{ "Event": { "published": true, "date": "2026-06-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-06", "timestamp": 1780790582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "939ce7e9-064c-41af-83b4-9724b0a2dfe0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e95dda-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771445, "uuid": "4eac827e-2a9c-4b0f-8c7a-1d97c5676906", "comment": "Malware payload", "value": "e7e9a0838b4253c3c43de5e23ef78d7d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771445, "uuid": "a471c58b-fbe1-4192-b518-48298cddfc29", "comment": "Malware payload", "value": "007c16460b4b540cdbdb2488eb9be57baed53a31f2544bda86e3d21fb5e019ff", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771445, "uuid": "46f3745e-c6fc-47e4-a6d8-c97393710383", "comment": "Malware payload", "value": "0e1e8f0cf7ae677a24f72340534fb16d51c4bee9", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771445, "uuid": "e47e2fa1-cf61-4e76-8cbf-1354598a1731", "comment": "Malware payload", "value": "620f2c5dee7cce5bc1c3375f3b2cb815fecb206353f55454d71428cdfacf158c54e1de715b4cfdf648bcceb780305fcd", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771445, "uuid": "860bf8ca-666a-4095-949a-01e2fd22fa9e", "value": "T1E4B312EE333C99EADAE96E0BDFD4BBCABD1EC7C35F46BA1A4540C8A1A14012010F5559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771445, "uuid": "b515c829-8851-4f0e-9a9e-5fef31301237", "value": "3072:SZDZkBatMkg4J6SxXdwKLJu+EXKYUFFcs0FnrsIVoT:SZDZk3hYd9tf5MlFrsIoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771445, "uuid": "a8664378-d209-4312-b9e2-123c9a4ed26a", "value": 114541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771445, "uuid": "d668efa8-5933-478e-8e2b-9a878ce8d5a6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771445, "uuid": "4e68c47d-6196-4167-809c-253b699f4efb", "value": "UrgentXRequestXforXQuote-73654323456787652345678-pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702e848b-61df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774771, "uuid": "92e28bca-9780-49b1-aa33-bff333f302b8", "comment": "Malware payload (Mirai)", "value": "974ec2170312613740e43586733eb98e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774771, "uuid": "2ce5e94f-c019-4432-b708-3a78e68b43c9", "comment": "Malware payload (Mirai)", "value": "008f69a06fb446a1c2606b8af15bab9f6cdf5aa0d467f36d56f4245e64c1f437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774771, "uuid": "154801c7-ed0e-4756-b134-7930df9ee7a2", "comment": "Malware payload (Mirai)", "value": "0d4532df9d07f58776b6cac370f3458c643a690a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774771, "uuid": "69eae710-36bd-46d0-8c0e-34106964ea8a", "comment": "Malware payload (Mirai)", "value": "cd7839709bee56b0604fd14d94d5ff067cd8ad016e649e008c2ec526a583d0644184fac120cee2795417ed4ee2e22e71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774771, "uuid": "7123651f-becd-4ba4-8b63-180a07368d9a", "value": "T174E33907B8C084FDC099C1B48BBEB13AD972B56D123DB29B2B88AF271D4DE604F2D555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774771, "uuid": "53f30240-0088-4754-b9dd-e215e766c16a", "value": "3072:HL+K3Eoyt+1+F6n+1Rmgv1cz1FiqYCap4lijk0KmODr/cVyS/9fk:HL+K3Eoyt+1+F6ncRmgv1SaDO0NcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774771, "uuid": "81678612-ad22-45ee-acd3-0d8b429ba3f0", "value": 152344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774771, "uuid": "1de884c0-168e-45c6-a64a-ce09478da1e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774771, "uuid": "fb4f42a3-e666-41c6-8ae4-5cbb3c9eb027", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d725fca-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771330, "uuid": "2afb4a2b-0b45-4492-b641-e9d6090296b8", "comment": "Malware payload", "value": "9b20faf95355445ef0a85f586d054ba3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771330, "uuid": "bc006b16-bc39-42c3-a5f8-30b70ba80b6a", "comment": "Malware payload", "value": "009207090d9e1c51be74159f75015469070b8ebf01f69be26d1c884a3542fbff", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771330, "uuid": "0ed9ed13-3693-4f53-8dec-a99eb5734f85", "comment": "Malware payload", "value": "ff976a79b61d568660104ca3f5d8be7fe76e543c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771330, "uuid": "16b4b1dd-c8fd-418f-9cbc-eb807241db29", "comment": "Malware payload", "value": "d96fb8176a3337a2abea5236610dda3826fd365a15d3923b69d409479a353f373a52d30c7b9876ca07bd272ea9f257fb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771330, "uuid": "bc62815c-638a-4011-a1bc-0cbeb604ef28", "value": "T1F813D0980647981CE5E966B4DDCD9A08BF71C078F4723982D4E14CA32BE0BB5CBB6592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771330, "uuid": "673045b3-0792-4bf6-b2fd-8a89f6990d9f", "value": "768:TguN90CuLDNzRxhmLjGrp8eUvgZNxeVkr3+SBeKxm:TVb0CoNzXILSrAvgZNQbyxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771330, "uuid": "223e81fb-d266-4064-85b8-363091ea4c44", "value": 42249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771330, "uuid": "5d913097-4f1a-4887-95e0-5e7c0f3bc73d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771330, "uuid": "d708b09f-d97d-43b3-9b46-9473d6647853", "value": "PO#9896640.shtml.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44911d8-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780771449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771449, "uuid": "e3575eee-2bb9-4671-aeed-7cbeadd443da", "comment": "Malware payload (PhantomStealer)", "value": "e4165d7a7d9743252bceec56bc842aea", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771449, "uuid": "d20d4af3-6426-47df-bf64-942cb00a5e01", "comment": "Malware payload (PhantomStealer)", "value": "00b7bb0d24e66cd711cebdd6d14db2e861ee93783e07b042b4650c433b6ac13c", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771449, "uuid": "93a0547e-a2dc-46ae-a799-1b0a4132aa02", "comment": "Malware payload (PhantomStealer)", "value": "1ff7424f6f1031f9d9ad75c413e306ea08e9bb9a", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771449, "uuid": "1b5a7062-ca31-45d1-b3eb-bd1b9d071781", "comment": "Malware payload (PhantomStealer)", "value": "3adaeb27d6246e09bb0f34ec1084c3d4b0b489072336c6b0144e335dbf77f155547bb64570c92369678037b90ea908bd", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771449, "uuid": "bc981e66-02df-42ca-aa65-4ddd63b6dbc8", "value": "T11FE19E1CA5A8B6277E4487DA6986E8FD728C0DA120EC3C6A50E759E205002DCF371FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771449, "uuid": "84e07819-7d0e-49a7-be3c-6ff6fff09ded", "value": "192:OUDgVpJm6r/XXowl/Xq8pSUyui6TprZHJXPmpbAy/DkfSUA:OUDg1nr/XYePDQDRSrCmfSUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771449, "uuid": "0cf2fdba-c950-417c-b021-5cd5374c4f8c", "value": 7415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771449, "uuid": "3666944d-f5a3-47dc-8b37-04a55cc9681c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771449, "uuid": "513e58bf-43b4-4498-983a-9fef399c9004", "value": "CONTRACTXPLAN.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418e7b98-61e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780775552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775552, "uuid": "e90a6ea8-b4e3-414e-894a-865c92ff7356", "comment": "Malware payload", "value": "1106c3eb858662f52a26cb77b813e53c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775552, "uuid": "caf5237b-b814-4b7f-9866-670e2c8f8f80", "comment": "Malware payload", "value": "00f887b89e087d515ecc3103b8a2a400c16f0148f2fb9dd3fcca0e288462a4d0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775552, "uuid": "51cd5f96-407e-47f3-9472-809281b5e9cb", "comment": "Malware payload", "value": "255acc9301de46757d135b1c0f550f44cca470bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775552, "uuid": "d1e9ab25-42d8-4323-a82b-7b6e01547dd3", "comment": "Malware payload", "value": "cc4637c977aa480c13dd9139b0495f1ece93e104b0dbeb4c7421ce276cc96bbd2ea77fa367f7371a0aa3ced0288605b5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775552, "uuid": "6c7e36b8-c673-404a-a6dd-ba10e0f19eaf", "value": "T170136D6526953C25AE99883B5D7F2F0CBDA983E2304491DDBF8A3CF18C15A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775552, "uuid": "295ae474-11df-412c-8e28-df88ca4ca06f", "value": "768:cr9NyXsZztCk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:6HusZcco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780775552, "uuid": "adbe5c9d-e55e-4c8e-84ba-56670eaa0260", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780775552, "uuid": "adcac22a-b7f6-4eb5-9cf2-988ab93aac14", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775552, "uuid": "04792450-ebe9-4aba-96fc-a989f55a5e29", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a77c55c-614c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780711518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711518, "uuid": "08cb32fa-b968-43a1-86fe-694dc7e9ef8d", "comment": "Malware payload (Mirai)", "value": "24abfe7a8c59df2e8d3e5505932baa99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711518, "uuid": "74498baa-a3ed-44a5-9412-115ad7ad3419", "comment": "Malware payload (Mirai)", "value": "0138f6c04444b88bd3ef107ed0f3fd99104de46bd8bdd2a8d696d05ac99acbec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711518, "uuid": "c762c468-8cf3-4fe9-b8fe-cebcc0097f8b", "comment": "Malware payload (Mirai)", "value": "a796df1d7041cf4b8876164ea7112692d3269663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711518, "uuid": "d38a98c1-6259-4026-a4da-6482b12d0339", "comment": "Malware payload (Mirai)", "value": "667a7d0f665f567d3dc78d9ce252fd497d24175acb071c6c3f8ec57e6aedf8439a6cbd11cb2a3fc0924b2cef35f92443", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711518, "uuid": "5e874bfe-a7b4-4f57-9138-802bf61b31f3", "value": "T13A33F1D9150225EDD879C43A02F59794A95C0932A233EE3F9A02B7F3CD37954B06BBE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711518, "uuid": "35212044-3d76-4ab6-bb09-3a56e52fbe4a", "value": "1536:MaDUCZrGfH3XoIEW/kQfVxnPk9/1leVJuh:MpC6h/jk9/3eVQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780711518, "uuid": "bd276a76-c3c1-4fd6-a4df-0c5ef836350d", "value": 54556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780711518, "uuid": "58ec1450-798f-49a5-8a6c-abf295897aa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711518, "uuid": "84e75bb8-93e7-4f9d-a3cd-a4fdcf481931", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87048e6-619b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780745794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745794, "uuid": "2e6a0bee-a9ae-40a9-9f85-5a179609529e", "comment": "Malware payload (Mirai)", "value": "5c261a28d990eab3e9c688f04b68fc5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745794, "uuid": "8b00cc99-45d2-4d40-b7fe-1db86c6e14e3", "comment": "Malware payload (Mirai)", "value": "0153066e5d7ee45442def97d1c043ba657dcbcfe1b5218c22fb2d20d3d766cd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745794, "uuid": "371ce28b-f474-4a6a-9888-4ce153106b11", "comment": "Malware payload (Mirai)", "value": "4145232812c962d8fbf9daf6b6d1e11b4ba0a69d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745794, "uuid": "0a68ddeb-2fd7-4dc8-888f-48edc4ba1604", "comment": "Malware payload (Mirai)", "value": "ad3c9ea00bf2e411760b4076e8ad27070ac9fa6a4967c95a33cccd6314c968985bf15f367d5b333e0a3624318f88b182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745794, "uuid": "698fd36e-611c-41a2-bbbd-0f2fb14940f2", "value": "T1E7932BA1B400DC7DF91BE6B7C0470B16B124A3A40F426F57B627FD63DAAE0645C26E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745794, "uuid": "1e23ba45-aa5d-4b65-983f-3525bb45c1ec", "value": "1536:D5G8wv+eScO057P80kUeEzvBotVbotO3aXfRofD87R4c:DQ8wv+TcOk6UeE1orF3KfRofix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780745794, "uuid": "f7b5a018-b127-4b84-8d79-9502fd678e4c", "value": 92620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780745794, "uuid": "36a5d3e1-2666-4078-9936-7a691c3ad96c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745794, "uuid": "e564650c-c46e-4f20-a767-adc5f1641eea", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e614bf9-61df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780774848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774848, "uuid": "54ef0b1f-18f5-4439-b7b6-87fbc298628a", "comment": "Malware payload", "value": "daf97aecd2c1b6efd1a60aee658ea694", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774848, "uuid": "28d472ed-d9cb-41d1-9a3e-608141710692", "comment": "Malware payload", "value": "02f021137074a7eb8059a84ffd92a4c0588b9ab09fbd2ffd9aa534d4ee94b500", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774848, "uuid": "178574c1-52ac-4dbd-879e-b8974526f761", "comment": "Malware payload", "value": "2ea3493e5dd0dc3a79d2554ab50548fd213d94c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774848, "uuid": "c92d11cc-ef94-4ab3-94f9-ac056ea91407", "comment": "Malware payload", "value": "107c73bb8fd99ae127b665e7dcf12eb09fede377e5d58ddb8aa23b5cf7a62a14a2e151c19891726ac676372207f7ba25", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774848, "uuid": "8c7b220d-4e49-4ea7-a244-6d41bbd6b262", "value": "T1FB05163DCC69412ED573D619C49A099FF8C25517223CE94B60C73B9BAF638827B8239D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774848, "uuid": "d9378bdd-7aa8-49a7-9ed2-fcf3e59d4ad3", "value": "3072:/fwhAfUQxclyBiDseXPMfuXGZ6wNFm1lBFKKGKhkVIsEHfxE9VQfprHT2zW0jaEd:XsQxcAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774848, "uuid": "5e8d1793-cf34-44f7-8a91-803b2c331534", "value": 795558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774848, "uuid": "b43c7c8f-f925-4147-bfeb-6417154f222c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774848, "uuid": "3bf99498-ebcd-4f1b-ab41-9b7a6ca5c892", "value": "output_a06iuuis.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c74825-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729247, "uuid": "3814b812-d840-49b0-bc1e-566ee64d09cc", "comment": "Malware payload (Mirai)", "value": "499b97481c251764779afa0df494ee96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729247, "uuid": "f3b69065-556c-4282-9274-421464c6c7c6", "comment": "Malware payload (Mirai)", "value": "034f4a5f2e6c2af3cd9f7a2b1f2ccfca4a88d1b7b098caec780fb03022e634dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729247, "uuid": "d9d27a1e-76fe-454b-a545-23854002f8a6", "comment": "Malware payload (Mirai)", "value": "625668a66f05c3e4d96b1350c8ebbd6c912f1e3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729247, "uuid": "a3136a2d-9707-4c22-a451-0a13b57c7320", "comment": "Malware payload (Mirai)", "value": "c50b7c26e9a145fc1a61b874cb982d18cc7c3bcd0c4e5e032ce8b7beadf486db6b95a804798f8b8f52d43814b28ccd0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729247, "uuid": "72ecfc74-7f70-4812-a637-4afd934388be", "value": "T18BC4D112F5318FD3C0160B7410E9E2344B5BFAE213726680F3BAD2692D42566FF5E76A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729247, "uuid": "a8b6f169-a19d-40f4-ac71-06c51bb39323", "value": "12288:mKz66Y6pkqFC3rcG7QTQRrnWRWtsFe8pNZcA:qrc1GrnsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729247, "uuid": "be26c9e8-7c2e-42f9-8cce-0a9073e0a58a", "value": 550472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729247, "uuid": "a1e94865-aa81-4cc8-8e60-899f856970a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729247, "uuid": "a5d7e91d-d9d8-46c2-9021-f9205816a3ef", "value": "kaizen.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bf6d9f-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771452, "uuid": "dde28649-73d0-45cb-85ea-6ec0d7bcf437", "comment": "Malware payload", "value": "efb764a7919d9983c0ee54b40e81feff", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771452, "uuid": "c45d4e86-5cc1-4fd1-a7e4-d326563a4bfe", "comment": "Malware payload", "value": "03a7b15f92c803535256f6efcb0db8b98fa2adef985d027121ab1d347fd9ae58", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771452, "uuid": "89ba6ef6-5b8a-4ca6-bbb4-82e33da8b4ce", "comment": "Malware payload", "value": "f94b3b73da394c53196e0bf6cffe02ce22cf98a5", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771452, "uuid": "b521ea39-9c54-4815-8f1c-c7bdbf7004a5", "comment": "Malware payload", "value": "40beafb0a31038f89de6ddceb3285cb895cfc15b367a957163a494fbc4436628d643ad8489299a806f590c4f7e7a1893", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771452, "uuid": "5fea5f73-e001-4348-bde8-826956ec3a5e", "value": "T12AB3128073AB938D813D1412037E39BC6B19A546FF56A16EE2904E4257A44CBF7E189F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771452, "uuid": "f95e83d8-f184-4489-b02d-4f0385dd0992", "value": "3072:RPrtl9JTYLeGRIth0l6/uDwDf+BKFpuqEHZg:pnGqXbWDE+BKFpOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771452, "uuid": "3ac79531-a125-4356-9655-54b8781f3f3a", "value": 107591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771452, "uuid": "48fdef2b-6a30-4851-92ba-3d79edb678ed", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771452, "uuid": "993d178c-189b-4ec4-a5b8-baeed2d7b46c", "value": "Request_for_Quote_Conversion_to_USD_and_Price_Validation__November_Quote_Attached_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0efdfd6-61de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774530, "uuid": "a31b31f5-53e2-4e08-b52b-61896a3518eb", "comment": "Malware payload (Mirai)", "value": "552d335c71480dcd71c0bfa379932634", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774530, "uuid": "e71e2528-618d-43c8-a895-4dac94a99ea4", "comment": "Malware payload (Mirai)", "value": "0464d1d248e1b12a39e4e43a84e5bbbb2d4726c5c1aafbb7ecefea334d1528de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774530, "uuid": "10a7a0ec-ae19-4ec4-a038-0bfdc5e544df", "comment": "Malware payload (Mirai)", "value": "6369679d9dc4d2bb0f76a791da6b23c3385b0f71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774530, "uuid": "2148f826-7f55-4221-89b3-6a09777bb058", "comment": "Malware payload (Mirai)", "value": "01ba1f070ad1c7553cf63ebc0be7c24e61ab141c23f8bde00e46c186ee1b7d967109c8c52edaaa0045e34396c9ac7932", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774530, "uuid": "86f84b27-3f11-45b6-96a9-26ffccc3cf2a", "value": "T15333F1309D9DB89827D224369494A38B63FD4BE951AD26303D20C1BC524BE1FA5BE5CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774530, "uuid": "e029726c-7c07-42b1-bfcc-fd0d7b2e1da3", "value": "1536:WhKzTmm/GJZBsyTHXGpRsnLkWhVv1OjcNcOz/:WhoaBJTHXEsn3HvbNFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774530, "uuid": "3b255d61-0e6a-4c74-9b1a-b16f7646319e", "value": 50876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774530, "uuid": "4a9bf1fd-485a-4b02-9210-efa346877e70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774530, "uuid": "41a1c0eb-cdd7-4e62-b588-3e2e228ad0f3", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6ff572-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759061, "uuid": "b6d16391-e418-4bee-8c64-558c5ca3c7ca", "comment": "Malware payload (Mirai)", "value": "d254c5465b144c229db42dfecc9751cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759061, "uuid": "a4a63e73-99a8-4b2c-8474-a1dcc404141b", "comment": "Malware payload (Mirai)", "value": "061e27e0e97210daa13bd25f0e9890ae201a2686660450c9271497b205ddb7bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759061, "uuid": "9707ca00-afef-4cdf-b43b-98ba598c289a", "comment": "Malware payload (Mirai)", "value": "5b903bbd6f742f437ee2b901afc822fa94ce5772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759061, "uuid": "3293ca4c-e135-49e1-822a-2217fc58298f", "comment": "Malware payload (Mirai)", "value": "e5fc7b0331347b007b009a357b5725df9208c8a300191faa853b72aec35f1d5f7f783fe0806b50aca125d97592c2e17b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759061, "uuid": "fb9d46e0-a915-4b1d-877f-472a48fc8b98", "value": "T1AC734B32BA751D27C4D0A47A21F30721F2F6478A25ACCA1E3DB20D8EBF256503647BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759061, "uuid": "b55a7ea0-6e05-4f9c-8331-0bb682b73362", "value": "1536:pBG4Soy5C9In2vUedOtBQGtg+KpRNM5FzvEYAdrdts8/XLC:psd09lUgUe+0RN8Fztcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759061, "uuid": "1fef5441-f778-4e9a-8e3f-896de7d38633", "value": 79432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759061, "uuid": "bca7b101-6173-48b5-8421-e7676c3d050c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759061, "uuid": "6287c3d7-9ca0-433a-b89d-1259699b8f84", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5451dbe6-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765705, "uuid": "1782bec5-1342-4176-8ba4-664e2fc0e958", "comment": "Malware payload (Mirai)", "value": "79c94c445fd4e819c214a54d34470b61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765705, "uuid": "1d986566-7611-4a00-a11b-99d6ad351203", "comment": "Malware payload (Mirai)", "value": "06662ba903df0638cfe4d0a59165f6c0df842e82ffe51f7e05e043aa7b1e2205", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765705, "uuid": "9c16be3a-bf0c-42f3-8c8f-058782ca6987", "comment": "Malware payload (Mirai)", "value": "1b6f2e334cbe31d7e56226b4cd3341d39f4641ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765705, "uuid": "e6b54737-2c13-4789-8619-141f7f8f9376", "comment": "Malware payload (Mirai)", "value": "4873773f3d086319fd4ff43a35b413a9c9df1ec595bb8ecc12aa6d15feb9d919d0db9f231a88a1e73c1388c792fe0dd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765705, "uuid": "4128b50a-5bb1-49b5-b09e-0a0e7c2d0362", "value": "T13C437219BF650EB7DC6FDD3706A91B0634CC641A21A97B397A34D818F60B21B1AF3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765705, "uuid": "40bc0755-3de0-41e3-aeee-c568b337a439", "value": "768:pInS8rJBHSvgv1EZMVWd8UuNeX5VkedeDbeL+E0nDZ6cYu7hPtsXiTexNIlbUg:pInS8NBrfNAQsibc+EKDZ6qN+IlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765705, "uuid": "c363ba8c-56da-46d1-b1ee-ea7088396001", "value": 59184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765705, "uuid": "a6677c75-72b3-4fb4-a27b-d7c705c7c812", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765705, "uuid": "d9b3d0e7-0e49-4ec0-83f9-8112107db732", "value": "f9460d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee967a2-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771306, "uuid": "d2b83549-27a8-4719-9e9a-440c22aa1e67", "comment": "Malware payload", "value": "f2f8fd226aafe72dd53c516ba8d26b00", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771306, "uuid": "784b9d2e-bcac-4364-bb88-e7608d1c5a76", "comment": "Malware payload", "value": "06fedd0f6fd4475f74abf8e829da0933f2a31613a0cda271339746a554da6ed0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771306, "uuid": "54d4d7da-d174-45a2-abbe-e02a6da739d0", "comment": "Malware payload", "value": "59db91952d34db61b0faa4d9e58df30449954f38", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771306, "uuid": "391f1cd2-7ce4-41e7-8569-d3a1f6f87b01", "comment": "Malware payload", "value": "b9c8110e010d70157f58851b0b59e4a58edacb8b702a4cf19399b6eadcba49d40b7e36a567372c6b1611e71c3c6475ac", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771306, "uuid": "22b53f48-b84b-412f-a8d2-acc5500d005d", "value": "T15CC2A33EC984AEF4071B62D2298F7E574A090712B674260DB8CED49D3B79361CBF54E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771306, "uuid": "3bec31d4-7a2b-4ae2-bb11-df1fdf0a9b37", "value": "384:Kln70jF2NSoUY59cr5j5jph35ZPM7625o4AilkqPLA13BCWkiizn//XT85Q7Aw:K1IJSU3959n+FFTAra/XT853w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771306, "uuid": "be8c3f0c-3680-4cfd-8926-08e51134de14", "value": 27868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771306, "uuid": "7c627f8c-7963-46cb-818a-af0169ccf78b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771306, "uuid": "62c094af-4b3e-4fb8-9654-02b06c068d1c", "value": "Document.