 151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920379, "uuid": "a25caf1c-0d3b-4ad5-984e-84eb7103fc58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920379, "uuid": "df9c7fb7-7f90-4ea2-a17e-ba9f85eba40e", "value": "iotmirai_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21781245-6470-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909320, "uuid": "b50db27e-0807-4454-941f-50c2e021bfdb", "comment": "Malware payload (Mirai)", "value": "33282d6887d947823120b24498c80a24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909320, "uuid": "0113d64c-f8ed-4c6f-b4e4-7e99bb46e054", "comment": "Malware payload (Mirai)", "value": "c9bccf2af72decdc9df7d474b6f3ec1b3b2b0705a083d3d645f246e2f9dac43b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909320, "uuid": "db743d4a-bcea-4f50-ba50-54d1bc418cec", "comment": "Malware payload (Mirai)", "value": "fb1240c41c28c488debceccfa38a9bc72d95c2fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909320, "uuid": "3c86d92b-0f7e-4393-ac8a-f24d839dac82", "comment": "Malware payload (Mirai)", "value": "575a951b08fb9cfffa6a1cbdb91a4433d38f7a1f01b4d304a40684a49827de6c46a2db2f6d63092e4339811a112b8045", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909320, "uuid": "fb92bf1f-35d2-4ae5-b735-8672349da6bc", "value": "T1AF431B9AF801DD7DFC1FD73A84574906B630A3D242821B37276BF963BC721A51932E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909320, "uuid": "5be751d9-c3bb-46f9-9a2d-ae67b9a3da20", "value": "1536:G0HgLnylIFyL78usLj6W4fiDUlGDXjkR4K+rtO:qy2yLWCiAl4setO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909320, "uuid": "03716900-bf9a-4f69-aeda-f36fe1b15185", "value": 60288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909320, "uuid": "ed05c3fb-c39b-47a0-8fb6-9ad4314143e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909320, "uuid": "a5a1dbad-6d83-4faf-8314-fa2f1edd8bc3", "value": "nexusnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d49dff-6494-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925053, "uuid": "c96f1ee0-d781-4d29-8b20-5dc22fe442d0", "comment": "Malware payload (Mirai)", "value": "73d5af9458fe9d69d50bdc5e636901cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925053, "uuid": "8900f344-fd7e-40d0-98bc-fbf186f01c22", "comment": "Malware payload (Mirai)", "value": "c9d6fe17152ada2e3d8c9e771b76139dddba1ec3e4944bf9795a84c572f01e54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925053, "uuid": "9cb75297-d7cc-4619-9c54-65106f6611b4", "comment": "Malware payload (Mirai)", "value": "ceebe0b4a43daf76c39fcdd82c7847b71155e096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925053, "uuid": "cb9a629d-fa85-44ea-b63a-ed0373b3a439", "comment": "Malware payload (Mirai)", "value": "6da099ef8f9e9d1496fe16d205ff78ebdea062c889eee72ff4919bd04d61db76d82d163cceb7edb84cd9b0d30679809c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925053, "uuid": "1f45db54-c4ab-45f3-bfe2-9448848fb20c", "value": "T1C9D33C46FA414B13C0D51779B6EF42453322A795A3DB73069A285FF43F86B9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925053, "uuid": "bc13948c-3fe7-4145-8eea-c0f4872120ee", "value": "3072:gdTiyN2MknA0YGoZh3t3qZgRLWH5b44XTLADM/9XXmPw/t93:aTiyN7kA0Y93t3qZgtWVLXTsDM/9HmPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925053, "uuid": "58065cc1-23a4-4d03-9774-533209e30a5f", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925053, "uuid": "747dbc99-0b77-4eef-82a5-15e9a999be92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925053, "uuid": "bb6f9664-81ab-41f6-95fe-29bfd3f82b50", "value": "uYtea.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3399f240-64c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752947147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947147, "uuid": "d88db226-63fe-4f75-a491-e0aa37703e6d", "comment": "Malware payload (Mirai)", "value": "85afff3268f0ed6820bde91d8fc88da7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947147, "uuid": "1ebda8fa-9912-42d7-8de9-4f0a8897c638", "comment": "Malware payload (Mirai)", "value": "caba7dbb22d8ae5621a8eef3e515a48b1e1dbcba896946083885a2a8ff86c176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947147, "uuid": "f5d00ab7-a095-498e-9996-2c39a2888986", "comment": "Malware payload (Mirai)", "value": "5c0ab3287579993fe6f54a16caa2d99149eb9d0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947147, "uuid": "4863bfbe-c419-4fab-b7a8-5277b3b0ae37", "comment": "Malware payload (Mirai)", "value": "0ed72acae5774f3b5bd7493054b49364a80a62093958aaef19cb1024758c674e882c6b1919e96d3df40f72ed346f881c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947147, "uuid": "ece7898c-63ef-48ee-87c2-13c3ab99e946", "value": "T1B8E318D7FD00DEB9F80AE73748174805B530B7E248925A333257397BAD7A0991973E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947147, "uuid": "03a3debb-94ff-450d-a803-52db7e425382", "value": "3072:ze0iGDQRWRUstyW7Egn0qRZh3dnwOVijbitL0pCcyT3vwD:ze0igb7EghRTdwgLkyT/wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947147, "uuid": "9f00bf15-01a6-4b37-9118-addbe17f7785", "value": 155360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947147, "uuid": "caf120cd-200a-4d08-ba7c-6dce75df3dfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947147, "uuid": "4b96fe6c-3a11-459a-97be-1cd68494abfb", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f623eb9-64bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752941529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941529, "uuid": "d31354ab-ebbb-415b-b620-74158d9881a7", "comment": "Malware payload", "value": "3119df6c716caa956c54ab0acaff3a96", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941529, "uuid": "0c581000-8452-4e56-9994-8abcc00a9563", "comment": "Malware payload", "value": "cae777f6d88874325a18a95690fbf16b3d2ef3a3eea9872a66f9276681532321", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941529, "uuid": "840b626a-ef4e-4277-aa55-bff6ff1a87bc", "comment": "Malware payload", "value": "0a25c2cddfc21a9dbb507266e3dac2d883845f72", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941529, "uuid": "88ef749f-464d-4c2e-b028-3f1e2c5bdd96", "comment": "Malware payload", "value": "b503b56c5e1e8f549ba1ae644d4ef2fffc5014dee44a47aae95ced8830b84dd1441f9c46905760a00aa73f210f7965e6", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941529, "uuid": "8c152345-ee1a-4688-9ed2-466301caecd2", "value": "T11D35339229544077F8E7A03AEAB9EC7A1F87C701CD929E0753D58ACD0ED8B77191C0CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941529, "uuid": "faf72c73-6858-4f93-9989-cbc9bf3d49cb", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941529, "uuid": "75f0850e-2009-41e9-b95a-c6873c7c2886", "value": "24576:AzZbM0HRVsERm85sfx+RSIF1vtV5CGngHtjVgd5UIwEWuewsRxmiv88v31zYF8PS:ARMmVskm8c+RmHtjVgPhMFAiEIlE86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752941529, "uuid": "859ebc9c-adbc-44ac-a6da-97da8eba89d5", "value": 1104220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752941529, "uuid": "2d3343e6-d4f6-44cf-8cd5-b1b4d91336e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941529, "uuid": "670557aa-b7c5-43e3-a86e-26f280d38731", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48f0236-6466-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752905353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905353, "uuid": "ed436027-0e59-4fc7-8aac-1ed5bb5aeb74", "comment": "Malware payload", "value": "a200244417bcbce222a786e90e18f2cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905353, "uuid": "93a3557e-7891-4777-a5c3-4ee0eed3f72e", "comment": "Malware payload", "value": "cafe34ba8757f2d38c5f76c8a7a2c1b878e5b2eb280ec4de38fdd7374a1ec428", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905353, "uuid": "d734ec1e-648a-44b2-b545-be4fb4006368", "comment": "Malware payload", "value": "06aff5d864af5e394e23525673f86326cd957498", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905353, "uuid": "8400de8d-fee1-4f7c-9c48-fa93a0d4f7c6", "comment": "Malware payload", "value": "b7e64ff918f436c199e4f408b19ae96941d9bb7406ac6204a972afc3f5c64ddce2fa16f42d734237c9c732dffb469b7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905353, "uuid": "09e9cfdf-275d-4f04-a40c-5d6c3dd28632", "value": "T1F7534C02B70C0957D1A76DF03B3F27E5D3DFA68012E4E684291EBA49D1B2E31518AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905353, "uuid": "7d0dd4a2-e124-4a20-b5aa-895dcae839b6", "value": "1536:egCb2RD8oUZ709QktuhlOPYCJZ5ilk15A6Ey2pT:fDquZ0ls+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752905353, "uuid": "9844aa9b-e377-4ea3-bb4a-265084774464", "value": 65044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752905353, "uuid": "acf4ab75-dc71-47ef-9bde-0464ee1db9d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905353, "uuid": "258ca4d0-2bab-4e13-99cc-bb5b59aaabdc", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3500a3-64d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752951347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752951347, "uuid": "c1af679b-2603-48e0-9b21-d7822d161747", "comment": "Malware payload (Mirai)", "value": "7b67fe23a32986dba527c6fff734766f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752951347, "uuid": "bc75900b-02c7-4810-9935-ed169975a1ad", "comment": "Malware payload (Mirai)", "value": "cb1a1b38f3010e91c4b8ef7b09a91dc501bdd20ac50f7e246e64f178cf830df3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752951347, "uuid": "72abfdde-fa6a-49db-8e61-142398469912", "comment": "Malware payload (Mirai)", "value": "69eb9bda12aab49d612dd7facc2652989e9bc4a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752951347, "uuid": "cde0d751-00ce-4a6f-9b37-a7ea3a91962d", "comment": "Malware payload (Mirai)", "value": "32d47fdf5d1e476419db9f2ebb957af35fde1caf6232ca3741f554a992b2bb5aacd128b2d984f6b909dbd144b2702b49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752951347, "uuid": "239ca146-223f-407a-8bcc-6990839c8930", "value": "T16DA3833F1B270F63C0DE213105975276ECBED74834BC9B979CE0686D6E1A9A830552EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752951347, "uuid": "a43e2422-33f3-4a59-ae4d-6103ab5931fb", "value": "1536:cQZE/QaAFI2Da/1R6Pn6SFtCg80ngezgMwK:cQZEo3cAvVtCgwezgM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752951347, "uuid": "387d16b5-0101-4080-9aa7-859bced301e5", "value": 107089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752951347, "uuid": "e8fe9dfe-c013-4eb4-85a6-a7fe73cae705", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752951347, "uuid": "0d4969d9-502b-4de3-b5cc-a5494c64133a", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f164f8cc-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933292, "uuid": "63f9e3e5-1e4c-4ee7-aebb-174a2de0722b", "comment": "Malware payload", "value": "fc023f4e1dce17fdaa6764b08e2fd02d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933292, "uuid": "d0d9d8c2-ad52-4478-81b1-df1eaa34c65e", "comment": "Malware payload", "value": "cb2d88dd274c268e1fca382cc8d94006098021ccb7c9a4011ed637e8dae834c2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933292, "uuid": "58a24493-b53d-4ca4-9ce2-2092e4a36019", "comment": "Malware payload", "value": "6b77721b5c1e16964232ee49f02eaf57b798584d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933292, "uuid": "915b17e0-3118-4a22-b4ab-60795a1f6465", "comment": "Malware payload", "value": "26b7c73d1588d03f05e3562eb3067f9e4df3f812edd63588367f811c32dc27f3b068770e3b75c78a3ef9bf4b957c2784", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933292, "uuid": "2a42104a-2a32-4705-b934-394f0f79b28f", "value": "T1FAF02E0646E1172AD0715D3C46F59791931A73429B4DA36F5691420248B4705EBBDDE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933292, "uuid": "88d2431c-ad1d-429b-8df4-2fb841343648", "value": "12:8+blBstsELD+KZE8ZD9wA7rCj3Y37UWz68Qy68umW:8+bQT+KxHwAGGoWQVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933292, "uuid": "32e407b3-948e-4855-a4ae-e8e89c6ff992", "value": 600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933292, "uuid": "60b8431e-258f-4a66-b6a8-b85654cd7667", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933292, "uuid": "f7452e90-5be5-4727-92c7-cee158f78b84", "value": "Invoice WM1073ZN_pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da0ae60-64b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752940801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940801, "uuid": "6b7d8e86-78f7-40bc-9319-95503bdbb8c0", "comment": "Malware payload", "value": "75c78b5218d8128396b3ad03b6190a95", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940801, "uuid": "96ca21af-7969-496f-a2a6-b133577fb583", "comment": "Malware payload", "value": "cb6f2bac0167f527d2bbf2e80c1f85b0a213036ee46580a41a8df84cb3ba3682", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940801, "uuid": "05f0e4b2-dd62-455e-98e2-57317bf5b417", "comment": "Malware payload", "value": "89ea57c8e9eae99a387f0a6a35e133a5eb966e8c", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752940801, "uuid": "ccc5e931-5274-43b2-bb41-36db464b6faf", "comment": "Malware payload", "value": "5cc365bffa4a473bbf916d89a8a8a0f011d0c3e0f3b97ef34027665e1d2a3929d2940749301523795d9c5c38f4ed91a6", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940801, "uuid": "5b36c06c-32bb-4378-b4ca-5a54357d67ab", "value": "T1A3B6544CD3048A5B107FF64B02F5151AA4BA91C8B25335574BE3EA0F378983EDB1AAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940801, "uuid": "0607b69d-801c-436e-980e-5f7378d3539e", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940801, "uuid": "a825e0f6-d60d-44cd-bb92-9a268f477400", "value": "24576:IzZKhALys8YaSUEvAq4XFM3B+avLDXns6vi/TT1619Eib3QI:IMqrrpvn4XFc+uXFvi7Q1Wibx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752940801, "uuid": "503e87cf-686d-42b5-9dbe-1384bc9e4042", "value": 10485784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752940801, "uuid": "b4c6913a-7562-4192-b244-746d5ae45824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752940801, "uuid": "b7396d2e-3341-4940-93b8-ab68c91b53b9", "value": "Latesten-v.winx--Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f200d9d1-64c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946177, "uuid": "d49780c8-602a-4b96-ad1d-953300c02403", "comment": "Malware payload (Mirai)", "value": "89cd6f60d1e23fec630087c18ad83963", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946177, "uuid": "48b8de39-9ad6-40f5-8263-27820d516ef1", "comment": "Malware payload (Mirai)", "value": "cbacea9fabf5d49ccd0200a0aac24fa0bfd6d0decb1dfa3dcb486ac681c6b329", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946177, "uuid": "252f2ce6-3847-49e3-9ed1-6e5670675350", "comment": "Malware payload (Mirai)", "value": "58f9e83dcc960a07224834e014c67f87b9e07aa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946177, "uuid": "5be6c1dc-37d8-413b-b104-61b4bd238bbc", "comment": "Malware payload (Mirai)", "value": "42a56493c3bf6e08acd3bceca090e14d3f47373f9b19b479a9b7d2ef4ba116e39551b8b7173de4b0a0edc9e62e30a118", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946177, "uuid": "57203781-6490-4819-80e5-f759b064571e", "value": "T16CB3E70AEF610EFBE86FCD3346E90B0525CC551622A83B7A3574D828F54B64B4AE3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946177, "uuid": "8d4445dc-d8d2-4926-8013-6ac82b3faaec", "value": "1536:HpARG1AaG1WfYjKrSbCwvZt0+EcOBmDvvde/ar9Ezq1WTthWL0ZPNsoYdlL3t/4b:HpARG1JiOSbC/axEzlTthWYEBF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946177, "uuid": "348c64da-358a-44e7-8b22-42c6abc1c0d2", "value": 110076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946177, "uuid": "9cb21580-2878-47bc-9be8-477199f96ce3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946177, "uuid": "98cdf778-b15a-4887-b6f9-05ea97e002e7", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e209f642-64c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752947439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947439, "uuid": "84fc1956-71a7-4e57-8097-5e9fbbeb2907", "comment": "Malware payload (Mirai)", "value": "4f725fc296e85b498684de4300550b78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947439, "uuid": "50ab3caf-b5f3-44d3-97a6-1f1461bc7797", "comment": "Malware payload (Mirai)", "value": "cbd17836ab3d7a8db1dc284f6beada40d3c9bde5727e0670f80b0172c1ac3ecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947439, "uuid": "4c2e8400-64cb-4696-80de-8518d74d4bec", "comment": "Malware payload (Mirai)", "value": "e68bea53e517dc4ffc8d84a906c33c24b6e359c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947439, "uuid": "335cbb3b-0c1c-4c72-bc18-a31c45e60aca", "comment": "Malware payload (Mirai)", "value": "a295834991fd2dee237ce816d8113c1512373b8cc3c8e4d517b8b09e86fd28bb0b5f8415a7c3c093b2f156e947bf0b67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947439, "uuid": "65fd9a40-e55a-4b87-9da8-368776fb3b2f", "value": "T1A2A3F70AEF610EFBE8AFCC3746F90B4125CC552722A83F7A7574C928F54A14B4AD3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947439, "uuid": "5b9789cc-f248-4ddd-b066-e0f046c39fd2", "value": "1536:9F//9RicOIdE62FZds5myA0gTYHUODPg6j2FOtqiz7xvSi21EzZc4W8wlFv2LrgN:3//9RicO4kds5myvHX9vSi5zuv+n74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947439, "uuid": "4e651eac-d0bd-487d-8a4c-0dd9260c8c86", "value": 104988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947439, "uuid": "2ed2ef8e-7807-46eb-b5bb-5e32ceda1927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947439, "uuid": "cd99790b-f241-4903-b066-6e445fe51b28", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9894fe40-64ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752934861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934861, "uuid": "7e05648c-e77f-49db-b050-d52460f063fa", "comment": "Malware payload (XWorm)", "value": "aade392ff6acf82edbc907fecee45309", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934861, "uuid": "d67d04f3-4c4f-4b3e-aa87-837440780413", "comment": "Malware payload (XWorm)", "value": "cce44cdb3939156be7f4d64fb00bfb8210c02f14993f7536432bcc523434e6f9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934861, "uuid": "ed4686d9-ec4c-492e-aded-88cba5e93f3f", "comment": "Malware payload (XWorm)", "value": "c38a0108747c2105f39be3e80af69e26b663f0ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934861, "uuid": "8e643b3a-bf6d-4126-a4ef-8ad2a336fe81", "comment": "Malware payload (XWorm)", "value": "db0c599141f548820d56405dd3531d46808dcc0f47d85298b5b25d7669cf57022d10372a08fe9e2ff751d5984cab43ee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934861, "uuid": "3d894c53-6bee-4920-aa0a-717c50050816", "value": "T170837A3D190C32C02E238738C3E5463999295E17AC673D853E7E6537E7EBE996432272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934861, "uuid": "69b60e7a-2885-4664-9687-5f2397ee3818", "value": "384:iSnkg5RUdwxg54sJ6/zHHM+lg+1pxk0J+S9CHcr9hLlTwd9ghjXPNIEyxX4lQe:igg4/9CHs9hm9glPWEyxI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752934861, "uuid": "2646fba7-ed2f-43bc-b48f-7bc60dd5562f", "value": 81821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752934861, "uuid": "49f15521-cf37-4231-bdc2-7e0662014790", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934861, "uuid": "773d8b66-83b6-4a1b-86cc-0901062de96f", "value": "Arrival Notice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bd2689-64ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752935148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935148, "uuid": "ec72c66c-b14d-4a97-91e4-e20486053ffd", "comment": "Malware payload (Mirai)", "value": "f32a5c5afe7126057af7f76111a11c60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935148, "uuid": "41ae3fce-0814-4363-8ae7-ce501b963886", "comment": "Malware payload (Mirai)", "value": "cd0d95bd289d8c21b52d0e63623045cf0ca5dd1d1e9a8b5ae1a58d21d44a34ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935148, "uuid": "8da07fb6-1f91-4ddf-8366-9bfd74f9b17c", "comment": "Malware payload (Mirai)", "value": "fb9c7d5bbcaacb4012fa5fbcfb2ab436b0844458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935148, "uuid": "c67dd677-3c27-4e61-9d75-a088c7448e5b", "comment": "Malware payload (Mirai)", "value": "f9a1351778b441bb1e155776bf26d28dc2d84ac7273780156b9be4cf592be5f6182a11056836d028b7f52fa489046eb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935148, "uuid": "8981e8b9-1b7a-4ef0-9491-86cc146e7d4a", "value": "T1E143E805EF914EBBDC6FDE3706E80B4231CDA50722B83B393574D528B65A5474AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935148, "uuid": "2cb61111-c528-472d-8953-30846d8ddeed", "value": "1536:pnYhMMaK3UXq9EI/KwLtgDdHxYZo7XXgY:mZaYKataHgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752935148, "uuid": "46e6df85-b5c4-4dcd-bdcd-b83112dbaab6", "value": 59876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752935148, "uuid": "b57b3abc-1b7f-4562-8183-c18b52f13be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935148, "uuid": "d13334c3-99be-44f1-be44-1370dadfb858", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f5ac35-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1752933056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933056, "uuid": "1131be0f-6c23-44f3-8377-3c8e7295bad0", "comment": "Malware payload (Vidar)", "value": "7f98f5631c21a5999136d4b6d20c22f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933056, "uuid": "190578db-b337-4c37-943f-2786486f8729", "comment": "Malware payload (Vidar)", "value": "cdf9365a865549157afd60e88276382db2ba4b63b2283543617d8dda6814d7d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933056, "uuid": "251a3d01-7eeb-4858-950e-fc12d43632e0", "comment": "Malware payload (Vidar)", "value": "0ab49b071273e2cf48bf73bc81c09670816ae605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933056, "uuid": "d43d59c6-8886-4546-855d-05c0c2720d87", "comment": "Malware payload (Vidar)", "value": "3f58fe9aa256ac3f5f8d8e2c4064ebb34bb9eb40bfed4e5b880508f00e028e0d94843cfbc9cb17579b98d8d084fa2787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933056, "uuid": "3a1ba611-be1d-4429-ad90-62d9ac3c80ff", "value": "T182F4D006A75264EAE867417989236541F977B8268338AFEF43D8E3325F137D11E3DB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933056, "uuid": "b32b55e3-e869-45ad-bbc2-0a348efc78a0", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933056, "uuid": "586ffcb4-e514-48f8-bc14-a7ef6305c3a4", "value": "12288:pat+lYdyC3oXivoTOhJvrYbeKkPgLgVbFEXXwUj0jxpnlOXYb9XXwUj0jxpnlOXd:pagOdyCGcoTMukPAXhj0jxuoJXhj0jxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933056, "uuid": "cb8c9f95-5900-435e-a2ad-0e91e9ca07d4", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933056, "uuid": "304a3fba-366d-403f-a74f-af887267099e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933056, "uuid": "1a27fff4-7426-4542-afa4-0dead0bbc75a", "value": "v999f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b936833-64c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946784, "uuid": "e6ea54f5-e836-4093-8a14-feb0069a493b", "comment": "Malware payload (Mirai)", "value": "95fc47ff47c6a5b08f044c066e9e9781", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946784, "uuid": "55cbbf98-983d-4250-b7e8-c9fb72cc0ca3", "comment": "Malware payload (Mirai)", "value": "ce5d6779bf0a00e81bc7421c0702b232efe583a6e19962c126877eef52eada28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946784, "uuid": "58a55636-0acf-4f1e-8686-3fe741cd0633", "comment": "Malware payload (Mirai)", "value": "e7990c2911c53672c4b42f6d94bcbad2c4e76e3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946784, "uuid": "1f124a05-e943-49db-9037-735c6aa26a4a", "comment": "Malware payload (Mirai)", "value": "13310835827c5f2d696347915587106c3944e48dbb3987a655882cb23a538053cf6ce6aa407f045966d5dae3d7e16dc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946784, "uuid": "662c57c5-fa11-42e3-b16e-604bf12cc71b", "value": "T166234B95BD815A03C6C411B7FF1E8288772703A8E2FA3303DE29AF2177579670E3A556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946784, "uuid": "6bde7397-b23f-42fb-8f2d-62dd9308cd75", "value": "768:oe9zqw6xZ3mgsnDBAtK7KIQM1hIbwPGgXOZUBeBV2wFyqeNV7ljCvCI:oI/6x2nD5zzIvgXOZsGhFylNz2vC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946784, "uuid": "389ff88e-f105-4be7-8b7c-1c0755ee7778", "value": 47980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946784, "uuid": "25c5985a-e88b-4e56-bc79-9f3a9c4d2009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946784, "uuid": "cec02da1-fa8c-4fdf-9a26-6a36567f008a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1b9c77-64f6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752966943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752966943, "uuid": "84d56125-c478-4902-8b06-1ac57c89caab", "comment": "Malware payload (Mirai)", "value": "6cd55ebaa00b7c7e389b9b8b24491f7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752966943, "uuid": "e03230c6-c408-41e7-9429-87291af25c02", "comment": "Malware payload (Mirai)", "value": "cf3ad61a9e2b8fae23ccb9cef0378b50cc2571b1dde4bc9e0d624ce25bb4ed62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752966943, "uuid": "dc17da44-e634-4bfd-be4b-9334bd67249c", "comment": "Malware payload (Mirai)", "value": "c68e99fbac68b0dd283b443b13bd84a75accbc05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752966943, "uuid": "cabb3591-12e0-41b3-b0c0-0294b3b07878", "comment": "Malware payload (Mirai)", "value": "b5ca797413e33486e3a07ab86e2dc403c022a7a8ebdb129c7687b0f969d577e252918c69cec5680545f35df14c732d95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752966943, "uuid": "f689b097-63c3-445d-b665-9c493c7c8024", "value": "T19BA33AC5F9409A26C6C145B3FB1F428D772A43A8D2EE3203DD295FA1778B85F0E3A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752966943, "uuid": "6d0c17a6-9eaa-47c6-89ec-cc7e7ac69b61", "value": "1536:aayrwKmT0VnCEK5BIpZyERc1Wm2sWNDgWSm8epeOby0z0tZcH+7M0mWg:4rfmcVSYZyLY1NDg3e/6cQR9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752966943, "uuid": "1234a0b7-e86f-40ea-b0fb-d28e891f47ae", "value": 99732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752966943, "uuid": "ea3c2ddb-1fd7-402d-8f38-b26795dc1e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752966943, "uuid": "e30ac9b0-38b7-4291-9e9a-9594284af6da", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bcad74-6463-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752903751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903751, "uuid": "3894d613-85be-46e5-9978-3b319161043b", "comment": "Malware payload (Mirai)", "value": "c7c45835b6769b00f408b684ec76514d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903751, "uuid": "3551d964-e573-4b2b-a3f4-957f8abda7b3", "comment": "Malware payload (Mirai)", "value": "cf9fd76d8ea768b2d208590e2f7e5713359c6c7101cd5ffdf83a94a8285b9ed3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903751, "uuid": "8b5d15f1-41d4-478b-b86c-737532fa42c5", "comment": "Malware payload (Mirai)", "value": "7302bac6be2ee4d1342800cb5d5910b5b17a8dca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903751, "uuid": "abbd795c-c971-4fae-b9d0-3757c8b76091", "comment": "Malware payload (Mirai)", "value": "642db764ae3b2cc85150a93242e24223ea9f22146c73b1c80865f8e4c60765d9bbed864a52469bd7d240120ffb33d347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903751, "uuid": "aa33cc66-a246-40da-993a-eec67f289f8d", "value": "T11283B71A6E319FFDF26C873447B74B21A7AD23D623E18685D2ACD1101F6038E585FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903751, "uuid": "d21085a8-b173-4dce-85df-935ec662fb27", "value": "768:WW9JUOGwJ+eJILE43LNLI6ILAz5ausXP5hk+7u0F63ER0Ld0hA7VWyjBYenAuMP3:DqbZiusRhk+q00ERGl8eAupljb1inyqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752903751, "uuid": "78df700f-4d47-440f-abe0-c7662cc61156", "value": 85080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752903751, "uuid": "8c54dc4e-051e-4183-9301-40c31dbd2460", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903751, "uuid": "d042448c-bf15-4770-8045-e290018bd0c5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a95c88-6463-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752903855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903855, "uuid": "0e47133b-8522-4820-a996-06b74fb41f51", "comment": "Malware payload (Mirai)", "value": "467ee071bd9c6c99d32dad8d7b1518dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903855, "uuid": "c7f74289-7aaa-46f6-b05c-703a09dad894", "comment": "Malware payload (Mirai)", "value": "d0644b4a636ea6471db18b4861c89684e0e24f5d7af26a5173393d23e74e5d61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903855, "uuid": "78b58283-b08f-4d6b-b06a-60006704ad08", "comment": "Malware payload (Mirai)", "value": "485a24adc28d7c4b31d046bfad4f4139ee25d26e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903855, "uuid": "259f756c-91f9-46f7-9bdf-8ac694811f8f", "comment": "Malware payload (Mirai)", "value": "4b3a7b892d25a0d19d609ad90a8935c4d0b6ef12c1e99e07b78816330d408caa25548109a41bbbb0c21fd058407cc56b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903855, "uuid": "d683fe31-abbf-4497-b26f-3491415317c4", "value": "T164534C17E48080FDD4EAC1759BBB7236D533B57D1239B21E27C8EE166E5EE212E9C600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903855, "uuid": "e269e18e-2f71-4df1-8068-ef1f3056c72e", "value": "768:0NKKZwyUw0NC8ZfciLprgdu4flpPEeUzy/344dE4Ht3xk2wQuGpB535KIWu08h:iZ21ZfJLevlh+y/440yuo/3gRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752903855, "uuid": "de676941-2552-4119-a773-0ec8b92b10fe", "value": 62792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752903855, "uuid": "9bb35146-4fb7-4a36-ad7b-078fd67dc06d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903855, "uuid": "34799d0a-c848-46ab-8375-6adb9a9b8ff7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11a92d5-6463-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752904005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752904005, "uuid": "d2d0bbc8-ea1e-453f-aaba-1b21bee5ef49", "comment": "Malware payload (Mirai)", "value": "09e96dbedff0f90d30e3719bfe92431e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752904005, "uuid": "73b958c2-e720-46d6-be3d-aecd478c5b59", "comment": "Malware payload (Mirai)", "value": "d0a65ec7b0b038013343cbbc630b4f5fb6e076a43a402de58122157e3079dda1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752904005, "uuid": "6284228d-2242-48d5-9361-7626d29de653", "comment": "Malware payload (Mirai)", "value": "0d21a921ea25ba59a7b48be9053f3f83935320e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752904005, "uuid": "1fee5752-e36c-4c1a-9ccf-f776bb7a8acf", "comment": "Malware payload (Mirai)", "value": "636787f937d8785b198060dcdc3a20193daec51f5ef40f406dbbc433317292d6870348f152f13cf561e6371fd592fafc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752904005, "uuid": "0704b778-d6a4-4b3c-a678-9e2e8d37b868", "value": "T163634D22BA761D2BC5C4A47A71F74335F2F2878A24BC86173DA20E4CBF6564032577E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752904005, "uuid": "17c8de1e-05e1-4208-890b-5bae467921e4", "value": "768:fFo+116xMEIr6sRCnWtFOx6O+ok5V/nxH5SX5stLgiAPX69jWpXuu37KcIQZyy:fFX116xMEIr6sRCWtMeok5PtH92Xx13P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752904005, "uuid": "5a2d501c-79ac-4918-bd56-fbbcdb4b076b", "value": 70624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752904005, "uuid": "144d04d1-cc10-4ca7-a0da-e0dcc4710d87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752904005, "uuid": "d1225ec1-5a03-4577-9cb2-cfe253601364", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760fdf79-6488-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752919770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919770, "uuid": "2e5b1c79-5eeb-42e6-8221-eab796953868", "comment": "Malware payload (Mirai)", "value": "b92570c573d52a35f590dc5eef4895f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919770, "uuid": "9e29f504-d08f-446c-aed3-1adc3137a0c5", "comment": "Malware payload (Mirai)", "value": "d0a9cbc2424bfde31cd113816e0115f85126ea5a035231e7c42d64b586813cf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919770, "uuid": "51c907be-8b82-4a1c-8277-9e4ebb75fd2e", "comment": "Malware payload (Mirai)", "value": "523421539af404ce20dc44c0fd548a960563ff1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752919770, "uuid": "4e893600-4d03-4891-a94a-343987612aa3", "comment": "Malware payload (Mirai)", "value": "74efe202526726c1df9d932a5385149cb0196b0b50f5ed76cdb6746e7257056e40dde9a11d742a98cbfdf41989d48813", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919770, "uuid": "8cd8c70d-0f0b-4b30-a987-507ddd5432f3", "value": "T16C638D66D019AC94C4844338D4E68B792BA3F80483772DB6AED585BA4047EFCF9193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919770, "uuid": "a1c7671c-c4b4-403b-a130-22796216144d", "value": "1536:+aB3vYpiWFe99tfwtk3aUPpmg//NcjN0SVPzn2Cni:+oAAWA99tfzIj00Pzn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752919770, "uuid": "a784cd65-088f-496f-876b-142bc572625a", "value": 72260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752919770, "uuid": "e26a9a05-8e1b-4045-8a45-8612d03e8d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752919770, "uuid": "1482ef1a-3d51-4d0a-8f43-73376953ae89", "value": "UnHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b93c7a-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933113, "uuid": "fbabd21e-9760-4422-91f3-f390e84ce6fb", "comment": "Malware payload", "value": "209f00ad73007e98bf3cea67ed2c255a", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933113, "uuid": "3872f297-e666-4090-bef7-868bf4e857c5", "comment": "Malware payload", "value": "d1058a9308900e555e700283900b9933b31ce4496888fcbbfa92045f9cfae39c", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933113, "uuid": "3ae34300-6651-4165-bfec-b92bff88ae8c", "comment": "Malware payload", "value": "44bbb4b238c745d611a7cc6b2846673adf82d7c9", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933113, "uuid": "69c3be76-83fb-4d39-9f67-403fae7576e0", "comment": "Malware payload", "value": "a2417829f4756d3dc7f862781435eda0dc5ce3dabd8642057109cbe375edc1cfbfc6b5090942e86683d99595906244e6", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933113, "uuid": "93a35a1b-dca6-40cd-ae50-5cefd69eed1a", "value": "T12B45F611FA03C62BC699223108FA93FA2774BC4A5A850757724DB33D3EFBA44EA57744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933113, "uuid": "a7368903-1a15-4d0b-a014-8f7da506f988", "value": "24576:y59yggpgCkMiAiTYT9wplsIWIulQB5kilPJIOIKlHpVQ6l7KIRIGlP5kZplYRPmC:yW6lbDQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933113, "uuid": "889eef6d-9c4f-4c44-b61c-9384d0ad3b5b", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933113, "uuid": "0bdb80ca-91da-418f-a357-83371330f858", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933113, "uuid": "fbbd039b-b7e6-4fcd-abc2-d4671e5450a8", "value": "VAT3_Return_A009170282M.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05e28b9-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752907923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907923, "uuid": "d16decbc-3acd-4b01-85dc-bc97f26145f6", "comment": "Malware payload", "value": "9c62d341c1f0197034cce02f29cd13b5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907923, "uuid": "d284e48b-6c24-418b-b4a0-af471ac8f8dd", "comment": "Malware payload", "value": "d23ac9d499bd1167a4d0f37ab3c23ce074a7673eb4f8d5c96993548a961be94e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907923, "uuid": "6ce36d39-d827-4932-a250-febdc9f88dc7", "comment": "Malware payload", "value": "d91e65c43c82428dec9607c08ec7ff154053f6ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907923, "uuid": "16ff8619-93e2-4c79-b51d-8eed223f9f7b", "comment": "Malware payload", "value": "97bf904da34acfd7b7366eb2b3bf78d1f78bcbcc2abedd147df7a69e9b289793197eb7fc09b72f1e5557aa30b52e23df", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907923, "uuid": "a06b2789-737f-4d15-8303-e7436dcb70b1", "value": "T14A7157CE626207757DA1ED27737F448671E0E087A0C6AF9568FC79F880CDF0864616AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907923, "uuid": "963163e7-821c-4987-8cce-3daebe45f461", "value": "48:v4U8veheq/zJOzJJsEq6QuaETSJ/kz/iaMiaLYCi/SlSF:v4U8votAscQIMQZ4LYCi6QF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907923, "uuid": "8c9cf006-3c6a-4b8b-8cbd-33acd6653f5e", "value": 3610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907923, "uuid": "1fb1abf5-fdd7-4ca8-b27b-7bcb99ba4876", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907923, "uuid": "f269caa3-d5f1-4adb-b38d-9ca0510d2faf", "value": "enp2s0f0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd21e0f-64ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752941471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941471, "uuid": "0c59fa39-6b91-4c78-8764-6861ff1703b4", "comment": "Malware payload", "value": "98963a6ce76bcec1e7e256b00a3fafa9", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941471, "uuid": "30f2e242-852c-4583-9cdd-383f64e0254b", "comment": "Malware payload", "value": "d297499c55bfd15701916371803aec8a41682bd399ecb1ff6245e11844dfa312", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941471, "uuid": "5348260b-4325-4138-97bc-756f285a108c", "comment": "Malware payload", "value": "77a55ab7b8ed431261637244ee251e5cb994f881", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941471, "uuid": "b58d8353-27c8-460d-9e29-12342c485132", "comment": "Malware payload", "value": "0b3af5886ec38134731dea961cc632e311d7e9de38deb256ca537289017a4f01a4f2588d7280302047b4644ac52a0538", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941471, "uuid": "b52c0255-8b5a-42ba-ae2b-384bfae9f4d0", "value": "T19F2812A0B3517F28E69F60E583D4C82D0B6BF1475B9266370EBEF18BB94153211F8B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941471, "uuid": "99010cf3-c58c-4767-93b1-7e2b0cce564e", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941471, "uuid": "6c663515-acd9-4b87-a189-e3390d7aafc0", "value": "24576:AzZbM0HRVsERm85sfx+RSIF1vtV5CGngHtjVgd5UIwEWuewsRxmiv88v31zYF8Pi:ARMmVskm8c+RmHtjVgPhMFAiEIlE8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752941471, "uuid": "b60d9eb0-15ad-4d70-9a1e-99f0e984d30f", "value": 94371836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752941471, "uuid": "a7ae752e-0265-487a-b629-4ceabb9e2f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941471, "uuid": "cfc20569-c9b6-499d-a1b2-8116ce871d65", "value": "\ud835\ude4e\ud835\ude40\ud835\ude4f\ud835\ude50\ud835\ude4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b17f5c4-64cb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752948555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948555, "uuid": "2e7f2e1a-aa61-4dbb-85c7-510927370fa2", "comment": "Malware payload (Mirai)", "value": "9132fdf9bc6e0aee4a9336d47aa2296c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948555, "uuid": "fa6e6063-7928-4337-ac58-166a908ff415", "comment": "Malware payload (Mirai)", "value": "d3e2b7563f92982267e822718ac8c3283de40870e3de3d0f4617bb13e13e00b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948555, "uuid": "8ff775d3-6568-46f1-ac2d-2776f3ece6db", "comment": "Malware payload (Mirai)", "value": "cb6bee7d0c124f8dbf2fc33a3dce34be00074ba7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948555, "uuid": "1370db8c-cc08-46c7-858a-1c5cb78b82c0", "comment": "Malware payload (Mirai)", "value": "c3f6b29b6c33b09ee8ad7329d546cd5716bcf130912aa0b66e91873cfb55a2d184ceba31e74a058ad41805f3867d0287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948555, "uuid": "8cc1a931-61ee-4329-9b7e-95ac48ec025a", "value": "T11FB3C84E6E228FBDF768823047B34F25A75823D63AE1D6C5D2ADD6101F6024E146FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948555, "uuid": "61d286f0-b670-4446-b287-e6ec4304ad5a", "value": "1536:uos8Ihs/D+BnjqnBQAdTs5BiYm82I/2tLedriKSfirgOV7:14s/ujKBps5BiYSI/S9HfVO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752948555, "uuid": "6a89fe20-4234-4260-a8b1-baec863bde27", "value": 110076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752948555, "uuid": "71f78bf9-a7cb-4259-82ab-72ba68b530e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948555, "uuid": "119d79c2-f7e3-4a03-ad2b-ef98e18bdfa4", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17274c1d-6493-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752924335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924335, "uuid": "1deb0f2c-ecb3-493e-a94c-9372a346d51d", "comment": "Malware payload (Mirai)", "value": "bae43bdde4c554ff8c13c896f454a5b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924335, "uuid": "67719cdc-6480-48f8-a95c-9d393b51cbc9", "comment": "Malware payload (Mirai)", "value": "d424d1f299ff4fc698ffb4c1b1797e3ab987e918b26e4c32e0dc260e8fb3c04f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924335, "uuid": "4281c1cb-6f7a-46ca-b8f5-13287e27f01d", "comment": "Malware payload (Mirai)", "value": "d1617b7a6d1a5e2e637fc7e603afebe4a14dfb88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924335, "uuid": "5e8cc16f-7a41-42d9-86c1-316ebbf1e508", "comment": "Malware payload (Mirai)", "value": "6356ec8a2c1beb4372c2849f6d8f0ac862c821a446e155a941da49199bcd78a671082115f0a24aae991d835e00dd5379", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924335, "uuid": "dbd9c320-b581-4438-bee8-1536211ae7e8", "value": "T1FAE55188EEA8636DC7F1B2FBE61843CE72730FAA67A930394534867073C4B697539514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924335, "uuid": "efed66b8-39b1-4183-8ba1-7d06a01bb0de", "value": "49152:bcQX7sD8Wpcp51ZG6rtwRq0YG0oqqeJFrfMtPGV:jX7sD8Wpcn1ZLmRgoqrlfM0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752924335, "uuid": "fed138c0-1c99-4a44-a107-592604648d89", "value": 3245500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752924335, "uuid": "f321d24b-79be-44d1-b9e6-743ff60c6f28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924335, "uuid": "9989b2cf-a5fd-470b-8ccc-c6f30f3b208d", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22215e7e-64ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752941104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941104, "uuid": "1ca9bdc9-5a32-42f4-b429-607161a2d852", "comment": "Malware payload", "value": "3e14cab0e598178ee0ae0d0044cec6e3", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941104, "uuid": "5ece3979-1b35-46cd-8d4d-c8608f07b86b", "comment": "Malware payload", "value": "d4961daaa5ad74ff738009724a37c620f29b77466128c6f9904e980a27e477db", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941104, "uuid": "1f68b074-d876-41c2-b6c4-c6a4d87e089e", "comment": "Malware payload", "value": "fa997cb2e83172b8244cd66c4215ede6c4d36dd4", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941104, "uuid": "70d938a6-dd6f-44d7-b951-8fa92efa68bb", "comment": "Malware payload", "value": "9e7ace6485e11ffa3acbf7fe0d3a48bacabdeec275d42e26c3bf2a992db91a66ccaa280301546bde7e269a3b7595ec7e", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941104, "uuid": "22cd44a5-b186-4f6f-ba70-35721be5b9fc", "value": "T1F83533F2AF83F23BFD878670B06705718B3F6588DBBF568207445A606E735A0D91D8A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941104, "uuid": "0709cda5-c6f8-4cca-98e8-8c732670bc1d", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941104, "uuid": "4827c327-d648-44ed-b739-9ebaf3ed82fc", "value": "24576:5zZZptTRMT58/GDluPeKeiyDU9bhaWQD7O4ZAwN6M:5Fns55OeTiyDSb0n4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752941104, "uuid": "9dced2b1-0730-4e7b-8952-964a518e9142", "value": 1072964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752941104, "uuid": "ad9ecba2-dfd0-4c3a-bda3-a174bff45477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941104, "uuid": "d6b40c4b-46af-429f-a44e-ce0745787806", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5126b0b5-64ef-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752963946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963946, "uuid": "2a79ea10-ac13-4eb0-b39d-de1beb9803e1", "comment": "Malware payload (Mirai)", "value": "27958da2d32b00deac2e252c9d291b48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963946, "uuid": "60f4588e-baa8-4575-a71a-7a24f9d9b6be", "comment": "Malware payload (Mirai)", "value": "d4a5465d40b1f03bc166e7c4e82a336490e7111181ad942b118e7de5f0aa1912", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963946, "uuid": "9de36112-5852-4959-84ab-693ea29dd007", "comment": "Malware payload (Mirai)", "value": "b6309c6b744374b59cb5d278e1130db5bacc1f23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963946, "uuid": "e8914fed-05b2-4a38-b774-f7c5b5451666", "comment": "Malware payload (Mirai)", "value": "4300ac64fe50aa489596a4519377c28d3c03ac6a7a756acc43fd82ef57ebfb191ab45abc4ab0cc14a1b9a00dcba5be63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963946, "uuid": "fd3dfc2b-6994-44df-b5a5-83510102880a", "value": "T191A32AC5F9419A26C6C156B3FB1F428D771A03A8D2FE3203DD294FA1778B85B0E3A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963946, "uuid": "d8f35833-689b-45d3-828b-bd000bbfec7d", "value": "1536:hYcca8cVp87JK5II4ZsZE1Wm2gSgaYqBc32pcOrM38k+mX9uP3vDmWG:hYc//81S0ZrYFgaYD2BcAHD9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752963946, "uuid": "18cd3265-3cfa-455e-a2e8-c7dcf874133d", "value": 101496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752963946, "uuid": "4ce8358a-4cc4-44b6-9908-b02935b769b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963946, "uuid": "e67171b4-d69a-415b-90fe-d74ba924c5f1", "value": "klogd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc8bab1-64ed-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752962998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962998, "uuid": "4a787eb9-1f6f-403b-ab1e-c10b7a94cac0", "comment": "Malware payload (Mirai)", "value": "1a1b94395255c9dafe041e5ff2d17668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962998, "uuid": "4c73bdef-96e6-413e-b050-5aa0a1709ba2", "comment": "Malware payload (Mirai)", "value": "d4d11eb4e47658f1e42be6fe2be8213a63a0e13a39f32e3d2e3cc2f1e89ec1eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962998, "uuid": "ce948fa1-bc29-45fd-a11b-0cac892edf90", "comment": "Malware payload (Mirai)", "value": "f6a8e0b3c31b918c89f1bd53352b230a2a97f7ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752962998, "uuid": "927791e1-45f9-46eb-b625-7b8890dc4610", "comment": "Malware payload (Mirai)", "value": "c5336ad59a707cda225a3488f3bc3809593d368b9177e9ba94eb39d22d837848236e45fece4361410f6378e0f69e017c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752962998, "uuid": "9210646c-60db-4f02-9daf-b41d7b579d2c", "value": "T115D32945F8515F13C6C622BBFB5E428D3B2A17E8D2EE7203D9255F21378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752962998, "uuid": "77027a87-4851-4a90-8a4d-639cfc511206", "value": "1536:p6d270stzZ8V44qn6gPeh0/CkAn9Fs4V+3/9xTrtyGLpv4U/jA21lLVwywtRR/qd:Yd2zzh4q69yCkIO4U/T9yGL268hIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752962998, "uuid": "165804da-678b-496c-b3d9-d84449a2dd9e", "value": 138528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752962998, "uuid": "c5e036ac-db6f-46bf-a007-440fdef1b39b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752962998, "uuid": "20639092-3dd1-489a-9c81-604212180d5c", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0b6de3-6467-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1752905773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905773, "uuid": "d8e6f2dc-b22d-48e9-9cdb-49ec7ac00580", "comment": "Malware payload (DCRat)", "value": "7e719d7fe147a87d5cc7890d9bb856ec", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905773, "uuid": "74118399-91e1-473c-8c3c-09d7b2c09896", "comment": "Malware payload (DCRat)", "value": "d5dc98234eaf7e743d7135ceecc775b13bb130cf34a9b75b0c4b1a3e72ac33ee", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905773, "uuid": "580edd04-5147-46ec-87de-802b38e919e7", "comment": "Malware payload (DCRat)", "value": "4100ff0e2dedf58f645bd80bcc41669abd071810", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752905773, "uuid": "cda90e56-94ef-498b-946e-836f7ffc3b07", "comment": "Malware payload (DCRat)", "value": "bcda88d23b5429f28a77d14064522affd73cd2d166936547c1f6209d6152f9b7d5c3403f89bbba9080630e93735593cf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905773, "uuid": "1a8797e6-8994-4359-af38-e4ee2e9d41d8", "value": "T1F9859C117E94CA12F0191673C2FF490447B4AC106AA6E71BBEBA377E65123937C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905773, "uuid": "e97d8b8f-bd11-4da2-9efc-1ed047a86f22", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905773, "uuid": "35c69042-f54a-4dfb-a6c7-329e6202372c", "value": "24576:U2G/nvxW3Ww0tOktv+XZNPb27Q/1gziID/2lzyxQnytW4jASQN+xH+S:UbA300u7a1e6y0ytvjAF+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752905773, "uuid": "9aaf1936-75c7-4532-a7b7-4ad4072ce41c", "value": 1711723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752905773, "uuid": "c6438e7c-7af9-41d7-ad1b-d563976eaa93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752905773, "uuid": "15c5f8eb-d570-4257-b3b9-27cd906e4eeb", "value": "7e719d7fe147a87d5cc7890d9bb856ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3162e64b-64ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752935117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935117, "uuid": "6d55b1e6-90a9-4226-9ea1-146e8f4a45f9", "comment": "Malware payload (LummaStealer)", "value": "a8db41c09f4094d533eaaa65d0b6f503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935117, "uuid": "6004969c-bfa5-41f3-9558-5e2db56b4459", "comment": "Malware payload (LummaStealer)", "value": "d773b18221c55ad3725609be461aaf280a6f79b3ef325d2d5fd50d9adba78968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935117, "uuid": "3f7e83dc-5060-479e-af49-4bda0ed43858", "comment": "Malware payload (LummaStealer)", "value": "bd172ac92ed80eb36e00d8dc5cfc45347a055de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935117, "uuid": "df2fc579-e17b-4313-900c-52a508e2fbca", "comment": "Malware payload (LummaStealer)", "value": "512a0c92e9aba7917f6fb51469bd80c999c90f21a8c00c5de4095794e04d7104af262d0299cce2dcdd5e6476a181a383", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935117, "uuid": "9925a021-3442-4e54-ba30-3b8cc96ab94d", "value": "T11555D0398691A3D6FD26407A44A175A5B432B772C1296FFF5290F3339E136C04E6EB2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935117, "uuid": "1670dd21-0238-4132-a661-5d0aa5401836", "value": "a7c4b62062a898c7859aeb5101fe98e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935117, "uuid": "f6a9898d-a3ea-4ea4-bbeb-bb2c600bfa11", "value": "24576:zwmiLMw7PbFLAlmuTkdRs72ey4zvc5Hs72ey4zvc5H:zHi4KuLkvO2X4zkZO2X4zkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752935117, "uuid": "0028deec-9861-4234-9219-6fad01395e9b", "value": 1404416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752935117, "uuid": "3fdb45d1-ba39-43f6-b154-0de6b5b33258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935117, "uuid": "45af42b2-0b81-4ca8-be0c-fec1a2e4d3b5", "value": "alex12312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bb6cb6-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752933059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933059, "uuid": "1f29e46f-1fcc-4cd3-a963-5feac1f776c2", "comment": "Malware payload (LummaStealer)", "value": "27701c7312cf270fb4d84fec669665d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933059, "uuid": "4ca2dc11-3352-477d-b4e8-6377b2bcd9f2", "comment": "Malware payload (LummaStealer)", "value": "d83e2efdc9175cdbd4ec29c0b0940185c3e3c82358a79b7c8b377e8c0646aeed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933059, "uuid": "ffe27229-fa52-49bf-ac47-18b056a11b6a", "comment": "Malware payload (LummaStealer)", "value": "e2b269cca289d874542eda22893e148477fd48c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933059, "uuid": "89b3b688-69a7-497c-91e9-57620e7f94b1", "comment": "Malware payload (LummaStealer)", "value": "663a8c0963725c94100194670576fdc5a5c15deea8587b0a86081139ec915a7133e053d2756badc01f991089cad19a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933059, "uuid": "3ab6e74e-6040-437f-911f-378f03e5d300", "value": "T1C7350106E61121E9E86741BA8852A642F5B37C368734EFDF03D8E3725F177D05E6AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933059, "uuid": "dec92498-908a-42cb-be97-90e826327cfc", "value": "3ede490b8d432fdd3ffdf674c3393047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933059, "uuid": "917e1448-48de-4ea6-9f6b-6ae3015920cb", "value": "24576:DagOdyCGcoTMukP4Euda2eKDWSeEEuda2eKDWSen:OgORP4ECeK6SVECeK6S6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933059, "uuid": "4646248f-6b6c-4d9f-a15d-776ac4ff61d1", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933059, "uuid": "ad88b605-c0c9-45c4-af38-5db63fb62d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933059, "uuid": "4c997f3b-12ed-40c1-befb-4c378f8df1ad", "value": "l8890f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23623d8-64a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752931065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931065, "uuid": "5401f907-1093-4740-9714-33d19150b2c5", "comment": "Malware payload", "value": "4857aaa8488f51f9e01f476a986b2b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931065, "uuid": "f14dde9d-6bd5-47d7-bfeb-58e7aec615db", "comment": "Malware payload", "value": "d8611bea3541c4c9fe265d91ec16f63ff6c6b326bc7dea26cc35eec29f66eec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931065, "uuid": "650980cc-ee01-43c7-b92d-1f85fc3c6e4b", "comment": "Malware payload", "value": "b346a19c1db279dceaf29d2cbd19545cc16f9a91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752931065, "uuid": "fd2e0133-eabf-496c-9f48-83cf7f3ee227", "comment": "Malware payload", "value": "f3eedf26a36b5be020f340aec2ea75b67b9bf61a528c5ce9df7f65cd4d565cbfd2ef3a8db1f249d4a03b906d3afaaa70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931065, "uuid": "7e8f86af-7713-4153-9b86-0e3d352edcf3", "value": "T17AA33C1BF69184F8C42AE474DDE6923A65B374E05270739F29982F337E25B20F70E946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931065, "uuid": "1d00e2fd-01c0-47f4-a5b4-c71ba8b184d4", "value": "0466a7436d228e0d621f60154497b6ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931065, "uuid": "4e8a45a2-6df9-4743-a6ba-d6209337c81c", "value": "1536:ae8gQoLhsS8ZoXyzhcv9XsvJNUGIRuDT/ZdiKNPBc7SYbIPLsMb:aewAhs2CzCv9XsBCIOKxBc7S4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752931065, "uuid": "8a3a03cf-bcc8-4b41-b24e-1cff60cc2772", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752931065, "uuid": "9d53dfb6-e496-4a31-83c9-e6e7221d431d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752931065, "uuid": "186a622c-bc35-4f2f-a5c2-b189cd318dfa", "value": "SecuriteInfo.com.Win64.Evo-gen.27273.15950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986b2086-64cd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752949463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949463, "uuid": "37875969-b759-4145-bed2-6d8e5afc81ec", "comment": "Malware payload", "value": "abc774f5eae08dc5113ee6012e1f37cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949463, "uuid": "96cd7d26-8f9b-4fe3-b6d1-fc6b4acd81f5", "comment": "Malware payload", "value": "d8820baf277ae265d7e23a5f96d4eaafa6632b778b34b452e7f730d24a7444d8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949463, "uuid": "5e1fac71-b2d9-4eb0-aac5-4a558af795d8", "comment": "Malware payload", "value": "29715adcbfdece32566d2b57075f6b7a2058b290", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752949463, "uuid": "c9152497-fd6e-4914-9c86-aa0766e137a6", "comment": "Malware payload", "value": "83ba10b78b3805385d7e7716043f3779379e9970576030caebb3c729b4fc1c804ef125c79bc289aacb179160782d863f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949463, "uuid": "f726d195-66b0-4823-92e3-9307b43b3f52", "value": "T1823164C94EA6D007887C8F32F04A87B85A9E86D775A0AE6960CD4CF3514DF14743AE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949463, "uuid": "b387db6d-846c-4add-be61-38f4702ece45", "value": "24:kd6ENEEdeEdYV2flEdxEdejG7EdeABAoA1Ed6unuaujEd6uQ9uQkuQ1Ed6u5uQuc:kdcEdeEdYV2flEdxEdejG7EdeCXaEdvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752949463, "uuid": "4a6740a6-f119-49e8-ac1c-987c36e3b0c3", "value": 1505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752949463, "uuid": "7fe4b3c5-39fd-4de3-9056-d9a9283e7627", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752949463, "uuid": "5aeb41d2-9b55-4cc1-8f5e-1b69737581f8", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a491a0a8-649b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752928009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928009, "uuid": "f2322ecd-8c65-4f4c-9d34-7eaab33a8553", "comment": "Malware payload (Mirai)", "value": "b7ece90a7375e47245e4d2b10e45eaee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928009, "uuid": "dd82cf14-ec36-4ddc-bda4-854d4fd3ef3a", "comment": "Malware payload (Mirai)", "value": "d98f7aaa9e2aa30f86d5f7c88bc2e895bee6adeebc6d87a904bd28e6f9e01810", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928009, "uuid": "16db5b58-2cd6-4ba4-bd5c-18299f74b68b", "comment": "Malware payload (Mirai)", "value": "97464ee344f200aa3c3e7a11361f0c1aa4d1537d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928009, "uuid": "7f880390-1f01-44fd-9d18-c8549a761d3a", "comment": "Malware payload (Mirai)", "value": "84e03b7ef5f417c4d93176b80c959fce76a71995201e5967571fbfd21314495c5448d8b551a235cfc45e02bd5516b7a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928009, "uuid": "9dc65245-52aa-4b4c-bda9-8d58bc713b83", "value": "T1CC044903B8C084FDC899C4744BDFA576D872F46D5238B55F2788AF226E4DE302B6E690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928009, "uuid": "7e3978c9-a9e4-42c3-a3a2-307097c30feb", "value": "3072:RGm8wopFuMyScHfyuaqjxS0GLwb1m1o6eEuWUOxynVw6CkR6n:RYwoTySc/njx433xRhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752928009, "uuid": "534c9fc8-dff2-4c06-aff5-304ffcc45a8e", "value": 177384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752928009, "uuid": "c50c17bb-0b7d-4c99-a55e-1438dbff32ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928009, "uuid": "4e9b1509-d6db-4508-9385-2959521d8b3e", "value": "top1miku.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad43bd8-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907618, "uuid": "df666cd8-41bb-452e-afa0-c74785f595e5", "comment": "Malware payload (Mirai)", "value": "179ddfaced7d5ab938a726a2af3d6ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907618, "uuid": "cea37810-434f-4b60-8403-a71f14275c51", "comment": "Malware payload (Mirai)", "value": "da0a744b77b90bf81b3e57c1769b97f7d68e36c7f19b04de32bd73605f4d98f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907618, "uuid": "0f572c65-7f81-49e9-be3a-6b675178ce04", "comment": "Malware payload (Mirai)", "value": "e108bd44f3faba86c2728eaa6dbf62c70ecf979c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907618, "uuid": "c5f9c10c-45db-4bbc-b8b0-5f1d8ade919e", "comment": "Malware payload (Mirai)", "value": "c251a3ea9e5f74d029c091f7efcc652fc7e285519a2db6213d2a46a038de53a6d46319632cde244f68a59d2b26ed7c80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907618, "uuid": "a9f508e7-3c75-4f69-b5cd-f1d285517045", "value": "T13C438C53C9251E58C58D9AF0B430CF386BA3956081A75FBA2676C3789443E8CF61E7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907618, "uuid": "4611754c-f7d1-4583-a12d-9e3400c446a0", "value": "768:HajUPvSosUu7C+dkKuwGNja0jSoIIcXCJc31lfougAOtiKqAUNm3IG:HajUPvSoM7cKuwGcydICJXugIKqAUwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907618, "uuid": "e0ef9df4-e151-4da2-ab98-9e077b3361af", "value": 56496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907618, "uuid": "2ce0c82f-d4bb-4202-a415-cee1bc867660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907618, "uuid": "7202010b-bb41-4245-bf5b-d1a2758056bd", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60787ae6-6472-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MooBot)", "timestamp": 1752910285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752910285, "uuid": "5714f21d-923d-47bd-a82c-9d1d04e86870", "comment": "Malware payload (MooBot)", "value": "f37bff3c0c20b301dc709ad74094682a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752910285, "uuid": "237acef1-390b-47fc-96c8-de90e4f6efbf", "comment": "Malware payload (MooBot)", "value": "da67937c2efde4f8f0e7de6cfd911444c811524fa938355d90193380c2ccec80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752910285, "uuid": "1276cc8f-9c38-47f3-9c9f-f0a12fa74d65", "comment": "Malware payload (MooBot)", "value": "2ee81d792308471e11c9ccc2242c7b3c77b89146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752910285, "uuid": "fd0a319f-7738-4d94-b42d-bd8a78215697", "comment": "Malware payload (MooBot)", "value": "040d0f48399cb8aa7fdccf60a84901d783ee91e55ebf74657cd7fcc61a9c59e18e3450c11d325eb9d6943c632312c6a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752910285, "uuid": "8cf9d029-bc87-42ed-a50d-0db21e09d9e3", "value": "T163433A02B31C0E57C0A35970263F5BD097BEA6E022E4F685351F9B969A72E371486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752910285, "uuid": "a590371d-1136-4119-89ea-16ab9a59cbc4", "value": "768:JfsrmjuyuRP4R1I0mQC/N4IIcBKepcC9NEoU9KmdL5CjvYwgKK0FRxtrSEwnjII:VsIuy80cI0KeacmPKQ5eYwgdIx5Ynjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752910285, "uuid": "6ba851a3-99b9-448b-97de-f4110c58ef4a", "value": 56384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752910285, "uuid": "6c93e9b8-230f-416f-ad63-d66e064303c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752910285, "uuid": "721e2d82-92c8-4c7f-b41b-9ab4e86e4bc3", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48f31d7-6495-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752925539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925539, "uuid": "fbb9cd42-d515-4ec5-bb42-59ebb0cfc430", "comment": "Malware payload (Mirai)", "value": "8627b338d919ccadc0e6ab4064d2e52a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925539, "uuid": "55d82895-7490-4a0a-8d2e-b75fb4bf556d", "comment": "Malware payload (Mirai)", "value": "db3ea4dbd78af5a8b0b3de3df34939e1708d0b9f8b3f608ad70a5ba247cc1666", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925539, "uuid": "9577ec10-b664-4199-a01c-123a3485f436", "comment": "Malware payload (Mirai)", "value": "689dc6b43c8a0e4eb4db4dfee7dcfc9d951ab921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752925539, "uuid": "564bf1bf-5ebd-4ce1-93af-c4822cd0837e", "comment": "Malware payload (Mirai)", "value": "8339decb2ade6136169697961cf14ceed2d591fcd845009738bfe8dd7c48d216182b90f17a97500f78f166ce340f4d44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925539, "uuid": "3d53bc5d-ce9b-41e7-a781-a49e6239adbd", "value": "T172A58C47E74878BEF246773784574A0F24087F12C0815F2292B5F0AD9F6B5AA1F396CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925539, "uuid": "882a6d49-c74e-434b-a2bd-197ac2c2e0bd", "value": "49152:mQvb/J4RMRGG95qDelq7d7HTeNdInZbnrB7C7:zvEUiKihIInBB70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752925539, "uuid": "a61d5faa-34d9-4de1-8103-d87c6fec4e52", "value": 2066560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752925539, "uuid": "f22eea7c-4d8c-4d23-b1f4-9f0918dd968d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752925539, "uuid": "6a3e5f40-d4cd-4545-8c0b-cacc53c5a2e7", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1345f6a-64ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1752934929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934929, "uuid": "07498acc-3dd8-45af-add7-b2524272dcc9", "comment": "Malware payload (AsyncRAT)", "value": "cad9939b6a478e8f7d1f829e1642c817", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934929, "uuid": "bb625aef-641f-4a6e-b090-ffc293936241", "comment": "Malware payload (AsyncRAT)", "value": "dcc5e50b7931f67538ba5a423ec6366db60c0ef297f7d93fd5bbeeb0542cc87c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934929, "uuid": "f3454475-886e-4e4a-b82c-779420e3b9f0", "comment": "Malware payload (AsyncRAT)", "value": "2c6da490f5408b30adc91b9e2015536c8d595476", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934929, "uuid": "fa3ef0bb-5535-4227-bb04-37ca667cc3ee", "comment": "Malware payload (AsyncRAT)", "value": "677c18482a58edc08ea6d9cf4bd14ca2654a936c40a58999dc7cbaa25f6391fe391fdd487bb608f18e5cee12814673c7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934929, "uuid": "4301ea96-21c8-4379-a632-9dc84f89dd86", "value": "T15DE4BCCEBE191FB0989231B81A29F0A37F74D7C1AF125FBE5C1FC28B55928D5920161B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934929, "uuid": "3abb2341-7c40-49dd-830e-624f61504c3f", "value": "6144:kt3kM9YbI1Gabm48QqJ+n6/v1MHGldkQjg2zIt3kM9YbI1Gabm48QqJ+n6/v1MH0:43kGYFt48BtLleu43kGYFt48BtLleU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752934929, "uuid": "7924e117-995d-4e56-8209-39b05c3693fc", "value": 704862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752934929, "uuid": "bd1a19f0-c5a4-4d3a-9d00-64d297b24b43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934929, "uuid": "340288fd-35e5-4921-ab02-46e4c24fd208", "value": "SecurityHealthSystray.