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a3d26c-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780729174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729174, "uuid": "7867634e-2136-4e26-a7d8-3b7ecf8c5736", "comment": "Malware payload (XWorm)", "value": "f9a8f624fafe0a85a39b94afc8e6d62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729174, "uuid": "42b80f45-ff86-4392-b250-03383f0ed810", "comment": "Malware payload (XWorm)", "value": "07d9ba9b1da3f0b3b4b58323b4b0111f3ea713e5299b45240f0c8516842ac72c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729174, "uuid": "56a3fdb5-82f7-422c-9b2b-45ce883f7f30", "comment": "Malware payload (XWorm)", "value": "60ae2b6f503bb21b447556aab29b0919cdeddd8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729174, "uuid": "6e4898b3-0a0f-4d88-8519-0fe2ec8164a9", "comment": "Malware payload (XWorm)", "value": "505bb5d17c39b9384ed8eb21caebf95bdc1a931a700c9e64394b5d48cbf55797fc64a52d0b9a3bc433a271bff14f7db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729174, "uuid": "f5cfad70-59d8-4301-9559-b93d4553e8ae", "value": "T1E695CF0573F442DDFEABE1768A13C50BC7B278450677961F06A0AA766F33B711A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729174, "uuid": "94984cb6-861a-48c3-89aa-6a52a613cbc2", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729174, "uuid": "f1530add-9d77-4d1f-9462-39fd7f2fd586", "value": "24576:GCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrODPs1m8hDTckRcMf3S0AoW5FZmnvbo:N1H4jR2TYrQbDTr0Ps9Tcs4RFZmvSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729174, "uuid": "2391f3ab-bf96-4610-9b20-03ce7c5b9a39", "value": 1905152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729174, "uuid": "89a01ad7-9bc5-4e91-a45a-6bcccf127b96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729174, "uuid": "895e1678-d6b1-4f7c-9869-e95fcbf83750", "value": "x07d9ba9b1da3f0b3b4b58323b4b0111f3ea713e5299b45240f0c8516842ac72c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc52b28e-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709669, "uuid": "2563f3d8-8705-47c2-bae3-bce7777663b9", "comment": "Malware payload (Mirai)", "value": "ec0685c9a406768040432f64c298cf7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709669, "uuid": "02a83c86-8abc-4cce-ba07-2f69a4f0c689", "comment": "Malware payload (Mirai)", "value": "084aea7560e0aa3b8e5a07b8060b8ee39e31d21d46e9dbec0daa5eae094240e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709669, "uuid": "0cee301b-fd57-4a73-accd-10b519e77410", "comment": "Malware payload (Mirai)", "value": "9fc17dd8370c15533888c49b3a7868a22a0a5b9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709669, "uuid": "0ba59158-eb03-4b42-b7b7-29103c285c8e", "comment": "Malware payload (Mirai)", "value": "924991ae2464eea3f6c1338c73ae224fa03b9a222c877bcf569a63b69adf5b6ce900221aef263b0054001d7d609745b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709669, "uuid": "1b847ac2-43e3-449a-9a39-b3e88778433e", "value": "T132C32A16B992DB12D1C311BAFB9E514D33132FB8E3EE32129D106F64678B8DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709669, "uuid": "9ac8be0a-3516-4002-a90c-7a4d7fb9b6cf", "value": "3072:3kwVQKYloLdvNPyYbdVpPgG3R9aSgZyyzc3iUpGwfK6:3VXYyplaOXp4G3PaxZA3i0fK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709669, "uuid": "fa5bf701-90a8-4a2c-b28d-ba0a68e95a39", "value": 122160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709669, "uuid": "93f143ae-de38-4577-907d-24485fa51205", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709669, "uuid": "59552e29-c656-4c21-a08f-5b556bf372ef", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d031a5a-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709428, "uuid": "6d78a05f-435b-44ea-961b-c1b5dcea8ee6", "comment": "Malware payload (Mirai)", "value": "308275addf532284e4eef53d0127900a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709428, "uuid": "fc189ae6-f98f-4f7b-9f60-8b4ffb09e765", "comment": "Malware payload (Mirai)", "value": "085d607e014e313a7e38eb2b5ed6a8b1872ae86b4a8f2bc3a61c18ae509e6e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709428, "uuid": "916cf407-7e45-4f85-b893-4cf14e9f5c22", "comment": "Malware payload (Mirai)", "value": "94f18c6eebcad19f26241c83f9666b0fad2960c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709428, "uuid": "07badcef-582d-4a6d-b90d-b1d77df8168b", "comment": "Malware payload (Mirai)", "value": "401ff7c251d9e1b14ce8236b6f924d53362bb30973bd4a54e8a9006940dd669daab273308ed89934b9da3e909c117cab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709428, "uuid": "6f6ba949-549d-43b8-a3ca-5dd40bf918de", "value": "T189A33863CC262F58D664D5B4B0B28FBD1B93996081475FBE1977C2748083D8DF98A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709428, "uuid": "3dcbc227-3775-4a64-83a4-bfd3ac9d95d4", "value": "1536:r/aMtaac+ClPK4Q1T7Bs6Z6mSdvk+qPt4WJ/LeMWZic8:uK3c+R4av0mSNXS4WxLebp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709428, "uuid": "7bc30e9a-2fa9-47ea-ae11-c2116e63736a", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709428, "uuid": "f72d66d0-0606-49fb-95ed-66a306b963cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709428, "uuid": "cd92a187-a646-49c1-b2a5-18fdf0bf3331", "value": ".Sassy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84826e7c-614a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780710810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710810, "uuid": "356e99d5-3627-4422-b884-3580f0728017", "comment": "Malware payload (Mirai)", "value": "3e59d41da4cf08d890da2c31ad963ac5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710810, "uuid": "ba4e8b87-8be8-42cc-b48d-1efd96c5b4b4", "comment": "Malware payload (Mirai)", "value": "093315f3a1181f0489de6121c6db79237925f840c0c2d73393ab5e3d2e4933e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710810, "uuid": "d374dea7-ca22-495b-9165-46f370dca4f5", "comment": "Malware payload (Mirai)", "value": "717f89e6ecbe73c41fe0bf6207c9492039916ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710810, "uuid": "dddc6074-65eb-4a98-a43c-2b41e0601b58", "comment": "Malware payload (Mirai)", "value": "66ec41a3d1cf7ddc1fc48cbbaebfe9ff99bd27ab781e32308692158fefcc96ccd4567dc8e2e1934e8a2e594add440e26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780710810, "uuid": "0cdd3c65-31e1-4aeb-8ff9-d37ad2b9ccc2", "value": "T137E33ACBF800DDBDF80AE73B48530909B130BBE155825B372257797BED3A1991927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780710810, "uuid": "91b0e539-c52c-4e13-8829-fa6ee13173b8", "value": "3072:HeC3KxrfyjjpdIWqvQcWkdBVKjbieLXFfBGGCOrsa:JIyj9dIWlhkdqLX1Fsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780710810, "uuid": "563af739-d298-4329-9f69-b92878e8795b", "value": 157152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780710810, "uuid": "2775594e-3c85-4d50-983a-9f9ecc8810cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780710810, "uuid": "b4e9715b-2a9c-4fe5-8d59-51c57dff0642", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b119fc-61d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780770718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780770718, "uuid": "bdb81b1a-2196-43c9-a1ea-2cd1826d3f5a", "comment": "Malware payload (Mirai)", "value": "0f15107c909ba5ddd11bc98a62ba46b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780770718, "uuid": "8dfe2359-8585-4bc7-bf87-da87b2be6e7d", "comment": "Malware payload (Mirai)", "value": "0a05943725ce56a1cbc57ec8543f771b265426e9c9e0e014aeb1e76ab123fa73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780770718, "uuid": "e31fcd9b-acb1-4821-b57c-70fd10361259", "comment": "Malware payload (Mirai)", "value": "aed44aec43301f7d00f65b395de0f0c02fd5bf03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780770718, "uuid": "657ce3d0-0b9c-4f1c-87e2-f2f7637212e2", "comment": "Malware payload (Mirai)", "value": "21a55cb1565f8b59396c03e763e85dacb456b60e2527e2b387d751a57b3933ba96f8b833f02cc39e82d787f53468b861", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780770718, "uuid": "e7a44497-65c7-46d7-9924-ae20b784d861", "value": "T146E35B0A79D270FCC687D17092AE9F21FA36745C02183DAB93C2AE711D36ED16E15E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780770718, "uuid": "8c22e984-4a7e-4b2d-8923-f0eca6a05132", "value": "3072:Fp7XN2ReAJprxZuIcrauX2oc/pPXyps6TOYrFjY:FVXQeWprxZuIhvypswzRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780770718, "uuid": "1848195b-0a81-4f52-ada5-37cb47c418b6", "value": 144416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780770718, "uuid": "0cd523c6-085a-4eb8-baf4-943df37d8272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780770718, "uuid": "b80fd060-2534-4d43-b92d-afc99abc1b89", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0d8781-61c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780763307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763307, "uuid": "e1ed9b50-d09d-4cf8-ada9-0df90e702433", "comment": "Malware payload", "value": "5cd275954176ea0590a2fac2eda9dc12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763307, "uuid": "47884d09-4d42-46a7-8259-955ec26a6fd1", "comment": "Malware payload", "value": "0b1164aaa84a6d513e2d7de599342516dc5bc8774b8ba0a009284de1eccf0b48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763307, "uuid": "fb3f93ea-969a-4c4a-9362-9ff24dfc998b", "comment": "Malware payload", "value": "8e3ffd6b68de784789ca957a399d830c5288d2c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763307, "uuid": "8c1e0f5c-2ad1-48c8-a432-00503dffaeb8", "comment": "Malware payload", "value": "6a0908279e9d006d7024c30e30086743fe569a1c0e382acdf386b73fd8b8c18240e926394914eedb3bed39568ce9a422", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763307, "uuid": "df509854-9c79-401b-9601-c32c1378fc91", "value": "T1C2E31806770D4F43D1432DF0377B1BE1839BAD9228A9E684750AFEC992B1DB26506ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763307, "uuid": "c376ce24-accd-4884-ac80-c1410d64d1d8", "value": "1536:vGuDqzMP8AzX4XxVr1wjrkKoAJjEJ2WUGCCFCB2GhYVrPn9LKvAp0s4N313JlScH:fOzeh4Xx8jrkMlEJUFCF2OVr1zp7S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780763307, "uuid": "67d8d3aa-8c9d-4edc-bcd8-2b0d537ef54a", "value": 151356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780763307, "uuid": "0c8d4335-4790-4c76-93e5-c6418a33cf50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763307, "uuid": "4ddedaec-89e0-47b3-9a71-c3a4c8563cc0", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6106be09-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748117, "uuid": "f2f5a00f-13e4-4a34-8708-0151d5e4126c", "comment": "Malware payload (Snojan)", "value": "9d1efb837be5c0957edc229cf31742f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748117, "uuid": "efd062e2-8514-494a-8798-1a51c3b3d7ce", "comment": "Malware