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b092a210-64ee-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752963677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963677, "uuid": "3216b40f-e9f6-4bab-af03-ad92bf5eacc7", "comment": "Malware payload", "value": "572fe515ccb3a0068bc641725f8e3ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963677, "uuid": "564abda9-dcae-4163-a981-922698ee0518", "comment": "Malware payload", "value": "dd4c4ee21009701b4a29b9f25634f3eb0f3b7f4cc1f00b98fc55d784815ef35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963677, "uuid": "8af7d792-880e-43c9-bca8-6a5dee14dea8", "comment": "Malware payload", "value": "9f5d1dbb2cd31b2af97e14b8781ea035a4869194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752963677, "uuid": "e6dbba49-aa15-4f16-8612-c0dbcd032cf8", "comment": "Malware payload", "value": "cd1ec79bc7f81d8321b5e26d84013e3b4654173a311595a65f09cd10c279bb21ecd63202770aaca46bc6136216deb986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SupplyChain", "colour": "#CFDFCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963677, "uuid": "98e37bd1-0e5e-4b3b-b3a7-0006f74c2d6c", "value": "T13A45284697BD11E9C1BAC03886035327FA71785D4330B7EB57E48B962B23BE5A63E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963677, "uuid": "082333f7-7048-4dad-a293-0fe4c3c2dca6", "value": "fe68c0c139cb5780368428461fbbc4da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963677, "uuid": "af00da57-5bbf-4032-9a45-6507ddccc46f", "value": "24576:goVNeWvQG2zjXfyR5QTGvFyDt3SDvOLOt/P/WSCFzVTcvPOkVy3Kw:goVNeWvZ2zjXfyYGvE9SDvOLs/P/WSCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752963677, "uuid": "9c2aa1e4-3a3e-4e64-ba23-e8323d43e08b", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752963677, "uuid": "cf1a6a80-0074-4723-9929-6ac7babfa0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752963677, "uuid": "e3849ad8-c24b-4046-85af-9a83c8c43bc8", "value": "dd4c4ee21009701b4a29b9f25634f3eb0f3b7f4cc1f00b98fc55d784815ef35b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c8baa2-6474-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AmosStealer)", "timestamp": 1752911066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752911066, "uuid": "9de75792-ed7c-4fd2-8010-71f562268855", "comment": "Malware payload (AmosStealer)", "value": "ad5cffd4b2e6d7f288cd04f0bc1b2f5e", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752911066, "uuid": "c1051415-6c86-42c5-afc2-0648d026a624", "comment": "Malware payload (AmosStealer)", "value": "ddfe3bd14685967a31dc1c9b2fabd68c3df6d9294a5eb7324d02b258507b97ae", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752911066, "uuid": "ae871a0c-cff4-458d-87fd-1439a76203f5", "comment": "Malware payload (AmosStealer)", "value": "bf87b65fed304a88a1a94e80eeea1f874fe73897", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752911066, "uuid": "09ddd0c5-4998-4c3d-92cb-4ce7eea702b9", "comment": "Malware payload (AmosStealer)", "value": "b909e3febe64d64d3bf75e4e2c3d63a686fd6626b5bb27a69eca5de71e8963a21a284dc1da0b6f8ae2ce4042d47bf781", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752911066, "uuid": "ffc4bc43-3ac3-4101-aa7d-5c6b70673edd", "value": "T1F2751241772C0FABE5573B35A5D22312E8D9F03B2FA09B9B1A120378AE357809E45F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752911066, "uuid": "b32aec90-f7a0-4097-91e2-2df0cde9d3ac", "value": "12288:p+M71SJhlfklHBHvQe+BMBgwLpLK4Q71SJhlfklHBHvQe+BMBgwLpLKAE:p+M71mhlMlZgKWj71mhlMlZgKWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752911066, "uuid": "aa35120c-3c91-4b96-9920-e049dcc634b4", "value": 1648360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752911066, "uuid": "dc6f2c7f-376a-4a33-a925-6b9d1b8cb399", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752911066, "uuid": "06ad14d9-1a06-4a3a-acaa-99437a3f3e5b", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913bb484-64f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752967919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967919, "uuid": "93c7e4e8-9288-4120-a55b-d82155f4a99c", "comment": "Malware payload (Mirai)", "value": "4e7fe4c9c545b4023d83123866f265ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967919, "uuid": "c3604137-2a0d-4f53-945e-fa56040a658a", "comment": "Malware payload (Mirai)", "value": "de2be93c32341b6005d946d43f8ab4019a66399eee6e7f42cf845b6cb61ec7e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967919, "uuid": "5ecfb7e7-28d5-4d68-bc55-0810cd0c5550", "comment": "Malware payload (Mirai)", "value": "4e6661786c42be4cedb7b8ee9e60dfa9e9640d84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967919, "uuid": "4c82ddb0-22a0-4eba-9570-ec2ce7126766", "comment": "Malware payload (Mirai)", "value": "c68a578a097d4112fdd1c9a90aa51e668602bbd5429fafd809c2dde24de8b7509d44f6f8acb39b91733b64f562bb4619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967919, "uuid": "16e95781-1fb9-4878-97ad-1556fa4a4ab5", "value": "T15AE31A46FC819B12D5D111BEFE0D128E37131BB8E2DE72029D246B75778A87B0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967919, "uuid": "927c4819-2f6a-4d85-887d-34e5a0225229", "value": "3072:HKMMdiVWaUsN6HTXrNysBWa8+blKthBj2IYz3OBD:HjX3ITXxysQaDblKt/cz3OBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752967919, "uuid": "071a740e-4c6e-4ba6-9ee5-8a58c8a95cc1", "value": 150364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752967919, "uuid": "deea94d6-d52b-4f92-ad36-043e7a98cfa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967919, "uuid": "2f3bac79-50c5-4e6d-868c-31d601cc27d8", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b55adf6-6493-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752924504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924504, "uuid": "c4bc2f37-1f8e-42d9-b8cf-883ab8e4459e", "comment": "Malware payload (Mirai)", "value": "cb5e483e8c270dad060ff0f2a201c6f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924504, "uuid": "c994898e-1743-48c6-8c86-61de1f9a4a59", "comment": "Malware payload (Mirai)", "value": "de5961922467e9b023a48e56fa3df60e136c84e01a1d73aa34c20015804ba173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924504, "uuid": "b35ce7a1-b4ad-4cdc-9316-1abbda6647a1", "comment": "Malware payload (Mirai)", "value": "a3b83c3a34cbdd7f5ae77da40c592319341c0927", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924504, "uuid": "c88df494-b475-49f4-ae60-6cbb422f28b8", "comment": "Malware payload (Mirai)", "value": "4b858fa424447346bf0e915a20c3362e5a72d95225766edf4869b52504a0d9c6ee35c3815bd70892552a3d41b337dbf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924504, "uuid": "1bb92447-bd9e-4135-ba6a-8ce1a36d709c", "value": "T139932B5AFD818B21D9C502BAFA1E118E3313177CD2EE73129D186F20778B96B0E7B845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924504, "uuid": "3f0b7953-e031-4832-83a5-8955382c34aa", "value": "1536:n/nWDc4DHszZ7HV5KZ7hqq7Kh5vLZaUs0SQV+UXiLyODFCu7IxBY1F81:ODc4DC15Kmq+hVLZaUOyODFCumBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752924504, "uuid": "119fce5d-1a85-43bc-967f-cfe4ca02d9e9", "value": 92176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752924504, "uuid": "beb3ca61-fcd3-4a39-a329-f1753db87fe7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924504, "uuid": "63bd6f9e-bcfb-453c-b616-bf0c0cb7b4ac", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1535b4-646f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1752909013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909013, "uuid": "2dd87f2e-a6b0-4d9a-abe1-f16976715752", "comment": "Malware payload (LummaStealer)", "value": "12348731c0abdf0b91d28fa2a008b15b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909013, "uuid": "34475655-becd-4e2d-b79b-b14d7de45b08", "comment": "Malware payload (LummaStealer)", "value": "de81f8bd5ba9c10fd6886e5fde35e71b1b510fee55cb24bc09142665d7326b6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909013, "uuid": "1de007fb-f8ba-44f3-a6fa-dace4aa4cb42", "comment": "Malware payload (LummaStealer)", "value": "705177cb53c9fbfb27b68fa3bd8e09d6429d3f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909013, "uuid": "4121a178-6954-4d03-9f9a-2ca570521089", "comment": "Malware payload (LummaStealer)", "value": "33062b974939159077d21fe84929ca9a8a5dd7045827b114c9a2c470852ca336bd759c84959c026b377c781abef376a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909013, "uuid": "a58eff05-eff1-48f4-bee0-d51b293ddefa", "value": "T1B88501737B0646D7D08DCEB525EE73A4F76CC0896A48131777998222ED821CDADCCAC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909013, "uuid": "51da5331-d051-44a8-919f-094131a89a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909013, "uuid": "ff2abe5a-c60c-4c61-9d39-1deb078989a3", "value": "49152:JF0ez7yrwVhhtqhZx7Kalog9g3Wh9Ugze:Jqsu6hip7/1KK9Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909013, "uuid": "70f70691-66a3-4f8c-844e-50138e3c7b88", "value": 1721856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909013, "uuid": "62ee9b41-31c1-4232-a200-728394b6e471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909013, "uuid": "978af934-28af-4d32-bfef-d3c0095eb954", "value": "12348731c0abdf0b91d28fa2a008b15b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba61058b-649c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752928475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928475, "uuid": "4e88e0d0-1523-4bd2-a1e0-d28a83ba6ac3", "comment": "Malware payload (Mirai)", "value": "59f8734cabcb0a021947ce120b121889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928475, "uuid": "e5182c5c-f00c-4087-acf9-ff1e2b8cd0cb", "comment": "Malware payload (Mirai)", "value": "dfb19a5c962ceedd185ebe83c688189f666e7e62f4a07c36242a44d8bb8f42c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928475, "uuid": "1d22f8d3-e930-4d62-a2e1-54c54f95fd88", "comment": "Malware payload (Mirai)", "value": "22b470a5fb657c96db3ee96d1cc6ca34f750c3f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752928475, "uuid": "9cdf67c8-610f-405f-8c35-c0d84c35d285", "comment": "Malware payload (Mirai)", "value": "338df63f48acb46f5a6db4a66bb6e21ace0e7b7db01ab49abd1b76ea9a2b6e4b9792f1d3cf5203080d6110a6633001ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928475, "uuid": "91ea4c75-f9fb-4b1e-86ff-0dee8d4b8e87", "value": "T164933AD7F400DDBDF80EDB7B44530A06B531E3A20A835F7A625B7927AD361984933E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928475, "uuid": "e50cd68c-fb27-49f6-9edc-349f3910d499", "value": "1536:AkXKpiKcwTHHJ3VAm96J39RoP128D0yJZWyKN8Nk4urDTbhl/TVcdNp81x:sTnJ3p6JtRoP19Hw8S4snTVcd4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752928475, "uuid": "1e5c8c97-9a0a-4748-92f4-bee61230618f", "value": 90588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752928475, "uuid": "e9439983-fee4-4b45-9d5d-d27154838343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752928475, "uuid": "0480eaad-651c-4bd5-b237-6bb5767fbab5", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a812de-64ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752941412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941412, "uuid": "5d56173b-d6b4-4d11-aca3-fd597eb2164e", "comment": "Malware payload", "value": "93c6177dc216dce5e8a21f5abf877b6b", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941412, "uuid": "ee600a66-b03b-4e90-912a-cbc1531161f8", "comment": "Malware payload", "value": "e0a7d335923c17e8aa3a9d2a2470eab4c0c702fee4bc7ac68b8132ea3a8e9be7", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941412, "uuid": "bc1d2c0b-d207-481b-896a-08540e4b1660", "comment": "Malware payload", "value": "0915f614bf620c0ef9852f6a6b62f2d466f9eead", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752941412, "uuid": "87aabf03-1d33-42f8-9e51-f661b58e0d17", "comment": "Malware payload", "value": "d3f3da8dd16f583845f104199eccde8a6ddc41d9fe3ef303bcdcf07a16f34717f14af4d9621ab3d40dbbf065385211bf", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941412, "uuid": "734256b1-dfd0-4e82-978c-9b07d7c4ce44", "value": "T146352386F5B9EA37DCF21A317CB57F422BA55F369EA6CA833305045837A101414AFBC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941412, "uuid": "0c2e25ab-4311-4f31-9bde-571baddd5a7d", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941412, "uuid": "459fd8eb-0d42-421b-8402-34e10210e016", "value": "24576:9zZ0j7RKJP/arpa3tgwHWr8EHckyLYPW7hbKjWRZ2DBDHLx:9qenmEeaWXHQAW2DBDHLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752941412, "uuid": "5d2e138b-7aa3-4e11-b02d-0530735ccce4", "value": 1083370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752941412, "uuid": "059a3204-f95f-48b2-b240-26054b830f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752941412, "uuid": "ca2c026f-a5cc-4c3c-b6ce-7cfb0b87d1e4", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0576877-6489-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920378, "uuid": "6817cf44-68e8-4c95-b52b-c71451f878b9", "comment": "Malware payload (Mirai)", "value": "57e1b44064f677a8bba73b0da265582c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920378, "uuid": "2a8f22f7-422a-4344-a5c3-c54b63fbca40", "comment": "Malware payload (Mirai)", "value": "e3259fa0a7173abcff75f95bf51d1aa00b3923017c32985002bc4ef2192753da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920378, "uuid": "c8af6a8c-7391-47a9-bdff-a5f87b095ebd", "comment": "Malware payload (Mirai)", "value": "d755643745e15851ea3f42096c915a6a89e936c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920378, "uuid": "1fffa9cc-a6ab-4fd1-8ed2-2fad9b298ce3", "comment": "Malware payload (Mirai)", "value": "7075d5574bbfe2168a6ecb3b260d28870708cce1ffbfe19ce0260b756829f4bb1b62f8d8f5b48734ffe980235b560076", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920378, "uuid": "7bf30e1d-d276-4e5f-a63c-c307a669446b", "value": "T159D35B17B5C180FDC4D6C1744F9AF63BDD36B1AD1238B16B27C8AA262E4EE205F1DA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920378, "uuid": "4c9eef05-a091-4211-a60a-256880116d97", "value": "3072:JipdYUqoGTXkmfyWv1L3eOdoaIw+BVgQy7t5JrOZlgg9:JipdYVoGTUmfyEi1Mh8n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920378, "uuid": "d522ac3c-bfcf-4e63-bf6f-4613787eaa5e", "value": 141016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920378, "uuid": "e0868f91-0783-48b4-aa8f-e93c4390a5f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920378, "uuid": "9418c139-c668-4849-b57a-88743301a3a5", "value": "iotmirai_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2519403-6489-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920381, "uuid": "474d3a90-7f16-48f6-b36f-79d05d5e4e33", "comment": "Malware payload (Mirai)", "value": "8d21345f5badc6628af79772e834335e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920381, "uuid": "cd8b1486-47fb-492a-83e5-8aadd7e97fcf", "comment": "Malware payload (Mirai)", "value": "e35c526ee7d7c7a14fc0b9f1aa972a721064091ff0b3cd75c7ef9ea085f38587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920381, "uuid": "d41a7d0e-3bf5-43f1-8f3e-a90b95a0b2ae", "comment": "Malware payload (Mirai)", "value": "a44282f9f37b8b0e34e7f487232d4bb561436a68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920381, "uuid": "b0f02cc7-e1b8-4da4-a655-1635515d5b53", "comment": "Malware payload (Mirai)", "value": "0bdcdd49f40d54bf520c41176a6bef4a0391bf8dbe465bf031237b9e3340328ac8a37ca2f630a6255077dc3edc617109", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920381, "uuid": "ae231921-3725-48c9-a46b-0bee9e64b8f7", "value": "T186D32A06B30C0A47D2632EB43A3F67E193EF9AC121E4F640355F9B8A95B1D361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920381, "uuid": "660e76b2-37ca-481d-aa61-0a85210549bb", "value": "1536:vTGneAoNCHVNtA4cnrHxfytZtevjX/+5wyAlHHJvAhhi/rB+eNsqbWahu1xq:aeVC5cnrHxat+uwplGhwph24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920381, "uuid": "80de4e7a-8ae1-450e-ae41-71897000d978", "value": 134100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920381, "uuid": "73f8b9cb-cc69-46eb-b520-1839745810c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920381, "uuid": "bcd97532-2214-46ec-9c00-b4b519481475", "value": "iotmirai_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b64c06-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CryptoWall)", "timestamp": 1752933299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933299, "uuid": "c57575df-230f-4f14-892c-0958e5a7e694", "comment": "Malware payload (CryptoWall)", "value": "9937605ed7b1019ad7786920d81d15ac", "object_relation": "md5", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933299, "uuid": "9b2b590c-26e7-496f-841c-14e9da3cb8c2", "comment": "Malware payload (CryptoWall)", "value": "e36ef17346e9d7ec9350a66a352cbdadb8e97e8e592ffbdb0e352fcba2f49f1d", "object_relation": "sha256", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933299, "uuid": "8ef75ce3-58d5-4bdd-8227-e00ce4b65e4f", "comment": "Malware payload (CryptoWall)", "value": "fb77fdfe1c9e3ccf635718101a341cab97f88cce", "object_relation": "sha1", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933299, "uuid": "ad0044b1-77cf-4fb3-861e-3152dba86e4a", "comment": "Malware payload (CryptoWall)", "value": "4c46f32c167626ef116b6e89f2859ec74e6996de9776c322e257c8e27630b8abbec0b13d5458851ad53895f8db06ad16", "object_relation": "sha3-384", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933299, "uuid": "d0bc15c7-6449-4cde-a3db-509a55e279da", "value": "T16623262929EA201DB1B3EF507EE438D9DDCFBA737925546B1085070B4B12E44EE9273E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933299, "uuid": "b355774c-cf4a-4718-827e-6435263fcced", "value": "768:pckK8vwMw7RcJHVvfJfeCVTGyUu0smy7gNKsNC6rmPPkLn/LLd4fgWHmLxbA+3cZ:ehDMwdYF/oNbAGtFHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933299, "uuid": "f38f9690-eab8-49a3-8ecf-561289d147af", "value": 48045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933299, "uuid": "62b48228-da3c-43c9-adef-c3632a93358d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933299, "uuid": "8b7a6368-7bc4-4afe-bf5f-177d3f2f4697", "value": "Project_Workshop_7th_Minutes.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc3c0de-64c6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752946546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946546, "uuid": "29acb8b4-3203-4f2e-9bab-93266005c230", "comment": "Malware payload (Mirai)", "value": "e01639e0ee8a93c7d162124ef351b4b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946546, "uuid": "a05fa2da-7ee8-483a-ba5c-17028cc3625b", "comment": "Malware payload (Mirai)", "value": "e3f47a2a9acb41e013e43281aa7fc0de8da868a1e4c1cb9cc5c80e0b00491f7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946546, "uuid": "ba9aae84-a87a-4105-aac8-f5bc7b594942", "comment": "Malware payload (Mirai)", "value": "af3d26254481c6fad08ccb88624bd1b5d3e381ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946546, "uuid": "ff9c9cb4-a9d6-48c4-8dca-42e920441fdf", "comment": "Malware payload (Mirai)", "value": "00b89604adc6eafa81dc9f94ceb2a4da3e8a1f8bd3b9af3c0d433211126057cd3254a5df615602f16d7ff4f34f21bf81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946546, "uuid": "1e593f9e-1a60-4bc2-9ec2-738227e50ad5", "value": "T175133A95BDC15A02C6C01176FB1E4288772743A8E2FE3303EE29AF6177479670F7AA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946546, "uuid": "dc0ae921-f20d-4ce7-a42d-3cad7ceffe56", "value": "768:qhzqw6xo3JI8PqJsXxZK4kM8ZEwaGgXOgDdqFVdarpJU6jsF13njOeI:o/6xOPqqP8ZDgXOgJudaNJU6gFR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946546, "uuid": "b4c470b6-aa9f-432b-9332-2c2ea0bdfe7a", "value": 44820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946546, "uuid": "16290163-c447-44aa-8f0d-78dc8803d005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946546, "uuid": "17e14ed9-4af9-43e9-8124-703698e5bd88", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33b947e-64c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752946904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946904, "uuid": "0049b86f-de08-4bf4-a4ee-68ac9f4fbc14", "comment": "Malware payload", "value": "778cea7f253606adafe8e2c4e8666b59", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946904, "uuid": "4d7e16a6-7951-4d89-983e-ea1ffcc0d487", "comment": "Malware payload", "value": "e40d671c6b92e4dda4c444d6e650e1dfa6d2f2bd7e0bdebb10e27b3a224c7de3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946904, "uuid": "0df7becf-617f-4fee-a645-e278d80d7738", "comment": "Malware payload", "value": "d8745257ac308475d2411d5ac0b86eef32f09114", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752946904, "uuid": "2f646221-f528-445e-8354-f60192dc68fe", "comment": "Malware payload", "value": "4224d6aafdc08f73025cca298489f9e23bca4a647fc74e4d00400e19a4ac560a46bfc63cb53dff281393a6e786555b0d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946904, "uuid": "88c02f86-63be-4624-a4a4-b9137193c6f0", "value": "T13C51958408D381B66CB5CF33F6AA8268B59E90C779C19EB644FD7CF1444DE04689A9D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946904, "uuid": "1a1209bf-fd43-47b6-a7a4-00709b9b7735", "value": "48:W1dydZ1dAd71dYudY3dw1dFdB1deMdexs1deRdeUf1dvcvdvg01dvBdvpP1dvqd8:Wr2Zrk7rv9rbBre4exsre/eUfrvcVvgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752946904, "uuid": "57259961-0a15-4cf5-b228-e5cd5207991d", "value": 2882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752946904, "uuid": "d27d40f0-142d-4691-877f-cd7acfd1bdd8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752946904, "uuid": "f40493bf-e792-45a1-8fe9-18bea192058e", "value": "toto.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fed203-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933118, "uuid": "2e8fcb1a-64a4-4704-8790-66e2e75ad644", "comment": "Malware payload", "value": "2b590cf1bdb3c71e0c076e32e97814a7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933118, "uuid": "ebe4b6ed-9923-423f-a0e9-f58f973cb467", "comment": "Malware payload", "value": "e5b384fcdedc837e8ecd1a06964e0c142ba2a7943eda20d6098ee618420dc230", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933118, "uuid": "9be9ae28-3367-49cc-aca7-60be7a3cc9d0", "comment": "Malware payload", "value": "f7664903d0ee020065a79113d0e3d81a4f58b4f6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933118, "uuid": "ad6aaeb8-f41c-455b-8f0d-5f16d7728735", "comment": "Malware payload", "value": "af6b84e57cc433ab16dee671e64b73722338059199df08c3e426ba21f6baf576222cd303221cdb2c1a68c693feed6866", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933118, "uuid": "e09bf103-6aa8-4c87-aa5d-9458bea26126", "value": "T1D5B527C0E7938852EE6E7237050A7763B0F1197237FEE57165F62B291BE9100872D2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933118, "uuid": "8fb544e6-22a5-4287-bcf3-bf7207f9f471", "value": "24576:344IPuHGXF8VojEnONjnPLq7JqEpHIAIQGqoq8o04fcaEY:ocmXF9O63q7JqESomL4TEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933118, "uuid": "6e17b983-6131-4f64-96f5-d53c83152486", "value": 2297344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933118, "uuid": "cb11c045-2234-49f3-8328-7312e7be739f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933118, "uuid": "c01d5c62-c27a-4947-83e0-2e60f5dab055", "value": "Mon3im_resume.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee12978-64ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752935113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935113, "uuid": "75663ab7-7b7d-4544-8caf-e04dee945926", "comment": "Malware payload", "value": "ae1dc7e0f63cdd0ffa7301aae67e68df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935113, "uuid": "5097456c-1d6d-416f-9360-20c5621cc99a", "comment": "Malware payload", "value": "e668dd0d6b4714296c8c3920104a1cb9901e2364609614d3fcf212e0b7d7edda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935113, "uuid": "135713fa-ef7d-4554-8da9-1b49c5a6db09", "comment": "Malware payload", "value": "aa52414f0dddf7d8bdc776e7e473b77c258ec29b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935113, "uuid": "5601b5bd-2987-4d8f-aac3-d0bd409ac549", "comment": "Malware payload", "value": "16ea1e10f26b0d07f2a08cfe2d1bc978082917c94f7cd56456fa17f3ced70163d5560bfe22016682e57e92d86c149737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935113, "uuid": "abfc983c-5d40-4246-9baa-02557c6e56a4", "value": "T196D4926C29F88627D064E7B5CFE18837B698D5E732506D3659C383A54302AA63CC773E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935113, "uuid": "cb8819c6-4347-4c40-bc70-72fe96e6c715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935113, "uuid": "1db3a767-4ae9-42b3-b07b-159f43e52bd1", "value": "12288:5Ep5QQZYPs9rWeyowW5tsru726TCTaeEPSLlOlzgvNOtL8LQ8zSfFDUpc:knlym1C62eXPAGzgl4L80mSfN4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752935113, "uuid": "6c23834d-7ac8-40f3-b522-81a7aef0984c", "value": 621368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752935113, "uuid": "a2ff67d2-3165-4a27-b2e5-d623bf04db41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935113, "uuid": "270d1691-34d2-409f-b515-7aadfbb3392c", "value": "FypNDh8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8f7174-646f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752908935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908935, "uuid": "504f9f2b-dfd9-4cf4-a54d-67465a796485", "comment": "Malware payload", "value": "08dc00309236753282db55131b6136b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908935, "uuid": "838dccb9-79ca-4c93-9226-df0edddf262d", "comment": "Malware payload", "value": "e696e297e4e480c8f272e37b467e3912a4a9d3126f1806b410421d1b0b140b6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908935, "uuid": "30ad73f3-5c4d-477a-8b1c-8be866bd2779", "comment": "Malware payload", "value": "92bb8678717769f6def86cbf00bd234a376fc042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908935, "uuid": "e3eafa70-fa0d-4282-b797-6ecfdbc05b8e", "comment": "Malware payload", "value": "018aa5d61ecda56f4e985dce32cb6b9827c5b753984a7ba90f5711ccf2b4e0542e5db054b6ba55a1ed957bbb3265c8ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908935, "uuid": "09046bde-196f-4265-b85d-3895edc1062d", "value": "T1A9257D0973A4419DFEABE1B7CA13C607D7B178460277862F01A49B766F337716A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908935, "uuid": "32e1c547-b27d-4ffe-ab67-b631979c93c2", "value": "fadc5a257419d2541a6b13dfb5e311e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908935, "uuid": "98771dde-7f0d-4208-aa49-ff9b4864d44a", "value": "24576:trORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvau3:t2EYTb8atv1orq+pEiSDTj1VyvBau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752908935, "uuid": "8a719fba-4ac5-4816-b13d-40645b8e615c", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752908935, "uuid": "af6ec3fb-b84b-4cb1-b45c-b3fad40d0a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908935, "uuid": "28d715da-7934-4da4-adf6-e8ee099340f2", "value": "08dc00309236753282db55131b6136b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76ee63a-64ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1752934885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934885, "uuid": "0f020f41-6501-47b0-abac-b174e16dc12f", "comment": "Malware payload (XWorm)", "value": "dac059caef320af74c391a6be8f72bf2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934885, "uuid": "dcce90a4-0ce2-4d26-b93c-b8305deb880c", "comment": "Malware payload (XWorm)", "value": "e79f730515a8e756937132c590028a8030f6f0d93ce3240dab7d59c2ce2e36f5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934885, "uuid": "01612c3f-2706-4a2f-a134-69acde1840f0", "comment": "Malware payload (XWorm)", "value": "52ceec41111a8bbaeab328338bae0802d7382b2f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752934885, "uuid": "b816a088-1d57-4ef9-8651-b81969f34d22", "comment": "Malware payload (XWorm)", "value": "c68aa5567212c59924e69fa3f5f824816933300b194e7b232ccb29db6da499b2ded4495672016ea592bc6c9ae05620cc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934885, "uuid": "a2795901-5862-4333-8cae-23d181059c2b", "value": "T1FE24083CCC60AEC8536BB0C6396D7B4142C84763E6B01FDCE5D24866F96869EBB7610D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934885, "uuid": "aa05e487-750a-4255-8bf6-0a5046e2fc3a", "value": "6144:DRsFTEhpoP+v5/iZ0TzGXcLapzDiEuwixLx9:+FTEhpoP+v5/iZ0TzWpLuwixLx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752934885, "uuid": "68289d2c-96d6-4946-bdee-dcc534cb4d05", "value": 213564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752934885, "uuid": "ab5039f2-eff9-432e-9d40-c8bd2ae4ee6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752934885, "uuid": "f447f0ca-a351-4a02-9a74-019175d7f294", "value": "PO-MASS Limited_18072025_155442119-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4d9dfb-64c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752947864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947864, "uuid": "1d49c312-df01-40ca-a685-f136a16529ef", "comment": "Malware payload", "value": "3ef0cbd2235b66b19fcd290899375440", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947864, "uuid": "81acb523-4e16-4d09-8591-7bf7a49973fe", "comment": "Malware payload", "value": "e8d20c029bc55bfd0f3666db04f91c3d918e2b1277d669f90430d5049ca7d2eb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947864, "uuid": "a449fcf5-1c24-47c6-b0dd-2b8925611a4f", "comment": "Malware payload", "value": "c346b5421f6cd99fab6a8d7aff1ce76224e8e1ff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947864, "uuid": "dc126925-890e-4bb5-aa1d-724899cc4bdc", "comment": "Malware payload", "value": "a9e6e760f58de24f8d8f0e02914c2bea06ae5cb17af7976b0cad09f11753446568ce970c66749470922fe4d46fa82224", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947864, "uuid": "343fc879-00e5-44e9-8772-d55c219b3d4b", "value": "T12C21018D4EA6900B94388F32F04B87A44A9F9687B5B4AE6564DD0CF3544DB10743EE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947864, "uuid": "89badfc8-8afc-4ace-8008-1bd02ed02a71", "value": "24:2d6EN+dodYV2f7d/dejGpdeABAoALd6unuauxd6uQ9uQkuQLd6u5uQuPd6uYuxuA:2dWdodYV2f7d/dejGpdeCXcdvuPxdvr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947864, "uuid": "ef013465-8a1a-451d-ad9f-b6b5a2e93ec3", "value": 1378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947864, "uuid": "792356c8-65dc-42bc-84aa-a532ed7074c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947864, "uuid": "85787509-ef4d-4492-9592-5d2f9b1f9121", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f59a4b-6478-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752913081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752913081, "uuid": "1bc357f1-87ee-4de1-87c9-04b2bef54bfc", "comment": "Malware payload", "value": "f8bf38aa4f4a905a96b91aedaa9db725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752913081, "uuid": "b93f5992-79f5-43ca-9088-2b3eefbb943e", "comment": "Malware payload", "value": "e8f8669901b7ea7a1b7bd000aade564f2a5e3e314f88550d97838e05f961fa8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752913081, "uuid": "b9737717-1600-4b02-879b-aeb4695e251f", "comment": "Malware payload", "value": "b84ad1dd49a6967d11806b832ae15ac4e7a902bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752913081, "uuid": "f150730a-73b3-4926-8202-b86adaffb6fb", "comment": "Malware payload", "value": "568475d90c984ef2fcaa9e9c084a8d6fbb0b7d83bced0fac303c6685fead6b5c7da88afeade01cc7ad1e446d0b501244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752913081, "uuid": "84372983-03b0-49c2-8fe9-c9cfaba7476a", "value": "T1CAB63A47E8A085E4C0FED13585269266BB717C494B3477DB2B60F7282F73BD0AAB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752913081, "uuid": "10a00009-fd57-4192-bcae-eab5a885ad9e", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752913081, "uuid": "9f86597f-0737-46d1-bdb7-b6039d2d51b8", "value": "98304:xoP+9pALd87Xns6kSvwW5rI8EFQPd1B+:NmLd87vkK41Fgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752913081, "uuid": "4ee7471d-e8d3-4d62-98e7-2fd0ed85cb35", "value": 11280384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752913081, "uuid": "61161a2f-a57c-4141-8b48-a9103b705508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752913081, "uuid": "065bb2ef-b5e3-423d-9c1d-b1ed53a6c81c", "value": "SecuriteInfo.com.Win64.MalwareX-gen.20558.18123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221a291d-6470-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909321, "uuid": "d0b6c7d0-f5d4-435e-895b-5769877d8940", "comment": "Malware payload (Mirai)", "value": "b08c0fa7c235dcad31125715ccf05a35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909321, "uuid": "ffe1f912-bca2-4afa-b798-4ed83120c643", "comment": "Malware payload (Mirai)", "value": "eb002d4b156c069d59c8d6ad00ef00033543c7f23b9a2ca231b31285bd7e682e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909321, "uuid": "0869af3a-662f-4194-94df-013561094db4", "comment": "Malware payload (Mirai)", "value": "b192ad60de83fa308da766ca17e54122972d0c22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909321, "uuid": "03d24be7-62ef-496b-8a62-40655c7322c2", "comment": "Malware payload (Mirai)", "value": "51a558da0f6a9d08d3c416a0ef9a8adbf1dfbc0bf50e1649a2fa3635ca21bee17f6e07f662fe3c63f0d2a5817738ceff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909321, "uuid": "105c390b-c343-4eec-bc91-130578fadf57", "value": "T158433B22BA711E27C4D1A47A31F74711F5F543CA26A8861B7DB10E5EBF20A803647EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909321, "uuid": "f72e623e-634c-49e7-a160-7d91b55f26e8", "value": "768:jHBLzCJFEhfhaGgZgc210YHGRSQjh6O+y5f5BpZF1t6fIV:NLz+FExhaGgOc210lRSYSy5Dt0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909321, "uuid": "c57090e9-fab6-4608-8c24-707ea35b34a8", "value": 58680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909321, "uuid": "fc28e35a-2fe1-4306-bd5b-1454c0a0de44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909321, "uuid": "77891028-47fc-4fc0-806c-e4d4c431fea4", "value": "nexusnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75674e9b-64cf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752950263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950263, "uuid": "007127ca-534b-41e0-9cef-a568f989f5ce", "comment": "Malware payload (Mirai)", "value": "5058e3045465fa0b97ac98b56e823f6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950263, "uuid": "cdfe84e4-ea4c-4da7-9a53-725ddada05d8", "comment": "Malware payload (Mirai)", "value": "eb6913d816c810b0846bc7bf8dd6a19152cf078b0e4ddac040eda89ae0de8ac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950263, "uuid": "d1398cb2-a7a2-4da8-a107-4f0f3c108537", "comment": "Malware payload (Mirai)", "value": "45b360632bc113ca31f0115bef6e89eae1619cfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752950263, "uuid": "05f1e189-8215-4a37-9741-24e1b27e69b3", "comment": "Malware payload (Mirai)", "value": "57eec52501fc964d37c3d0c6d572f047d6189ea96af719cbdb25b52b8aa4c69f90196e6feeac83aa507ffab622b964ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950263, "uuid": "99bb57cb-9bd0-4602-b038-39b6f4a50992", "value": "T169144AC7F800CDBDF80AE73748170A15B130B7A254921B777267796BED3A199093BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950263, "uuid": "3c9c3760-7d97-426e-9e78-c7373e427920", "value": "3072:56r0EL1Vm3zyPIrR6KW28EhklP4mcPdcVsjbiRLb95spypYH2L:5W0EL2V6KWhEwVcPiLb9SypW2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752950263, "uuid": "2e62c597-9267-4091-bcd8-36168a54b276", "value": 190560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752950263, "uuid": "3f620077-e3df-45ed-8856-8216b1dd73f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752950263, "uuid": "445b721e-b31c-4415-8e6f-558aa51b2f5a", "value": "top1miku.