payload (Snojan)", "value": "0b1aee2ec8ea6c68421afe0034137f85edb786ac37e801157481f8f006df4535", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748117, "uuid": "fb389c5f-0e08-4aaf-a714-6f201b219592", "comment": "Malware payload (Snojan)", "value": "597a78b6f66e2d15c289aa79615b936007f3eb74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748117, "uuid": "30407a92-e1d3-4cfb-80ea-a80ae3ef91e8", "comment": "Malware payload (Snojan)", "value": "d4acbb4e8276c86623967069690f260064e05ef83ed24dd73a4ebb224203b6ff48d5781647aa9cae2963f8f7faf9fc31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748117, "uuid": "2b38d762-f7db-4ca2-bccc-39831a9aab95", "value": "T18584F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748117, "uuid": "1f3fd55b-8b2d-4917-950b-4e452d1f8254", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748117, "uuid": "70751028-452a-407d-8970-80f65448b2a2", "value": "6144:NrFZaaZmEJu2DKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uwh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748117, "uuid": "3d48de2e-72cb-4475-91aa-bcdd9f82280f", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748117, "uuid": "f8da7e81-f739-4c0a-a4f2-e99b5bbb0bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748117, "uuid": "f1d1bfd1-5e35-4ae0-9bee-2520ee68ae55", "value": "I48b0FOnTEpradNs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f55926-614f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780712752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712752, "uuid": "c8d6c108-ef74-4292-97e5-a60ae2add03a", "comment": "Malware payload", "value": "fe485021400a3effa1ecd5d4d8e09112", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712752, "uuid": "a0f2beb7-26c1-4cfa-87aa-405639007f4f", "comment": "Malware payload", "value": "0b25ed4bd4da2173081353a606216a18d7aa681a573f88e8c5cca1ee4166ddac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712752, "uuid": "e7b6105f-c116-4cbb-aa17-47fe5f679ef9", "comment": "Malware payload", "value": "f1e4f6a3ede3b9f08d3a3b264ac618412a7ce50f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712752, "uuid": "195beb6f-f296-4e66-9033-ba67b8e86b7b", "comment": "Malware payload", "value": "f992dcc1bcf77e4b95ee2bbb9bde7fd3a32c01035c338c3d3a1bfd765907e505c4607eb461a13803791322010c24c583", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712752, "uuid": "35ca198d-6b94-41fe-b7ca-51d44cd72be3", "value": "T14466E905AD843BE6C42C4B7440EECA5623B45E140AF2563676A5FBE9BC762397F43C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712752, "uuid": "5506c24c-c3ff-46e6-9e8d-74a3be77a89b", "value": "49152:KS8t/QzJNVkSs1smE7BSv+h/uKb1qjYee6VQ8kwm5qKmyKEg5EP:3T7BKW6VjEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712752, "uuid": "a61f37af-c05a-417e-986b-47d7f46fa4fb", "value": 6815959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712752, "uuid": "6b59f572-a8be-49e6-94c7-c8132fa0f3d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712752, "uuid": "641242c4-d516-4520-9de0-7639691d6570", "value": "SecuriteInfo.com.ELF.DDOSAgent-FN.41222393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752d7a54-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747291, "uuid": "bcff0f24-cf88-48c5-b8cf-6db7678da9ce", "comment": "Malware payload (Snojan)", "value": "60feefbc37b314f0809dbb1706f9769f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747291, "uuid": "b3c163b3-c5d5-4e83-8c76-710416269823", "comment": "Malware payload (Snojan)", "value": "0b8975b0a7bdf5b301359e029495f9a36f83f2da161e2f804858d4b0ece79e77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747291, "uuid": "8db774c2-9975-44b6-adc7-482f8d97d76b", "comment": "Malware payload (Snojan)", "value": "ebe9100d742a964a8b32b1d8129144cb1e8d3dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747291, "uuid": "6510a18c-bb30-43dd-a855-7d5d3d51811a", "comment": "Malware payload (Snojan)", "value": "af61a0d9a59e0039a10b02994f1902935d5ef004ac57df27b34901d5629d8ea88b780a6e7620f2eaf70c62776e136cd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747291, "uuid": "14a29fcd-f463-4634-a2fc-a2a222f1c07d", "value": "T17BF3021646DB58F7E49B12BD469D9063B2FBA06F4BCE3EDBE1FC224DC6062B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747291, "uuid": "af73cee6-f421-4c48-99b2-00892f0dd303", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747291, "uuid": "32692263-473f-4bd9-9658-7be5756b39ac", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+RK:QJ0TAz6Mte4A+aaZx8EnCGVuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747291, "uuid": "7676f498-dc7e-4405-8597-c6cebaf47914", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747291, "uuid": "d9038b6b-4a23-4a21-8aa0-40ce2abfb781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747291, "uuid": "6371f881-a122-4fb2-a30c-6aae0d204bff", "value": "DvtSRD8d6icU2GUN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17709a69-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780729095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729095, "uuid": "d8254577-cd5e-478b-a3e0-58edd7dcd07e", "comment": "Malware payload (Gafgyt)", "value": "7df8d5da009a5a00d9b90b199b5a8033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729095, "uuid": "0c87aa95-b3c5-4118-9283-a80594a7ac55", "comment": "Malware payload (Gafgyt)", "value": "0b979a71b7eee9cfb5506d00c4031a7a9acda8493b37116eacdbfa7cfc1b9227", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729095, "uuid": "f44bedd0-bd11-4f3a-8be1-579f719201ad", "comment": "Malware payload (Gafgyt)", "value": "e868159e3900d7d674aa4c2d79e0e34d1b01b1cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729095, "uuid": "1c918873-f8fa-471b-8fd7-4bef60555b47", "comment": "Malware payload (Gafgyt)", "value": "c24ab2a43ee481ac96897c08218ae308ad4e23107a1d16ce1512b99c05c38743dbc1fef91cd2acd4b162e7baac7cd6c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729095, "uuid": "acc45d48-f309-4af0-95c6-10543fede226", "value": "T143F2E15253D29754E868D13B145B7E0AA851F31EE348740372EC7A3EEA63B36172E363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729095, "uuid": "34a601e8-d1a4-4a26-8541-5e1e7a16f763", "value": "768:XWx0Xm+j8vtu3FrLowNjCpdZbPB7Nh+ES/PvLprSY7PEnbcuyD7UWyqG:XdXLj8ogwNsbPB7NcHvEY7Mnouy8NqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729095, "uuid": "18458c43-741e-4a85-b773-6b8a05ee58f1", "value": 36780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729095, "uuid": "045c7782-f31c-478d-80ba-a9574f4dbee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729095, "uuid": "8e6b0823-f9f6-4624-91ca-7349f1d13697", "value": "I586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72bed40-6180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780734168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734168, "uuid": "2d40e5ef-ba4c-471c-8f3c-00cc392465c3", "comment": "Malware payload", "value": "c993fcfe6822a60677415e6234f74b49", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734168, "uuid": "6f8e8d6f-35b6-4fff-b484-c4e7c498e08c", "comment": "Malware payload", "value": "0c9b6e97a2c6d3b1eaa1c5eff2f1d90bc18036f5880d164c9aad3282c33e679f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734168, "uuid": "53f9b68b-022f-4234-9a03-21cb0f2d8ea9", "comment": "Malware payload", "value": "3c94f6447ca36cb8e8071fbaf6347aaf85a0924e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734168, "uuid": "09f6ecb0-458f-43c0-b5e4-8ab952240462", "comment": "Malware payload", "value": "7c58f4647da4bab7d6e46185cf7863efd7703b08c3f7e43341684b0dc21193742b7583b9d61b2d012678b88737af9f71", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734168, "uuid": "96a7a352-f09e-4468-94d8-95d6516abbc1", "value": "T1A4D2DF34C4D83FBDEEAA2A1C06FA6A20D7D68B1E9498860637077D9B4F37C80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734168, "uuid": "7b05d86a-d347-4ffc-bd25-ebc793283227", "value": "768:UumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Uu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780734168, "uuid": "ee1075f5-5e31-4924-bac7-ad89f93c9d73", "value": 28665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780734168, "uuid": "47852b3d-2e0a-489c-88d6-6b8b218a8fb9", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734168, "uuid": "d3a8ed48-9bcd-412b-8a73-eb860f6626ee", "value": "23.94.110.24_1780734104082247_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af6ca28-617e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780733128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733128, "uuid": "aa83cf7f-c403-40b5-82b3-ed30c191b07d", "comment": "Malware payload (Mirai)", "value": "e3794e45ff05b622c3a8e38d908b1d85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733128, "uuid": "f1aa8a83-8d47-4c67-a407-f4ee16db32e2", "comment": "Malware payload (Mirai)", "value": "0cd6e547b20a56b6acde99492b278af3812ec4b9328eb97784d3c624f3f5c3d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733128, "uuid": "45e9289f-2efa-461c-9340-8cc102277859", "comment": "Malware payload (Mirai)", "value": "2632c59cad01a5508f3399ceefe9aada3b0ff2d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733128, "uuid": "b291b9e3-9617-4869-af59-a22031096f57", "comment": "Malware payload (Mirai)", "value": "12e4fc7c5cc76df9e2b8221c4ac156296b8bb49fc76d8131679c73c22801d0e3083e060702c5e8f28b010df6b4915a46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733128, "uuid": "133ea849-cf9d-45e1-8dcd-b397847a313b", "value": "T11323F2596B563ED28224087F492691C4C23737F8717FF5B52C610B2A258727FB9B8B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733128, "uuid": "93ba5856-be79-4367-83c8-77b410420e3a", "value": "768:0JIYiG589TrHdWqq1ItirYQWVJVHUVBLpx5X7lS4w6MGRzpeVPVscESw2hPnIFWg:0J8YlCtikQSJ0jx5X7lS4lM0gISlIc03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780733128, "uuid": "c0b50388-b87a-4a4d-857a-753797ff1d6a", "value": 48548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780733128, "uuid": "6ca26687-4ec7-412e-b310-29e5a06d05cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733128, "uuid": "8463bf65-0447-4071-bff7-ec3b4a4419e2", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1f2e75-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759062, "uuid": "ba50e102-8e7a-4289-863a-5951533e9f2c", "comment": "Malware payload (Mirai)", "value": "71042818a46f5b452cbc44622ac80d80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759062, "uuid": "81da3b26-9d08-4a17-98a9-270bb15f89f8", "comment": "Malware payload (Mirai)", "value": "0d15fb0861bfba3672af309c97476da396ecd5fab4861be5e5af536bc9043884", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759062, "uuid": "66e17cf8-538e-4ffd-a4ba-92164f6480ee", "comment": "Malware payload (Mirai)", "value": "5992fef9c07c20401fc32809bca87e5bb1fc1bd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759062, "uuid": "fb1f4330-5e77-49fc-a9ac-78747563faf4", "comment": "Malware payload (Mirai)", "value": "75a31b314ee490e09f6f55bf216e1ed634ab38d1873d326e1a906c6b44dfbb0ffd2b41e4b5a65543998175f9196377e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759062, "uuid": "3f017a79-3da7-41ba-83fc-ad0b6037e189", "value": "T164833AD7F801DDBDF80ED77B4453490AB270A3A516831F3A679BB953AD361A40922FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759062, "uuid": "d4a0b43c-c6c8-492e-827e-324a8e1dbc70", "value": "1536:NR8oiUuDOmKAMPqgbH8NyoSFeNLqNan18zc6N7/6tisg9CVCnXyg:NR8yaKJPqgbAyoSFSfn+zcK2g9C0Cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759062, "uuid": "42bbbc48-9d76-4133-81c5-5f8a075134d3", "value": 82924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759062, "uuid": "41fc515a-6096-4308-aafd-0ff8a9c65b1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759062, "uuid": "d3189e3d-c08a-4b73-afe6-afee0b21dcb4", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283c0c7f-613c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780704642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704642, "uuid": "1b60b593-870e-4716-8cc1-4015a1d822c5", "comment": "Malware payload", "value": "97e7c9f57bc0173580efbaae8d6d5403", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704642, "uuid": "45322361-71b2-42c6-b75a-7add1d705ba1", "comment": "Malware payload", "value": "0d8e578a63f4dd978ba7ed65d87ac66a9113094d56985f9faaee208bbd4be915", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704642, "uuid": "ff626b0d-acbf-4521-9d6a-06a7ddf85ca4", "comment": "Malware payload", "value": "cc7629925d0a7085bd0e963d8fe415b43ea536ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704642, "uuid": "b895a408-4a24-4136-806f-e957fc3bac00", "comment": "Malware payload", "value": "016d9891600b46bc0ddde5d275998c9a354d0154014cf11957b5362c943e1db3f6fc2c841e6139df714ab5a594ca0cbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704642, "uuid": "1f794961-0a45-404d-ba4b-5121113c9f0e", "value": "T18C6617133B28E75FD228223458B2CA84276A1C8645D79917B395F319F9F20BC996FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704642, "uuid": "7fea8cb8-6e3a-4613-8c42-3284508884ec", "value": "49152:0NvqQLy5ZuKMFHICutxp8k0Irz2UK9YGPpK3e8y1cJF0KXXjqezf0GmM8YZF/la9:008h8+Lg0GmM8YZF/lanEjEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780704642, "uuid": "24d82bfd-1a55-4b5b-88e1-f30814d09e9e", "value": 6553815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780704642, "uuid": "d5f2d078-1b41-4e2a-b3db-1bce7d7b3b4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704642, "uuid": "a37a8285-cc14-46e9-916d-0970eef94cd4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e4f51c-61e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777899, "uuid": "43ac4e7f-ce8d-4bee-93bf-1845ab42b815", "comment": "Malware payload (Mirai)", "value": "2cbecfb48bf7e2328d3f1643af2552ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777899, "uuid": "dae74497-077f-4d17-8bd3-63c75a922dbe", "comment": "Malware payload (Mirai)", "value": "0e8f86b53eeb7b9a1679c51a0d376ac72558adeb539cca80426f940dbba40726", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777899, "uuid": "d1c8e34f-114b-4d09-92f7-7d00279b5533", "comment": "Malware payload (Mirai)", "value": "25f56f638f7b151aaccb3f9f246560bab9680c28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777899, "uuid": "00c9edd7-5534-48dc-892d-3933eea2645a", "comment": "Malware payload (Mirai)", "value": "cde76b200e166f3a68f9036ae31fc1f7e45d41329f72bbaad953edbed27ab407bdbbd66d0217085eed1e5ff970db9abd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777899, "uuid": "dbfc042f-bba2-4b6a-b3f0-95c27e6db905", "value": "T106931986BCC1C612C5E0A1B6FB1F91CD375643ACE3E67103CD19AB69674B8A70E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777899, "uuid": "30c1297e-82ba-4ba6-8fe9-b4c8e2cad3db", "value": "1536:28OyBGhm0FLn66rGD+zoGM6sWFMaqDacvue1MgnPoSvu:289sm+LFCD+0Hr2cvueKxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777899, "uuid": "ae1cc3d9-1607-4cdd-8a8a-33027006c374", "value": 97084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777899, "uuid": "5cb7ae4e-8942-4a1a-952a-4306975415ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777899, "uuid": "87737e37-d3fb-452e-b595-c5a3f164f0f3", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5882d115-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765712, "uuid": "2da1c373-b300-4ab3-a78a-34d7eba032d1", "comment": "Malware payload (Mirai)", "value": "1291821014ad12cee9ab28c9a678fa23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765712, "uuid": "f9207f38-646a-443f-908b-448c7911d09b", "comment": "Malware payload (Mirai)", "value": "12283c0fc21a542597f32acb609620860e25fc2edf31e919ced80d1a92680a24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765712, "uuid": "9dc31b0a-d55c-49f8-8dd9-05d128b78c23", "comment": "Malware payload (Mirai)", "value": "0df4f2d4e66b104747cd16d88878e1108b884c1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765712, "uuid": "14d752f5-6d97-4205-a8fd-387e5b2883ca", "comment": "Malware payload (Mirai)", "value": "827b7f56caadbfdc4135d5b58eb08ae10bcaf353074f1797d8de2555905722719dd116030c4c1fa3f8953fad6b28a3ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765712, "uuid": "1899c8e3-bb1c-4a90-86da-061555d9f929", "value": "T1C513F817B98280FDC4A9C374073AB63ED53375BD0239B2B63BD8FA16E986E214E1D544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765712, "uuid": "5d7d495a-82b1-4c32-89dd-3fe5578ea390", "value": "768:4uH7tP5xT1g3TRtkUWOKNMa+LevPyGHPdUUXU8Nt:97tP5xTKttk/FWa+LMLdW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765712, "uuid": "9ba431f7-024a-4d55-84a6-6b6977c48c2d", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765712, "uuid": "0167cffa-bcc6-42b2-945d-0e4b95345e64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765712, "uuid": "61037707-792b-4167-bb24-da3ece36f752", "value": "2fc2f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186d896e-61e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780775912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775912, "uuid": "23a710e9-b89e-4d33-8b79-b141391215ff", "comment": "Malware payload (Mirai)", "value": "2202b51d149521c9784a7cdcf8a330c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775912, "uuid": "08e0327f-5b11-4bc8-96dd-a61a9b2ee01f", "comment": "Malware payload (Mirai)", "value": "126a3f21afc54d71b6ec95a299db649d0716a5f3796fe7740195e795900a3b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775912, "uuid": "210d438d-101f-4cf7-923e-68ae2a5687d3", "comment": "Malware payload (Mirai)", "value": "5038c19fff5c2f643379a6167ac1bb2855a7135a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775912, "uuid": "e43a0701-bdf3-44a0-805b-c9841cbacefa", "comment": "Malware payload (Mirai)", "value": "344a83fba9e0013af773aca73e3f96ec3fa90d934e1f468a200ff346a660987f9107840a2ceb3a926d0620ee829be8cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775912, "uuid": "56521059-1187-44c1-9800-a97e8fe141e6", "value": "T155A34B11ED75583BC5C0713B51E34531F5B743A929BC8A5E7EA31D9CEF18220323BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775912, "uuid": "f413a9e7-0b36-4557-aef9-77db1436c773", "value": "1536:qRgjd2aWyX7N42F3ryZyIyRogYXGqlFRHoHq4U7OANWZIUGgf0JMV:SuZbNF/XGxN7VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780775912, "uuid": "12a61b36-5d92-4dfd-ae51-ff6014f05ce9", "value": 99988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780775912, "uuid": "7b428ddc-d152-46a2-a0ff-fff81382ab19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775912, "uuid": "9888f882-42ec-4320-baad-ee61633664fa", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7226def-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771454, "uuid": "b6ce31d7-9d71-4e0f-82fb-3a3c4cf8b5ef", "comment": "Malware payload", "value": "d0e8f86f75c0da359e63d165733bbb29", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771454, "uuid": "c710039e-c2c9-447d-9185-c44b97a26746", "comment": "Malware payload", "value": "12a05db31fe283f505bb7fbf057d0e15cf1db20b7e4b52a516065cdd0b54d4d0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771454, "uuid": "04bd46e7-063f-47d1-998c-8fa9bee68153", "comment": "Malware payload", "value": "ce204d699603a7bacd08e0c64a56198368ed5592", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771454, "uuid": "5f647258-4aa5-46e3-9963-4b1deda4cc6c", "comment": "Malware payload", "value": "2253bc9f0d983582cb1a375aca532b152a449d58f5dd4f5f3943581d7e17b9abbf500226512242dbead8b127411d0fb0", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771454, "uuid": "666f6f73-8df5-46e2-bb66-f9e945f8850e", "value": "T1C9F1AFCB96113595DBF7E493084EDA36640A2C0D980A8207FE4706BD9F52FF308C86F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771454, "uuid": "b5e449a1-8413-4e27-886f-ce9270632e35", "value": "192:WNstae7FNXNA1LZaBNOy2r2cWlS4KdVhT1Z91Lx7:WNsFNNiZa/+2cWl2NZ91F7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771454, "uuid": "412889db-d3a1-488b-9f36-04a892a94287", "value": 7476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771454, "uuid": "614388f3-f4b4-4f70-9438-706c4bfb222f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771454, "uuid": "b22103de-f145-414a-87c9-7e0dae9d9f73", "value": "Swift_00023140kX.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c00eb4-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748098, "uuid": "ae914079-055e-4fc7-9a0d-af95a282e375", "comment": "Malware payload (Snojan)", "value": "efe5f118f3ba7d7882f0987aedda6631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748098, "uuid": "a88f71fe-e2c4-428d-8ecc-2181976682c2", "comment": "Malware payload (Snojan)", "value": "12cdd6adb956c355d4ed8f24448a436a38c96a3cce2526e75cf288e922fc2676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748098, "uuid": "fefa238d-c703-42a1-8a63-55407ad9cc5e", "comment": "Malware payload (Snojan)", "value": "dc497caa66fa82b7193543f9fca80ddb41f7baad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748098, "uuid": "3ff6b2fe-5a7b-4983-9c75-483324f2662a", "comment": "Malware payload (Snojan)", "value": "2f12c4099c78599f959c5f659d418b25a663d52b800be05bcad4384b4c3fa409600209d4b4ee483604ee88bddb99bc13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748098, "uuid": "ef5ccfa5-2056-44cf-aa9c-0a42b11ed962", "value": "T15F84F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748098, "uuid": "34d2267e-8db9-47ed-9700-03e0c7eceb27", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748098, "uuid": "237c5676-a931-499d-9a6e-3456c049ed33", "value": "6144:NrFZaaZmEJuoDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uuh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748098, "uuid": "3e7f0c1b-23ad-4115-b542-87a730906671", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748098, "uuid": "908a4359-c1d0-4961-a528-a08db29225c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748098, "uuid": "00d7fcbf-d831-416e-915a-f14b9d8c7859", "value": "FPrq1CmGnmkL09BZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d469eb76-6183-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780735425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780735425, "uuid": "a4879313-cb6f-4556-9bed-d972410d0585", "comment": "Malware payload", "value": "d384bd703c5f6936a01f488de2ec06a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780735425, "uuid": "df898fe8-5160-4489-84c5-36b2bb7f2d99", "comment": "Malware payload", "value": "12e9a971309479b7bc4aeff093b3baa0c06815700ad5f973f390f14afa88f2f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780735425, "uuid": "e852356c-a05c-4bd1-a305-eb2c8fcfc4a3", "comment": "Malware payload", "value": "2d7843cfd8827b09dbed5b066cf94f2fd42b552a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780735425, "uuid": "6b5b0ce2-79fe-4842-8157-bb7874cc147c", "comment": "Malware payload", "value": "930f465e15b6d25e3abc9fbd9cd8c168991d04b520cbaf244ecd7478156f88c9fc0fac1b8f0cae66fa3a35c9d4471407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780735425, "uuid": "d2c8ea2f-9a91-48d0-b80f-a3b184459477", "value": "T16367CF7791067CE9E9A94DB4841015816D787C874B78A3C7BAC8B1FA66FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780735425, "uuid": "b61fa4e5-a6e1-40c3-8d43-dc18cecde526", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQM:cqYUQuVDt0TZEAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780735425, "uuid": "76b25a48-1b95-4879-9fd1-e9841993cef3", "value": 30113792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780735425, "uuid": "8304619c-e6bf-4668-be0a-53bb9955322f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780735425, "uuid": "755adbd4-fc07-4ea0-bbcf-94fe17f7e9d8", "value": "12e9a971309479b7bc4aeff093b3baa0c06815700ad5f973f390f14afa88f2f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c34bdf-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748091, "uuid": "2941232d-6be4-4182-9a9d-ff0c25b29985", "comment": "Malware payload (Snojan)", "value": "8d12cfeafb64c103af04202244cf7674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748091, "uuid": "cf146b4a-2ec2-4bf8-b64b-5c19539e9f79", "comment": "Malware payload (Snojan)", "value": "12f8eda608964b0414e980597d288aef0da21e6f6ee2080f596431924583ba9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748091, "uuid": "aa5ffd32-e70d-47a6-9a9d-4c48a7c9793d", "comment": "Malware payload (Snojan)", "value": "65ead2bbded2e753a446c4f37c0b0a1ecc3e580f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748091, "uuid": "7e873f52-7d91-409a-9f14-7b25eef14c22", "comment": "Malware payload (Snojan)", "value": "8a16ef9c70db89707ad9db402e55c73726af46af3aec824c5f21fb98856ae8a0c77b56c99df46a87ea48e1daa6277fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748091, "uuid": "6c824a88-ab2d-43c9-b4a6-ad5eb816195c", "value": "T17DF3021646DB58F7E49B127D469D9063B1FBA06F4BCE3EDBE1FC124DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748091, "uuid": "e6e021f1-5b55-40db-8236-8c9441b8fbff", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748091, "uuid": "19938539-f9f1-4280-88c6-1f7616367d83", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+AK:QJ0TAz6Mte4A+aaZx8EnCGVuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748091, "uuid": "8ea4875b-3053-451b-9ad9-d1bc9f5258fd", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748091, "uuid": "0bd43ca4-f164-494b-953d-ba649f636748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748091, "uuid": "8b3094af-de61-4268-adfc-530014da6ce9", "value": "EapBctuJZ290vbz2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbb41ea-61d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780769636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769636, "uuid": "b134b6d3-204e-4084-a337-c50aed70508b", "comment": "Malware payload", "value": "f8700e49c078f1bea6b1efb67cc3ffa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769636, "uuid": "2833c063-df15-4b71-9a25-9d0d8547080e", "comment": "Malware payload", "value": "1388fbdd71a44e3726852c002e2abfabc114575d951d7e702db3bd8fbae61a05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769636, "uuid": "71c0965b-ce12-4eed-82a5-c3e1aa1af92e", "comment": "Malware payload", "value": "7fe9f047a7195d713245d0ac644c3115a7c9556b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769636, "uuid": "a6fe4472-b074-458a-a482-b8fb489353e4", "comment": "Malware payload", "value": "6901571133803dd51c756df7ff663a70f8b0da51b1ecb85ac447749ee303187658ea00cb5d6fb70c38ac60e28fa589b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769636, "uuid": "5eb0732f-1b06-4c8e-9a2d-a63628660e31", "value": "T1B0160973E59445E4C2EED174C6256213BEE0389B273423D77BD0A6E10B76FD4AAB8360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769636, "uuid": "a221a7b8-00bf-4b54-a71c-d4a4d608e4bf", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQy:cqYUQuVDt0TZE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780769636, "uuid": "9c58e7bf-8bb6-4e54-bef5-86a6ca197117", "value": 4030464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780769636, "uuid": "458ec94a-c0fa-4275-ab69-52d3427402e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769636, "uuid": "4bbdf6b1-cdd3-493d-a3fc-9add4f1fddd3", "value": "1388fbdd71a44e3726852c002e2abfabc114575d951d7e702db3bd8fbae61a05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec60df6-61c4-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780763306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763306, "uuid": "ae3c5f26-f55f-4a66-8fbe-bd22c9b970d1", "comment": "Malware payload (ConnectWise)", "value": "c7aa65f1a4fcc0039c6a990edee20b1f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763306, "uuid": "e5a77c7e-97cd-48fa-aa48-5d3fe9c0e479", "comment": "Malware payload (ConnectWise)", "value": "13e27ce4d1be66fbb51edbb0d7721e11cb0b42c76610fc393c02a792acc31e25", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763306, "uuid": "6371d367-3d79-4c2f-ae8f-74d536202424", "comment": "Malware payload (ConnectWise)", "value": "483ef8b2057b623b262543753fdf2a91ddb7dce7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763306, "uuid": "e0a9a4b3-468f-4fd1-9b35-fe032548e41d", "comment": "Malware payload (ConnectWise)", "value": "1217cce3aea71b2ba292cf0d1a221b891bdb1de670d7a54471e1dc30f4a722f1452bd3c7943d99b3cd7debbc0e4ddd9a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763306, "uuid": "67b94ed3-b027-42a4-b655-a79ba5e4fdbd", "value": "T174646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763306, "uuid": "21720a09-ab00-4aa0-8ae5-dcbcdc33a547", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763306, "uuid": "8d9fc1dc-a2a8-4178-9947-20a5e6e714f9", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9A:51iw7gryNkSV1hy1Z1u2JLu9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780763306, "uuid": "6d324272-d470-44d1-8b5f-cb04d089f952", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780763306, "uuid": "9c996403-4643-466c-8030-68886eeaeb65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763306, "uuid": "8198b55a-367f-4490-8492-f927e4697bab", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4e38fb-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709427, "uuid": "a8d38305-86b9-4e94-96b3-fc34411ac99e", "comment": "Malware payload (Mirai)", "value": "1bad4be7e3519e2c7c04401b948cdffb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709427, "uuid": "8db3d185-a80b-44a7-bb57-9710c16aa7b0", "comment": "Malware payload (Mirai)", "value": "149470ba851b0c38448caa638db4ddc81e72a6ae8befd7100481d205fdcef89d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709427, "uuid": "e3bd8d42-256c-4784-992f-8ac81bffd719", "comment": "Malware payload (Mirai)", "value": "e62911dc7fa2724d389b41004fa12b0f71736baa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709427, "uuid": "77d03632-9c1b-4f8b-85ea-d7786ff93595", "comment": "Malware payload (Mirai)", "value": "3e0d4e8806613a08ea736b78886b59b33b57aafdcc5f773ce21f6fd595bd4947932b905fef8eadde2ca291e0276cfe6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709427, "uuid": "5fdf9c58-151e-489b-aab2-10f242b20b1b", "value": "T1ECE3875E5E328FADF678833147F74A30A75D23D623E1D684E2ACC1142F6029E545FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709427, "uuid": "0735c81e-3e28-46a3-b63e-09ec114370b0", "value": "1536:ENzdrD0pQpL6R2FGBYs0AUM06CqqVG02KeB3PMt8tfK9UzTKtpkzCs9XSgNo:2z5gR29QU5b3VG02jy8yUwpaCsIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709427, "uuid": "df548e2b-fd7b-4bc4-9124-1dd8984d2b72", "value": 156684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709427, "uuid": "c14452b0-1463-4932-94e3-ad084e3b299e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709427, "uuid": "372b6a23-bae7-4358-aa0c-2e6650ef1307", "value": ".Sassy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401bc595-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748061, "uuid": "9a16f7f0-5218-4bea-94fa-777ff7e75fa0", "comment": "Malware payload (Snojan)", "value": "ffb6350725724245fd896e9f753fdd31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748061, "uuid": "6bf688b2-2892-41e5-800a-e371e1d91ff0", "comment": "Malware payload (Snojan)", "value": "14be084d564a5329b21a98dce69df77148ee6dc6d3bdc67f6bafa0eebca2bc30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748061, "uuid": "c63e2c98-159d-4ddc-bee9-5e8c424c61e8", "comment": "Malware payload (Snojan)", "value": "aa47eea00e8c3cb084c1a82b252c46d8302d4a2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748061, "uuid": "f038603b-e0c1-4a32-9b20-16e8c01a540d", "comment": "Malware payload (Snojan)", "value": "2094736c4263252f83d826a657c7bc5188e62ec1b418bef3b02398366fde52427e7fed4f8141dd01c8cced9a6656ba4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748061, "uuid": "8f864c4d-8de7-4339-a615-e0fbd3d971a4", "value": "T14C84F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748061, "uuid": "a3b4c66c-a117-478f-8c2a-26ff953ecd35", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748061, "uuid": "405d79d2-d88d-41c1-a18f-c2b629b46931", "value": "6144:NrFZaaZmEJu2DKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uwh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748061, "uuid": "4b36d43d-98f5-4c16-950e-c29f5d5cd63e", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748061, "uuid": "1d797409-8c73-40a8-a6f9-8aafa05129f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748061, "uuid": "b7404bbc-7315-4674-88a2-5201918e2ede", "value": "1fBmCk51d3w5lqeK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bb2e2e-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729252, "uuid": "e20248bd-6e6d-4155-9082-cceed6910063", "comment": "Malware payload (Mirai)", "value": "9fd1347088f456cd10af89d66f1ffa5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729252, "uuid": "bc3f233f-c796-4275-b744-1a24d99f09d4", "comment": "Malware payload (Mirai)", "value": "15e367b636db07d60bce006bc1ed13761ba4ecaa600d8a1f002d27e184f8ca7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729252, "uuid": "e79e7160-3069-4399-939e-5fa09802da34", "comment": "Malware payload (Mirai)", "value": "66b8a50dacc4dcc5d6bf86c6a8583bd622e0652b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729252, "uuid": "e8e5be63-058d-413c-b9c2-694728c945de", "comment": "Malware payload (Mirai)", "value": "ef2f813d00a471af4039db090b2283ff5d64b0954da70eb738040894d9814e28a6dc982caed244567a9f2d16f9ccb61d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729252, "uuid": "0923f6b6-f5d6-46ad-9844-71bb2936e6f4", "value": "T11D6423FCE7911647B663713E5A2EF8228CF4416340BC1EAF66B4E657AC8B11B48C534E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729252, "uuid": "9d8aae41-9d18-4bd4-b92a-18af64bfd660", "value": "6144:YJ1QOrfOO5F+nUossM776vfNwqYfgqu69QIoaVH5LVvFOvh5D4:sQEf/5Ro6P63ofglfaXLVdOvhN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729252, "uuid": "4bf0d56a-b7b6-47d5-a399-f1ba9dadbcef", "value": 311088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729252, "uuid": "307d9e6c-f113-4035-bc0a-34b2710de422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729252, "uuid": "2cf122df-f140-4815-a4aa-df8659410f28", "value": "kaizen.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d83bc3-61c3-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1780762692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780762692, "uuid": "b3532596-a78d-4c58-a5df-a4ebbcd0ff4a", "comment": "Malware payload (AdaptixC2)", "value": "9800fe8e3fa4ce5a84526c33ba651712", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780762692, "uuid": "a21d4b3d-cd85-412b-9208-67a98a819db0", "comment": "Malware payload (AdaptixC2)", "value": "161e25e9bff516913bb9e9a4add7a76181112d5a9c9a618a4ff9e75403992cd9", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780762692, "uuid": "fa34f1e1-f339-44df-9bec-d3e9c61d46c4", "comment": "Malware payload (AdaptixC2)", "value": "157bb1b63ecabc28b4ba86ee73dfbd0bfec95aba", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780762692, "uuid": "51469104-3fff-4224-b5f6-fc1710d77936", "comment": "Malware payload (AdaptixC2)", "value": "71a0f128e65efcc3ad60bf752d7ccc8f205ff6b3de199d27d81657d83e276606cfeb8fb7831ddc10b1bdc2c406d512a2", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780762692, "uuid": "249edd79-a431-4afc-9625-44ca288e9e4b", "value": "T130930113E6E58E72FBC7C3BA03560B16F5B9F660B3741FCB12AC9850272092522F469C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780762692, "uuid": "457b8f22-2a41-444e-b2d9-e60c98e8fb7a", "value": "6bc21bf1ac021eb39332adc53e4cb88c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780762692, "uuid": "b0d8ae63-c9e7-4364-acd4-bea4fdbbf6df", "value": "1536:tlzWTcZ/EI7ecpKf3C+fZnQlv9QUr8Wqh2vNVDBlXHhmT1Xh6jJfErmNQkfhQv:tlzWTqsTci33ovi+8WqoDBKREtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780762692, "uuid": "f84714ea-1ea7-4546-888a-2ed82b303bfb", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780762692, "uuid": "c12982c7-f4c7-4e3d-b190-5ecd5de8de35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780762692, "uuid": "95c19147-7d2a-421c-aaaa-c17db94a0a08", "value": "aesde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e295f2-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777302, "uuid": "198088cb-949b-4d10-a0a8-1762d2a588ab", "comment": "Malware payload (Mirai)", "value": "cf88a311b04fa76186f30bce7d63b44e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777302, "uuid": "4233119b-990a-4031-a37a-6bdc6c80ce81", "comment": "Malware payload (Mirai)", "value": "179c60822f9b57f8f12a236e07f483bb1183bb28dc303cdd584968bf2574853b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777302, "uuid": "fd2c2d10-fc5f-4861-b215-b5b208f3cf11", "comment": "Malware payload (Mirai)", "value": "67160867b5a9828c6f93ff71b10271cf212fdaf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777302, "uuid": "1a4c63eb-048f-42a7-a851-1e00effc3ab4", "comment": "Malware payload (Mirai)", "value": "971afb7403e07305ceaeb0e95588906731af9220adfa3d2a3016ebf21931f42610ad9d1ce44b82913e2d14c64c5af604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777302, "uuid": "6028be08-c5b8-400d-a2d5-dc84e29dd5ff", "value": "T139839E118D744DA8F02A6DB420F58BFA4B13A444991B6DF73C8786729017DC8F1ABBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777302, "uuid": "11ba69a8-3e2c-491e-83e6-b53257c3e0ff", "value": "1536:OkIhybcb5pZwpAnsjsHM9EMB5RhtW3Pl0MLkR7XryCyq1hy:OkIhyob5jTnsjs2EMRhAPuogjryn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777302, "uuid": "33165b65-3363-4831-b21c-0e6804be0bf1", "value": 87844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777302, "uuid": "061849e5-b2a2-4a78-a287-da1195963da6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777302, "uuid": "571148f8-0d4d-4d8e-afc8-a38bdf057684", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf210e3e-61c4-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780763307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763307, "uuid": "4cecedec-23b3-4d8c-8b39-ff69a45ed970", "comment": "Malware payload (ConnectWise)", "value": "fd27a13dec3f5b90c36a5c36d49a0084", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763307, "uuid": "6b1a0bc1-5609-4f5b-b07d-a0e835ab68a3", "comment": "Malware payload (ConnectWise)", "value": "18a71bf3381cb75fe73a609c1ce121e95bba4ceb530c29cbe44e0c689404dd31", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763307, "uuid": "34e25393-d255-407b-9d73-52744c37b266", "comment": "Malware payload (ConnectWise)", "value": "bc80f7fa775185bb8daf75af24b32aa38bdf026b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763307, "uuid": "88b29eb1-b103-4696-8b41-3d7565af9ea0", "comment": "Malware payload (ConnectWise)", "value": "7e0bd902ebddb62f697e6dc2a7316ee643e2944a8073a095f2e672d9d4c53db2f79a84e812a6b7aab1dec2f8e611a3e3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763307, "uuid": "6ad3d889-61a5-44ae-98a5-d6025187e2e5", "value": "T1BA46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763307, "uuid": "cca90c9e-7430-455d-b508-70b8d8b3baa8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763307, "uuid": "01797dd3-6121-42a6-9962-7bb10282dec1", "value": "98304:UzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:UhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780763307, "uuid": "50c0600a-0e68-4bae-ba18-16cf71d42bcb", "value": 5642216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780763307, "uuid": "aa46b51b-7ed8-43ba-8532-3a24ddebde7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763307, "uuid": "7fed286f-15e4-446c-937e-949b2fb3fb36", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbecbd6-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748165, "uuid": "d56e686a-4aea-4116-b204-a5ff447e413f", "comment": "Malware payload (Snojan)", "value": "14a1164eae52a64180f59b1f517ef766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748165, "uuid": "0820f20d-e469-4b33-9281-6ce3e5eb597a", "comment": "Malware payload (Snojan)", "value": "19a367e6b0b8b1326d3c3e8d57386405a82b744406686ed383b5f2a40437d9bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748165, "uuid": "6d74a2a5-32a4-495a-9fb2-baf988e2ff9e", "comment": "Malware payload (Snojan)", "value": "a978ef039c556cfbc41582160baf6d603b3e81d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748165, "uuid": "03d56068-c694-404a-a367-e2242673d52d", "comment": "Malware payload (Snojan)", "value": "d900c8fb440d3c74de1fe7adc834dfcbd19f8936ad826c3e64bfec7f6a17ce197d7859272c9c8a42a8822368b9f4bfef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748165, "uuid": "65c0f104-04f8-43a2-8e23-31fdb8b403e3", "value": "T1A6F3021646DB58F7E4AB127D469D9063B1FBA06F4BCE3EDBE1FC124DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748165, "uuid": "e5e96a16-f775-4245-b3a1-a4c68679ffb5", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748165, "uuid": "919ce237-9922-4c3d-a674-533e8fb49454", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+vK:QJ0TAz6Mte4A+aaZx8EnCGVuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748165, "uuid": "de431494-7f88-4cc2-8ea8-5d8a102d2ba8", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748165, "uuid": "e053ca00-2aa7-4300-b4de-5226a0cdd79a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748165, "uuid": "afc24f9a-518e-433a-bc68-203c83f75791", "value": "xpbStUwUFbyCatG8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437b4f1d-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780729169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729169, "uuid": "8707b99b-5f19-438f-bf24-808f59cc0765", "comment": "Malware payload (Gafgyt)", "value": "33d907e0176838869cad0ae3087a4890", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729169, "uuid": "950e5a56-f648-4bff-b62f-5e25972e9858", "comment": "Malware payload (Gafgyt)", "value": "1acd4655f64a2b14305c4195857393d0526a1d09e0ea874ce775fda10bb6741e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729169, "uuid": "171bd598-a7cb-4e73-a195-c2cee0ee59d9", "comment": "Malware payload (Gafgyt)", "value": "02d8fc4eef7fa08fea6c369a7eb0348be913ff83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729169, "uuid": "c7a357c0-e72a-4514-92da-b26c0f8f9606", "comment": "Malware payload (Gafgyt)", "value": "05c55826cb320e711794d598780bc8a8b5dddfd136eb9be7a0c69a1da1993b4277b5a4589473117ab7f95b07c90d501d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729169, "uuid": "a1c87036-5bd8-43fb-b5ed-392930496e6d", "value": "T165F2F190F1959BD0DC97DEA87EBB9A8097B0DD8E3AF6D7D0508C3E6642710B12B118D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729169, "uuid": "fcd0977f-afa1-452b-8b0b-d19b583238e7", "value": "768:etGzoQJwk9s5nTpM4ZZQTEKLbrx+M9TzE4uVcqgw02NWXz:ZfJN9MpMK3KHtF44u+qgw06WXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729169, "uuid": "70c7f283-95d4-41f7-adeb-4b3536bdcec6", "value": 36732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729169, "uuid": "f9fe5ad2-7012-4cdc-97f6-30da1d9dcbd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729169, "uuid": "8cb44aba-3a67-49ee-94a7-dc949d409f0e", "value": "POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7283071-614f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780713042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713042, "uuid": "474d145f-5df1-49b9-8408-bebc5c97e414", "comment": "Malware payload (Mirai)", "value": "236b8a10941beb618b32569234bb2a50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713042, "uuid": "4abf2c26-5ca7-4ba7-905d-2346e0430fe8", "comment": "Malware payload (Mirai)", "value": "1b040a9d152974dd5ebd119a85ecfee9e75f1c178d15b03ab5350c704829c86b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713042, "uuid": "b7e6ca3a-2796-46e5-b62e-2fe3c750e18d", "comment": "Malware payload (Mirai)", "value": "18dda08bba57e6e943c5676ca73c744effff83d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713042, "uuid": "0875fe14-e527-4d6d-a8b1-cc6707a728c3", "comment": "Malware payload (Mirai)", "value": "e41647f9fd5e2e945228d49c8bc203630ec961ed7c67e8f1ff585f288fcd626b428e5fcf2e57d4c62bd923f7a391990b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713042, "uuid": "3a4ffa77-1956-40e8-942f-719a8e32e92f", "value": "T1BF03F12DFF237C618F303832E96907CBB66224F87456FBA76654C6845200EA94E1D78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713042, "uuid": "bad662db-547d-43b4-8a0a-43c5e4b75ec1", "value": "768:nT75Uj0VSHEcEUY34ybmaYCUj4JBsZwrmik8PeKsjQMBsl4NfC9q3UELMx:nfiuSHEsY34ybc4JaAkPjQ9uLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780713042, "uuid": "967a9a44-94bd-4da4-8c0d-8df98ef0929b", "value": 40168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780713042, "uuid": "0f812f93-86b8-4a47-83d1-d327ac695630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713042, "uuid": "72478056-e4dd-414d-b828-51fb57f7d6e8", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39985caf-61db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780772961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772961, "uuid": "0f5a4f8d-b2bf-4723-87d8-296e3f932ce6", "comment": "Malware payload", "value": "1a1a182c7235219b36fca6f2c2ffb536", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772961, "uuid": "14783eb0-4954-4ef1-90a0-ca7bcec20812", "comment": "Malware payload", "value": "1c5dbb66584bf425f5fb6f9a064f1255ebeff474977626081b1f15c492d83213", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772961, "uuid": "32cff9f6-094b-4c28-8eb5-b2d1d6c180ba", "comment": "Malware payload", "value": "6698db92b18653b9d0a379c13b9de3ee076f4877", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772961, "uuid": "fbb1113a-f277-41c5-9552-bbba91ca2789", "comment": "Malware payload", "value": "7edd3a2eac2a55c1b30b6e5d0cbe940f16690129eb5fb47eec12e3dce8ab87ea6a2543bf75be2dca6834cbbced68b91e", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772961, "uuid": "7337b70f-0912-4bab-8d71-69e440ed3a0f", "value": "T1EC0833A45E10893FE01915B777D363300A4645DBBD716AABF3CCD1753C878CA28E8A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772961, "uuid": "6ca1ae6b-6bea-424f-8b23-8ff90bfb1a66", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772961, "uuid": "2eb9c340-cdc6-48da-82cd-0cf476abc7f9", "value": "1572864:Wt9IKPXGDQQRWY7d9KmkzjfcL0FhH3wzoVjhZBQipWGOPAgSN7:WUK/GDQQRWikffBXoo1SiDNN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780772961, "uuid": "41094b28-79ba-4716-9f65-5a5404f8210e", "value": 77523142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780772961, "uuid": "2013136a-d3c3-4b9f-b42e-a350634dcefe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772961, "uuid": "bb3cd5e2-7c36-4a21-9174-dc1e75a1c8e3", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646d7d2c-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748122, "uuid": "c352639e-94ce-4c79-beea-81a8aba38baf", "comment": "Malware payload (Snojan)", "value": "0de7237121a3b0aaead11c8871c2594d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748122, "uuid": "5ea1713f-e65c-4603-91d4-a534deeadfb2", "comment": "Malware payload (Snojan)", "value": "1d5e8c05d7f375d8f0b8284533f347a028318466fde7f356a28626f25fb69ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748122, "uuid": "cac3acd0-4fbb-4308-bb7e-f6c0f9786022", "comment": "Malware payload (Snojan)", "value": "2ef5a335591c279ea54f9e14e02355bd64446abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748122, "uuid": "468d2958-583e-4a53-b831-87864dc4e111", "comment": "Malware payload (Snojan)", "value": "88cdf270893d7f4e704646a65d39f686b91eba83e68a163bb8d6e027135cb1bf08f3e5434af48ab8dafad0a1ffcad409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748122, "uuid": "1554faed-c93d-4ef0-80da-3425ceda9514", "value": "T1BCF3021646DB58F7E49B12BD469DD063B2FBA06F4BCE3EDBE1FC224DC6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748122, "uuid": "0eedb19f-361a-48f2-8078-2b97314244f8", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748122, "uuid": "41672316-1d86-4e13-b71c-117f45fce204", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+yK:QJ0TAz6Mte4A+aaZx8EnCGVuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748122, "uuid": "1981e205-987f-464d-a23c-48daf0c55a1d", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748122, "uuid": "21dee380-9106-452c-8a42-b954a3c15566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748122, "uuid": "78a91a8d-35df-4651-9c66-206494726e43", "value": "L3SM9TMsf4OvfqFL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d4ff28-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780746888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746888, "uuid": "6a1841d8-c656-4d90-ad43-44b7caa50956", "comment": "Malware payload (SalatStealer)", "value": "51feafafd3311bd27f084fdd8a4875bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746888, "uuid": "3e4e0c59-de20-4efb-8aee-8b5d25d292cc", "comment": "Malware payload (SalatStealer)", "value": "1d93d15a70ca84479e88077e3a81f85ed8c58e9077dffd728a94adeb79645a28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746888, "uuid": "97b30621-5f3a-4f50-aabe-2e8db8b9e64b", "comment": "Malware payload (SalatStealer)", "value": "7de22391f29537e4ed60a03c6dd92d9cd572cadf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746888, "uuid": "cccf370c-9862-4031-a1c6-ffd26396c742", "comment": "Malware payload (SalatStealer)", "value": "c1b8057ea3c236898eb9857d237b2d8690ddd05a9ebf8d295b4b12c959ca7dfb0d8187dbcb4404ef22f28d0788a83eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746888, "uuid": "301e014a-aaf9-4b00-a75e-fba0074045d7", "value": "T155C66B11FADB95F6E903583100ABB37F63315D048B28DB9BEB547B2AF8776A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746888, "uuid": "127e08c8-08e4-44a9-a1eb-45fea6092176", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746888, "uuid": "1a32e497-b38e-4659-a56c-e5d92b937c77", "value": "98304:PhsaYAe/J7EChHvcFy0FR9/Amr4L3HxmcE5O/:ZYAifHe79IWsM5O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746888, "uuid": "09bfd107-b48d-4fb8-a98e-fcc477ea7bea", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746888, "uuid": "e8bb6180-21a8-450b-bff6-c3eead2b636f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746888, "uuid": "193068ff-a49e-45a9-95e9-a494e9aeed84", "value": "FIX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cd53c2-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748104, "uuid": "110fa8da-4ae5-423e-87e4-cd7cc2187590", "comment": "Malware payload (Snojan)", "value": "5796cdbc226302d66f957c9765fdc675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748104, "uuid": "3ebb2ea9-e8e5-46b4-a127-6fa522715833", "comment": "Malware payload (Snojan)", "value": "1df26bd22d2b24125fef7be885304fd0bab15372d4852b897c5e7e9d66fa01d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748104, "uuid": "3ced9f45-175c-42ad-bf56-5f82ee35667f", "comment": "Malware payload (Snojan)", "value": "484f1cf2f8d310710f1fcfc83aa8bf811b7aed30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748104, "uuid": "3bb2ca49-4d4b-4894-85fe-c7ae640bbb10", "comment": "Malware payload (Snojan)", "value": "bbd13f9e42bbb02a4ddae94d95f9f66c32aa37c7580c0a311c27308afee2f381578391accccdc1158536b8242d1660e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748104, "uuid": "76f8f5d6-b937-4803-8dec-393f49a5ef5a", "value": "T1FBF3021646DB59F7E49B12BD469DD063B2FBA06F4BCE3EDBE1FC224DC6062B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748104, "uuid": "0f33f742-f1b4-489e-bb8a-a001d2777027", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748104, "uuid": "8d8fb521-a208-4f47-9e86-f6b9ff6cfdfd", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+WK:QJ0TAz6Mte4A+aaZx8EnCGVuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748104, "uuid": "92817d92-0b9b-4c8f-8839-194b8f17512b", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748104, "uuid": "9224d9c4-2781-41d7-bf4b-a7526e7d8309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748104, "uuid": "dbf4d4d5-f2f2-4a5d-a363-a8d671ae48f1", "value": "gzt0Blo1gyvJsMYO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e5101d-614f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780712961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712961, "uuid": "c5b416b0-e602-4993-8d02-7a1a0ddde80f", "comment": "Malware payload (Mirai)", "value": "9a1b7645bea558b92a3dd32e129fc78a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712961, "uuid": "c3206a11-7fe4-4e7b-a5ea-8d3d8735121c", "comment": "Malware payload (Mirai)", "value": "1e2b58b266af07f2787710e5fe515a1b90030e23d6f04e24a9edf015052dc55c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712961, "uuid": "b08155b9-c4bb-426b-94bd-e6aa393bb6b2", "comment": "Malware payload (Mirai)", "value": "46a7191b4d765ce046532414d179dc48dbbddadb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712961, "uuid": "d910e0d4-009e-4c8b-a144-9f5202e00f56", "comment": "Malware payload (Mirai)", "value": "40863072bf66d0d8ca816d0d862d8cdd492dcd3e58b53709c9e3f01d4cc9b295db9d818685eb2948983fd843c93e5eb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712961, "uuid": "6ae180e5-46ae-430c-b7f9-957e51a02852", "value": "T18923023177040165DEB42AB06AAACC46177726D8D1FF72388888C97A1C2DF9DF77C8A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712961, "uuid": "0210aa93-b1d8-4e05-bd11-e85da8a56f02", "value": "768:JiURkPjiJuVYDZN4rAhflMuNyHYUMeTQ2FOrF5vKDFbz6DKjwaDREU+Anelngest:JiK+jitDn6uMuNy7ESE/qGUlnelwzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712961, "uuid": "dcadc5dd-ca56-4c38-b9e9-145da55325d8", "value": 50104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712961, "uuid": "ca3b1711-8410-4d66-be22-e93a636dca23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712961, "uuid": "4f71ccc7-b9fa-4d36-986c-415f6bab31ef", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be60e50b-61a9-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780751709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780751709, "uuid": "f716d172-c13c-4b06-8019-e8b02c04a626", "comment": "Malware payload (WannaCry)", "value": "d3a9c119d3eef9228fb22b0306fedd2e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780751709, "uuid": "37a0367d-4980-4cd7-9555-f77e33dbbe27", "comment": "Malware payload (WannaCry)", "value": "1e866c39a78402808e1ddc3f8cbc2dd53009c2114c591deb2a21c5dc20b4b867", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780751709, "uuid": "b6e8bfd4-f755-43a8-9d1a-ad0309e09781", "comment": "Malware payload (WannaCry)", "value": "8b74da81349082f4f2cf2b158a1c01c2a5dc6904", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780751709, "uuid": "74010864-e09d-4b13-ae97-24261d620c84", "comment": "Malware payload (WannaCry)", "value": "924b2b85bd3e97a2f162e9b97a22bf1a27dc806048f5f80afcd683ca52ed6365f277346c523897cb78cb3ab1a93d9b7b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780751709, "uuid": "efa98daa-9825-410f-8eb3-28f93917e129", "value": "T13B36125932AC80BCC11B5274A4B34E25E7B37C9A227D970F8B9487661E13790BF78B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780751709, "uuid": "ad42de1f-a283-476b-9a89-2fbb81ca0f77", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780751709, "uuid": "49cddb12-9c8c-4499-af40-45c3f36a9fd9", "value": "12288:jbLgCVbLgPlumQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUj:jbLgcbLgdlQhfdmMSirYbcMNgef0QeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780751709, "uuid": "16ab1b10-daaa-40b3-b4f0-2b319ada70b0", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780751709, "uuid": "168a4b98-ae99-4629-994b-dd313612ad4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780751709, "uuid": "c4360e68-01ac-4b83-bc4a-1870a2458f24", "value": "1e866c39a78402808e1ddc3f8cbc2dd53009c2114c591deb2a21c5dc20b4b867", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b293f9c-61df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774709, "uuid": "2c6d713d-ea06-4ad0-9118-fa935f0915de", "comment": "Malware payload (Mirai)", "value": "5926edf288eefe3c3f72afaf480bea5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774709, "uuid": "43aa7d73-a965-483d-80ca-90c8cc25ef3f", "comment": "Malware payload (Mirai)", "value": "1e917b582754c27b0c81cbd68365933ec5cef864da50eec696714c569ed224c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774709, "uuid": "17d3c009-f86b-46cb-81b4-2fc14a1a758a", "comment": "Malware payload (Mirai)", "value": "57c6216ade07129604e24f6b4ee1b7c53929f801", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774709, "uuid": "69630f7d-75c4-416a-beda-4211a3c53447", "comment": "Malware payload (Mirai)", "value": "c67a2a664f706b1237d5a7a1924e44db75324431414a9f0b649fddf59f9b6ac357e82346cea8c7235c491375823808b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774709, "uuid": "5bf0b6d2-b730-49aa-9eff-37b6cb854667", "value": "T1B923F2023044BC6ADB32A436F8F85E9F33B1557297F0747D1A915354A1C6929B9F0B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774709, "uuid": "c6485641-4c40-472f-bfd5-e16c70883c65", "value": "768:SjeU6BGxrPe5PT8U4LGkx+dFCG4ITqXbFbF3RCvscwHb7QDMxs3UozCw:SSU6AW5AUKx6AjhCvVw72zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774709, "uuid": "7ed27107-7bdb-43dd-bccf-b265661a112f", "value": 49420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774709, "uuid": "6a67ed18-a955-4e0c-91dc-0cad3bc9836c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774709, "uuid": "c7ecfa93-6909-459c-a6fa-68f4c4f7fa82", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f805804-61d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780769643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769643, "uuid": "3d57db50-a186-4408-833e-18d5fb87bce0", "comment": "Malware payload", "value": "7ef2819696b68b9ee31ae76304f688de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769643, "uuid": "ce468e05-df1b-49bd-9592-1464547cd153", "comment": "Malware payload", "value": "1fdd1176933a786be5aec4814c143f4a192a32284a015bf3a28d96e6df66a3d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769643, "uuid": "7b101b3a-d523