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326520df-646d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1752908060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908060, "uuid": "9059f86e-b0b8-4947-999f-b1a2f9c63748", "comment": "Malware payload (AgentTesla)", "value": "651298d388a199e3f6b13f07f60cd811", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908060, "uuid": "2cbe2eb7-1853-4e76-ad82-33555ee282bb", "comment": "Malware payload (AgentTesla)", "value": "ec40add0f6f93d1ed5cc9a72fde905d55f17f394525fae57eb514a935a202660", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908060, "uuid": "7d5962ff-361c-4a00-8aea-3421e43755c0", "comment": "Malware payload (AgentTesla)", "value": "a5b03e53e6d83f74379acaea09a582758313880c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752908060, "uuid": "f5f44464-bf22-4ff9-aedc-a6dc1c8edb84", "comment": "Malware payload (AgentTesla)", "value": "c98e373fef8be22acf9d02fb2febf78a28638e102a39e9fe4912107c8efb49df028fb3e85709238f52bd8ffe3afc00da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908060, "uuid": "0fd7d266-980a-4fa1-841b-e4fcc55f7793", "value": "T13A253328E1E0CE77E6861D3A5A7A0F27A4F8F06E667147573BC02F46D8239F0449E1D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908060, "uuid": "4d0a5421-5005-4780-8d5f-643387c2ed86", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908060, "uuid": "4ac16c19-07ad-40fa-ab6d-f6d459efffba", "value": "24576:s4BdO85tJ9ZoRi72wID9IR3P+1uAlxxULE8W6D:B3tJ96U7+03PSWqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752908060, "uuid": "15a8dc1b-eb0b-43a6-847c-938628864199", "value": 1047154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752908060, "uuid": "97262a3c-d000-4590-a39b-b9b8d1d718ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752908060, "uuid": "514e8fa3-2bc2-4229-9454-d2a94bcec95a", "value": "pago de la factura 13-3369013..bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deaf1fd4-64c9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752947863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947863, "uuid": "dd880ef2-18cc-4efb-92f6-b62d3ca9f7d2", "comment": "Malware payload (Mirai)", "value": "f8115e73ceb5c0ed4415b92d521638ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947863, "uuid": "1f24f7ef-0967-4f3d-b42b-af195ecf3772", "comment": "Malware payload (Mirai)", "value": "edd85149fdf3b955a1fe37b8d28903432f2eff871c37168e9a43c90f9d4a4a90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947863, "uuid": "9b8f18c5-9405-4eb4-bff0-4be0436b77d3", "comment": "Malware payload (Mirai)", "value": "bb01065476c5510c60b0e2ff50d246ba489c4f4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752947863, "uuid": "f6ef6bac-1e67-4230-83f8-258d5f970e69", "comment": "Malware payload (Mirai)", "value": "e5c961ec34340df862f8a3ea8b7097227015a881c570b00597ad3b2134a6e6fda43c5fa9e8d6027114130aad3e4be34a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947863, "uuid": "3ece372e-004a-4363-8d59-7cd6b8b5b059", "value": "T10E04D806AF510FFBD8ABCD3705ED0B0139CC955722A53B753678C628F94A94B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947863, "uuid": "6d4cf33a-917d-4797-89be-29365ca30d05", "value": "1536:b5j9tudkr/cc0ttkLp5wB3VyW96Ol1d2Wdnug8AHL2bw96z5ou7JYZb3uHccwHM3:Z9tudQXS3BsrSb28A57iGOM7STBUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752947863, "uuid": "6c42cfd1-3216-46b8-a10b-405517636860", "value": 186028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752947863, "uuid": "d679dfec-463f-4131-87fb-d8e2485809dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752947863, "uuid": "8edef25c-5fa5-4c46-ba96-2039c69efa08", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f409a2e1-647d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915257, "uuid": "868f6877-3f7d-4382-b3ec-27899403b3c6", "comment": "Malware payload (Mirai)", "value": "346ddee1c27ac6cfa5d6767f2011e71e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915257, "uuid": "17e1cb5f-eb08-42b4-b5da-e1950853b4ca", "comment": "Malware payload (Mirai)", "value": "ef3a0ce3f29b7d12dae478e0b691e64e3eec902a07008d232f6f1ab0986745e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915257, "uuid": "c9220cbe-e425-4e66-bb37-044939c352f5", "comment": "Malware payload (Mirai)", "value": "847f74b74294b5743c9d5e0d2d5338255d4fb539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915257, "uuid": "6e72c54c-c9ce-474f-bf7f-d6ba5cc9dd64", "comment": "Malware payload (Mirai)", "value": "e6252cd8fb437e94be72b5949c3bbed8b1369fb569aece2875eae1030ab2c4850643b0f108c385aa4105a6d0caac540a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915257, "uuid": "5be9e607-933d-4888-ad87-c7ea6155c8d7", "value": "T1FFA2E01572A32D66F2ED183CC96AC357BD660BFC90F632757D446520C90924A2E39A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915257, "uuid": "41aa983f-fdc5-4b49-a9b5-964a36174342", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjKBOhymdGUop5hf:vvQn4j+ZO5fKAlxxs3Uozl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915257, "uuid": "a451e914-9b78-4243-819a-e2ac154d879b", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915257, "uuid": "fb8b38ba-8d6e-45fd-a206-7e2f4d5be46f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915257, "uuid": "0c162f91-a51d-40dc-a029-15e3c3f27789", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196b7bd5-6493-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752924339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924339, "uuid": "592962f3-cf77-4ce0-9740-1768d6b5a52c", "comment": "Malware payload (Mirai)", "value": "ce74887193c57eaf480840e6c3ffde92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924339, "uuid": "8ac7fbaf-2cf2-4536-985c-dd420936bbe8", "comment": "Malware payload (Mirai)", "value": "f01903c82436d5792beb3b57eef64f9290d4e342874b64610a6cba7a703fb924", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924339, "uuid": "08aa5d17-e60c-406f-adcc-df4ee269fe58", "comment": "Malware payload (Mirai)", "value": "c5019de8b06de9c99819d0a35e6c74fb5289ab68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752924339, "uuid": "2bcae154-74e2-4af8-b14b-b9af0320cfc6", "comment": "Malware payload (Mirai)", "value": "aa28c169698ae084a5af183b23300c6f3e4f76ccb7ddf4b2c100dbb2837f30c52fbb45336f4b37a82cbd6bd7711be70e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924339, "uuid": "7922765f-6021-4683-b088-e59d48e20d9e", "value": "T139E55188EEA8636DC7F1B2FBE61843CE72730FAA67A630394534867073C4B697539514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924339, "uuid": "a1e73919-a5eb-4ea0-a7e7-b124f307a9ea", "value": "49152:+YCTSwpAD8Y3cf51MnRnrX4V8GxOZpMoqjh7fMtPGV:+kwpAD8Y3ch1MRnk8tMoq1fM0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752924339, "uuid": "958f50a9-832a-4a39-8edb-162577421ee9", "value": 3202936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752924339, "uuid": "7e3f5e6a-2776-45bc-bcb9-84bf81c03a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752924339, "uuid": "0062f1ca-b7cc-462a-99ff-65ad6e5be999", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50841f7-64cb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752948679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948679, "uuid": "093863ec-566b-4f8f-a868-9133255869ad", "comment": "Malware payload (Mirai)", "value": "ce9d936c405dd96d4ce16f2167dd241c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948679, "uuid": "e7bd9cea-97dc-4350-a34e-6ee8be509d08", "comment": "Malware payload (Mirai)", "value": "f03f204d7f73e219b850ac24e2e8758c22083da5c6e28fb49204e5e786aabfd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948679, "uuid": "be3ce57e-4121-472e-a24e-b338dccd4669", "comment": "Malware payload (Mirai)", "value": "4a13e5f598606dfee035a4e081989234560a4fc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752948679, "uuid": "50737003-b00f-4312-ab9b-a52377f7afaf", "comment": "Malware payload (Mirai)", "value": "9b42cc6e88225b0cdd0230d454103f906d2287a6aece293ce0460c70ae865b8186a07ddb99a66b44e8e65c74e418887f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948679, "uuid": "ae9e3b55-628b-472f-8b58-c04ac7832d3b", "value": "T145D3ED7AA7A29EBBEC1ECD73059A4902214C928D52D96F6FF264C518E3CBC4F44E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948679, "uuid": "9d6590ce-413a-49ee-872e-9eb999e6bf82", "value": "1536:vJ93QmKehZ+ag5kOXWsFKClp3v3LjW16KHHsr3dAe5uI02CPEd9DSwFl:vJBQbehZ+ag5kOeClp3Ful2CPpwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752948679, "uuid": "e0fad657-4e58-4d15-bc20-9b51e01928b6", "value": 130950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752948679, "uuid": "7f965d1a-028b-42ca-a2d1-2afcc5e26b47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752948679, "uuid": "eb9e07db-e4e0-41db-baab-fccfddad75a9", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61298e71-64c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752943787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752943787, "uuid": "8e89c2c4-b7df-40c1-a0cf-b71bfb1eddec", "comment": "Malware payload (Mirai)", "value": "0bf0305ae4e6bac88ece4be4502c8fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752943787, "uuid": "8b117b8e-72ee-4131-b18f-158a811c7582", "comment": "Malware payload (Mirai)", "value": "f0acbd7cd2a32d3a5230a1760980619f9e1cb32a230d31ad452723c62c76576a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752943787, "uuid": "5b592173-c197-45a6-997b-373b5d640d98", "comment": "Malware payload (Mirai)", "value": "a4f802e38f279391e95d44d8606e2fe7309112a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752943787, "uuid": "d9bb0839-0170-49eb-8604-c2aa63bf7858", "comment": "Malware payload (Mirai)", "value": "32889a3ba6819d3e7a165cbe372571e0f6398fc8e3d1bd9002f75e412de293d93a77aa9a0aba9ce585757b46289c3b00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752943787, "uuid": "fef00a67-d80c-4a51-805c-b6757778067d", "value": "T167835B22FE75193BC8C4A47761F74336F2F6438A24E88A1E7D610D8CAF646502297BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752943787, "uuid": "f2572c67-ca29-4148-a84c-a4ebd1bb9e29", "value": "1536:XzD51tLHUbwVvI7u3Vp5Ii/Pow7bKtF01XNT5+GIQQihtTFmb:XPZPpHYwqnYXNNMJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752943787, "uuid": "3a5dd462-559e-4b31-8d0a-4b82cdd0d770", "value": 87496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752943787, "uuid": "106a907f-cf46-4fc2-b2da-0425e9c9c9d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752943787, "uuid": "fea57d50-4387-455b-96a0-7f5f18676925", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc537dd-646c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752907922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907922, "uuid": "6bd67fee-c2ba-4be0-a074-1f5b739a0bf2", "comment": "Malware payload (Mirai)", "value": "13745acad6c7712add8ddcfd9cf2e794", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907922, "uuid": "459349aa-8d1e-4edc-a530-d66f73ca3d44", "comment": "Malware payload (Mirai)", "value": "f1a3830e55853fef4e3174b1776c7a32d864f92ed8203032c149dbd9708f2bec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907922, "uuid": "b76c5101-7705-4c71-aef6-9434efbf6bfe", "comment": "Malware payload (Mirai)", "value": "e95b273a839bd0ca975393364d10f8d87d6db9e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752907922, "uuid": "c10f62bf-51ed-4319-a461-de17ddbc2fa5", "comment": "Malware payload (Mirai)", "value": "ab902341cef83757c6ffe804636ed949a99825ac8e2186d7297f04bcf2e90b49e0e43b7502af48dbdaaedfa6daf6e520", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907922, "uuid": "a104b320-f8d1-4d3d-b378-b72440ec640c", "value": "T1B7730997F905FEBEF45FE73909C20B19A234BB468A531A293267349749373852827F07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907922, "uuid": "70d5dfe3-c1d9-4800-bb57-0d4670ab304d", "value": "1536:eLuuNSJstjsySsJP4L6Ir0LgtequxP/K8H1wj:eLlSOasJP4L6pLpquR/pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752907922, "uuid": "860caf24-54e6-4b1d-aa63-8ebb9a8cb456", "value": 80061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752907922, "uuid": "8946f756-ac29-44a8-b3b2-550ad6ef2f6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752907922, "uuid": "b29d9ff0-66c1-4384-9f33-74d698d68dac", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9090e1d6-64f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752967918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967918, "uuid": "4e2328c9-1416-44e1-809f-2a676cbc0294", "comment": "Malware payload (Mirai)", "value": "d95f8c67743548d4101de60848c4d510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967918, "uuid": "4d6533de-b297-4b0b-806b-40d2a9aa0b06", "comment": "Malware payload (Mirai)", "value": "f1db45ff92f5e580171f0d1fb728e81657ec5b2cff86ecc35eb5de18c9e7cdbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967918, "uuid": "8398194b-cde7-4051-8233-835e26c0816a", "comment": "Malware payload (Mirai)", "value": "56800ff2455ef6f3a0804efb0c5d1a8512d7e9ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967918, "uuid": "ecec343b-441a-437a-b660-db9b9b19a05a", "comment": "Malware payload (Mirai)", "value": "3fad9d98001606ec8ae1981907735c77bf4813a85ea21bbd3c3eae48f3413850eacc6d3d63dbc797af260eda048b0181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967918, "uuid": "4a59e941-0742-4e2f-ac04-e5bfd7befd8a", "value": "T122934B82E2CB84F7D85704B46056B37ADF32DA568032D647FB499E32DD3BA0152173AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967918, "uuid": "a147dc1e-a902-43c2-a0ce-961c3caaf2f9", "value": "1536:nqmmD+TfUGhrBNNIvdbZWba6iZawX1CaiC5/l3itWIRg:nqMTfUGbrv9zwX1Cai+/ccI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752967918, "uuid": "b453c944-0839-4add-9a8d-45d7138edacd", "value": 91300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752967918, "uuid": "250610f9-8f0c-4cf4-81a1-42e4e3aef7bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967918, "uuid": "8b073a4f-93f9-4768-9781-418da0bc9740", "value": "cron", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216c8f5b-649e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752929077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929077, "uuid": "cdfb79f9-9fc3-4ada-b27b-acc861906610", "comment": "Malware payload (Mirai)", "value": "ad6acb9b47fc3e3477db78dada7cd918", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929077, "uuid": "8aa36e36-e74c-47f2-9190-a42576c91309", "comment": "Malware payload (Mirai)", "value": "f4185560f61a2e65676dca39e34f3bf58df70e31bac15ff102a457d017bd03b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929077, "uuid": "7ee4a748-332f-4f8a-b84f-41eab5eba240", "comment": "Malware payload (Mirai)", "value": "bccd71d1d2cabc1beb7c4c35d09cbe58e0b49214", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752929077, "uuid": "011b447a-129e-4a42-a6ce-e1eabe5c426c", "comment": "Malware payload (Mirai)", "value": "3d049be430ae9946c1a0f9813823bf246b53b0de4dbeccdc86e15dbf35a193f38ca6bd9508fb1c51c686785521168b64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929077, "uuid": "3b2a03d2-ebbc-4055-a3b2-8496d6e2862a", "value": "T199636BC2AB47D0F4E8261571217BF7726A72E13E0069DF83D729D831ED53A02966A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929077, "uuid": "a6223a7a-21bc-4479-939a-e57d0be189a8", "value": "1536:veiDth78+x/JE8xILLjQs633/xgAMInc7WM0TabX:vDh7BpxWLX633Jg3QI+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752929077, "uuid": "ebb883fc-2d98-4f8c-adf2-c22e59a23a98", "value": 71824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752929077, "uuid": "eae9a037-258c-4082-bc98-5f26aa37cbd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752929077, "uuid": "874da96e-439a-476e-b666-fd598e921b08", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffc0d56-64f8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752967783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967783, "uuid": "2e3223c3-1b23-4d46-a7a3-990525c89a98", "comment": "Malware payload (Mirai)", "value": "5efa6176d37f63de684f47359ccd165d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967783, "uuid": "46563725-9f63-4253-8853-fbd625088c5e", "comment": "Malware payload (Mirai)", "value": "f53157403d7afea41314a22d4a9ed83074e22f55ad367fe5e0920e147f355d49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967783, "uuid": "8471f2fb-01ac-4716-85d2-2ecd5c4eb6fb", "comment": "Malware payload (Mirai)", "value": "329c4bbabd663f22562fb1d10c30566337c51062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752967783, "uuid": "26d2b189-e4ff-4942-950f-c9a5cfa02929", "comment": "Malware payload (Mirai)", "value": "147fde2555ba14d5eafe60c313234c963fbd4795e7f8e927b7a6055b40354c14c69d060f564c2403615d08f3ce8f3247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967783, "uuid": "f6fb2181-e634-4bf4-b521-656b6b03e07e", "value": "T1BA935C47D293E4F1D90201F5206BA736DA35DE335020DE9BE798FD76AD36A03901A7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967783, "uuid": "f297627c-0560-433a-8d38-52aa90e75232", "value": "1536:+sOdR1cjxj8gP8Z2cmTmKVWAMl8K7XoI+OIGUi31ZZvKeGWDr:eTc9j8gPISioWAMlSCFrwedH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752967783, "uuid": "ec4a452d-2910-4eec-b08c-324103453098", "value": 90780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752967783, "uuid": "1caff1a3-e2ef-4656-bd08-4b27be70248f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752967783, "uuid": "00735c2f-f22a-469c-ae52-bfdee03a42bb", "value": "rsyslogd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41bd568-646f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909191, "uuid": "b4dd37fa-8d34-4958-abba-8dbecea7e977", "comment": "Malware payload (Mirai)", "value": "faa220e5374386ed528beadd24fc8969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909191, "uuid": "21ad3a7f-e729-4035-9eca-58c06a677825", "comment": "Malware payload (Mirai)", "value": "f660736984480c1a3a87af5f6f17adfa7ed5a61c8e0d607bbcb84ca8ba665162", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909191, "uuid": "cdb259a1-9ea7-43bf-9a57-9e392bd530c2", "comment": "Malware payload (Mirai)", "value": "7ca671866da2088f6b2ca7d0c4defdb5ad5c5793", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909191, "uuid": "ea9e5098-e143-446c-9ba7-77ff46454e34", "comment": "Malware payload (Mirai)", "value": "6352d6d22397b89873725512ddee1c9d84e5c1071a76f087ecd1319b1823f88f67aab4b63d4cffbe49d7cc7e34bc4b3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909191, "uuid": "5a5b1e79-3047-4265-b276-a669b1d3626c", "value": "T123A36B9FF64B1090C86246F01BCB4FDE3E232392AEA784E32C1D16B919751DB5D0AB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909191, "uuid": "aafe5dff-e975-42e6-9427-f84c5dd70554", "value": "768:a6oVyw0w+LirD0wurwAKA6rYlLVyp4xBXN266qc8pwWlT1UBMXc9XNe8gwGI554Y:o0tDlgrKByp8Xcy7jlT1UMs9Vgh/LW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909191, "uuid": "1a9dc2b6-c954-4ca7-930e-e23d3be8e59d", "value": 99600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909191, "uuid": "7e90e915-179f-4471-87ea-ca611a72baa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909191, "uuid": "770ef308-ba52-416a-999e-3ff5741bc222", "value": "nexusnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5ae8c7-64a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752933261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933261, "uuid": "7131f3d5-7207-4405-90ca-3c4e66835564", "comment": "Malware payload", "value": "c6b11b7beee6178f9a877fe5c7bad7cb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933261, "uuid": "c61ba7da-df73-4043-9f2c-6ab266650c95", "comment": "Malware payload", "value": "f69745697f975fc53af53390c94141450263181fd16fe2e7ffff19fbf26f7b4e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933261, "uuid": "c714a052-1ded-4950-8584-5509eb114ca9", "comment": "Malware payload", "value": "98c58768e5bc4e70d2790e6758d465715d35a0d5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752933261, "uuid": "067b42ba-aae6-4fa0-8394-9b20a752c9a3", "comment": "Malware payload", "value": "b00be194ed0f86877afd905b854e17bb846110a4627c27512b37f8a2b3447de82e4b28578be4679e0f85a944a9205248", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933261, "uuid": "8a32c4ae-fc81-483c-af54-a10c41309c56", "value": "T1E9F243D1EA5F3E100FE23345515C4469CE6D9302ADAEAE1A3A8F0C5FC36399C7593E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933261, "uuid": "7c21103e-1110-4c1b-8f53-7e2ddfef6540", "value": "192:HOSuJ/N2P5Y+5iXXYgQ6JHA5GXdxHznV8N/0EPMMt6gnL6hpfhsR5iTOE2BtPvX:uHc6+aa6NA5GXdhTVW/NPT6W6hsFvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752933261, "uuid": "819fb20e-74ff-4907-aae0-32b23a50c815", "value": 34323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752933261, "uuid": "abd56cf7-f543-44f1-9bce-1e1c90253b58", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752933261, "uuid": "85f98f1c-8ea8-4165-8c25-61b3f5cf2c7e", "value": "Emirates NBD 33746737223.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f18c6e-646f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752909254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909254, "uuid": "3c6764ec-9ebf-4559-b0d2-978530bdfec5", "comment": "Malware payload (Mirai)", "value": "73db69ff1ed43c66054a3f9f69608118", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909254, "uuid": "df1f41e4-9b8e-4f9a-88ce-2b471c5d1119", "comment": "Malware payload (Mirai)", "value": "f6cdb8e4c3e73080ef3a91fede1aaeb5b7039e7a988e4ebabf2585294212d9de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909254, "uuid": "c49a3ed2-337b-4633-b151-38e895aaaf41", "comment": "Malware payload (Mirai)", "value": "638a425986ef476b5cd95075a18e6de55eb88dba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752909254, "uuid": "fcf16783-df25-4d3c-bf08-3bd54035bf05", "comment": "Malware payload (Mirai)", "value": "cfc35778947a7b5d7cded26b1d46417f07d4a1de6834b8bae217eecab64f8e46add3c9fb8e24a29b5514316f92f9e105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909254, "uuid": "d9590255-b082-48b3-a272-f127beec9f22", "value": "T1F763D82A7E218FEDF6A9823047B79E22575833C637E0D6C1E26CD6015E6034E545FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909254, "uuid": "df94c8d2-54b6-42f1-b8e4-9bebf9467339", "value": "768:rVz66z/560HEbN4PuRjYyIlS/hbdkfJTmDhK5uLHxH/Ys/YnHWFLGiZYfM6soP7z:rmnqWFsIH/Ys/YnoLIf8oPyevBcelr7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752909254, "uuid": "52d0c5aa-778a-43e4-91e6-608f79b3e7ff", "value": 69232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752909254, "uuid": "6ded2f86-a9fd-450a-a18e-446a26ac72b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752909254, "uuid": "db3d81bd-43cf-4d18-9de1-ff11ae4059d1", "value": "nexusnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ed4d26-6489-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920257, "uuid": "1bf4498f-02c8-4c23-8410-56c741c3e8d2", "comment": "Malware payload (Mirai)", "value": "bd302fb2a0727b99553656e122c8732e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920257, "uuid": "08d3666a-804a-4ab7-8aa1-31a424dde48e", "comment": "Malware payload (Mirai)", "value": "f7d0cb5d9264f648f67133fed54847bded8fc9fd9d7c3fa92d5d1924a0479a14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920257, "uuid": "cc9b0066-c8c0-455e-bee1-818f3bb6f291", "comment": "Malware payload (Mirai)", "value": "dbe886f76f895ef1ad4ab3aef9604217ad17dd76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920257, "uuid": "2fc1d98b-0a2e-40e3-872e-80ad1f66fc48", "comment": "Malware payload (Mirai)", "value": "564d60c5fc34dc937ef375ea2208a7f281a9828027c1f4c7c2245346c5ca1300fcc4ff507f20055be7e64abf8f8c183c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920257, "uuid": "32d621b6-3128-4bc6-aa33-963c89f566f1", "value": "T1DDD31A45F8405B27C6C612BBFB5E428D3B2A17E8D3EE720399216F60378795B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920257, "uuid": "67b75d89-3646-45cf-9c8c-bd365c8cd25e", "value": "1536:zKRrtqBVytsVi5b1q8638KARrH4ViylET4HwquCIKApAZRGG5kQLubaleywywRR6:zKRBvjJl88KC4t+swquN+1GSulcDFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920257, "uuid": "ca37edd3-1f8d-473c-8e0b-130857a0660f", "value": 133984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920257, "uuid": "af8f306d-e061-48d8-b442-933b339dc760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920257, "uuid": "681f6525-506e-4d84-a20b-f4309b8364bf", "value": "iotmirai_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06320d9e-643b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1752886511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752886511, "uuid": "feec2962-2fff-4254-b52a-d344d0793714", "comment": "Malware payload (DCRat)", "value": "523f3797ef31ec298108fbd26bbf2cce", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752886511, "uuid": "aa0a27a6-2cc5-4db9-93df-8d26ea9821eb", "comment": "Malware payload (DCRat)", "value": "f8a85602655e366f369d3431aed9c12e202d45d708e1f4b748b15e116bc815dc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752886511, "uuid": "f776ce6d-e786-421f-b36a-fcf208035135", "comment": "Malware payload (DCRat)", "value": "3202962bd7531f5b4370f791d6cf8428f14af457", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752886511, "uuid": "2ae247f9-f0df-4c16-b73c-3d77ea6c9985", "comment": "Malware payload (DCRat)", "value": "3d642dda8941dc42b5ee3e9d280d53adeec127289da81e4818fa8695e6eae1b7ffbe97ca4559cf5db812a20a4b95d613", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752886511, "uuid": "1d122ce9-0f1e-4b7b-94df-f47307e4ddd9", "value": "T16B05F701BE44CE11F0991A33D3EF46484BB49C516AA6E32B7DBA376D16123A73C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752886511, "uuid": "d9709f7c-985f-491e-aecd-7d54db70daf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752886511, "uuid": "5cc56f5a-8053-4a6d-b9e1-ba9179706ce4", "value": "12288:WRQ5elxlIUqTN+G4GfuvWRlAvkDJjJK+ZJBhO2nFIVnuYiqvQ:fkbuUqhjfuvWRlAMS+ZJBUCFGnubqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752886511, "uuid": "8d65b45b-9512-4a03-b1a2-cf42409f517b", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752886511, "uuid": "ddef01f8-dda4-43d3-97a3-80924ccf2308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752886511, "uuid": "ed4e9451-2e71-4660-a61c-d9a904ae146b", "value": "523f3797ef31ec298108fbd26bbf2cce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123ef485-64ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1752935065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935065, "uuid": "81564cb9-7764-4f73-a432-1ffe190fd1db", "comment": "Malware payload", "value": "5f1a78e7492f46140eac6c5c0af0d4db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935065, "uuid": "e4c6ec70-42c0-43c6-a619-5d42a6e6e5a4", "comment": "Malware payload", "value": "facd710c09d2f096703409de2130923f55035031db876cd03411a98d8b9528e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935065, "uuid": "106aa71c-4a4e-4af6-accb-8d76f39e64fe", "comment": "Malware payload", "value": "9c68fae7e7824720c41a19f699c7d79adadabf06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752935065, "uuid": "f0a34f97-6687-45c2-8cbf-3ba44b706feb", "comment": "Malware payload", "value": "ab76190a3e1a26965a2a16aff1f956a231ec4aa7f8828ba6d1a66e29c2582a7eabd78851bd05b6d82f94bcc6e72c9604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935065, "uuid": "c2a81662-3c5e-40a0-98aa-b10026dac872", "value": "T1D3261A27DE90640CF973553066F59663813D6C3A681DC80FF781AE886871AC76EB633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935065, "uuid": "aece06f3-ff97-4be3-b35e-fda9fde282a5", "value": "6ef1f1e4b5a2cb3968fa7e14964b34af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935065, "uuid": "59168192-d7bc-4cec-84fa-08c134729c2b", "value": "98304:QyNSYfIMFn23ETg6rE3eoeJB8AOVhzmfdZTaeuR:QyNSYfIMFn23ETg6rE3eoeJB8AOVhzm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752935065, "uuid": "e54a64f7-f665-417e-a75a-e6efe5adc233", "value": 4796416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752935065, "uuid": "3efd152f-9b50-4ada-8fd9-9f726e4ef1f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752935065, "uuid": "432dcb2f-d7c9-46e7-ba36-17aec3c50913", "value": "xsh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96917ba0-6489-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752920254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920254, "uuid": "33a01042-90f4-4164-8a13-249a8a3bafdc", "comment": "Malware payload (Mirai)", "value": "faa7b1ec050d2d4bd9f2856b4e2e01b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920254, "uuid": "cd542fba-708e-4076-9b5a-dc262a87cf80", "comment": "Malware payload (Mirai)", "value": "fc807d9305060188be87bfb6aa1f04d7f0ef9a6e7d767c02c79684ceed63f02d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920254, "uuid": "fb3747ea-9168-4dc9-a13d-36fd9bf47570", "comment": "Malware payload (Mirai)", "value": "be9fc3f4aceb3560b848572f444a072c16a180d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752920254, "uuid": "48d45cb6-8913-4aad-a103-8150bdb10fbe", "comment": "Malware payload (Mirai)", "value": "637b6769750e44b0165c1f2b91f0bfff4931fd6238e6091ab6015ce4b2cf43fba4dbd5b5662971fb515b18d6e4f8d20a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920254, "uuid": "a40adde0-cc92-44d0-8409-77a6c773447b", "value": "T155D31A45FC405B23C6D612BBFB5E428D3B2A17E8D3EE720399256F60378795B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920254, "uuid": "0a7a7fda-2710-48df-a711-9a2d610bd855", "value": "1536:GYpKwhBhPG5XJwaBehyMBTrXWrAkCP4V6ioTDrPOye6tvMGrxqRd4RFle6wywHRM:GSKY3oChvdDWrW4lorPOyHtBFmGIxaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752920254, "uuid": "14f995db-1695-4bd0-b9a3-c17481ddd660", "value": 133984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752920254, "uuid": "a83b1082-b8d4-48a7-a225-5bacdc4ecbe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752920254, "uuid": "9449ce1f-083b-4705-b869-a96835e4f21e", "value": "iotmirai_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f2417d-6462-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752903508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903508, "uuid": "85c1988d-9a69-45ce-b9ac-adf7596484e1", "comment": "Malware payload (Mirai)", "value": "f799c3f0cd5c527e3f9dc36e44d52a87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903508, "uuid": "202cabd4-d319-4240-86ad-15e9323f00bb", "comment": "Malware payload (Mirai)", "value": "fcdc9d1a5ddd5b89a0f0b58357bc4f5830733286528070a4ea3a8ad7f4149000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903508, "uuid": "8d74a8f9-42cf-45c3-84df-d04209bbc782", "comment": "Malware payload (Mirai)", "value": "cf6bc0a40a6fa0cd322912420a6c0c4dd7baf0e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752903508, "uuid": "82cc4c6e-6f75-42c5-be64-ce03a70c6418", "comment": "Malware payload (Mirai)", "value": "f4cf983f2659e36ad89d822e3a26a96e74bb8684b7913af0ed4c0c1174f1bb940b1c2b9ebf3a15660291eeefed437237", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903508, "uuid": "2f67f5eb-15bb-4f2e-bfe9-4361d52b4287", "value": "T18FA33C85B8815B25C6C156BBFE1F018E33035BACE2DE73129D141F647B8B95B0E3BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903508, "uuid": "94714f9e-7cdb-44e9-8de9-e7b05c16fa68", "value": "3072:yicrB3oudK21Md7YE7ZiVqaZUzgvfLxRnWZpnS:Pcd3jVi99iwasWxRg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752903508, "uuid": "41a4be65-fe1b-4fa7-998f-0bd7b1c8669f", "value": 100032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752903508, "uuid": "61c405b4-ae22-4e24-a1db-5cd1e1b9cb49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752903508, "uuid": "5cb73a90-1570-4cdc-aec3-23e238ddfde9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b670b3-647e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1752915280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915280, "uuid": "d395e479-c46c-40cb-95ad-a34d06f30f22", "comment": "Malware payload (Mirai)", "value": "38bd6382e5ae2bb7816f479f677d2b11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915280, "uuid": "3475c944-b455-429a-a357-1cceeb2506b4", "comment": "Malware payload (Mirai)", "value": "ff0d7b4c8e037d35a362096eae88646fff40e3ce3fc2d5b700ffff69d6186ff5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915280, "uuid": "20531682-5035-428b-aec3-2d21892f0ab5", "comment": "Malware payload (Mirai)", "value": "74e3742ec46d5f1c48dc0d2709386aabbc2bf5e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1752915280, "uuid": "1a54e0ac-b13c-4e60-a7c5-8b1dbb6068b3", "comment": "Malware payload (Mirai)", "value": "63dbbb5ad9e666672a07c99289432f8c2db6136881b9b181ad09da48ac98f32282cce70f7e8b5a4c2e698f0bfac0c7fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915280, "uuid": "3ceef0e7-ab67-4f86-85e7-418a36f004c6", "value": "T12BC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8675F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915280, "uuid": "fbda3771-d302-4bd5-84a4-8e9d01558f36", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHo3rScVM/9OAvjik:cowpuQyNSG24a1styKdlTuI3rSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1752915280, "uuid": "07bc99ea-110d-463e-9c96-2060c1f0e8eb", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1752915280, "uuid": "a739bb5c-5af3-42e8-ab62-7f3aee8ac8c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1752915280, "uuid": "133e6a88-a06d-441d-8eeb-d4d7631aca61", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }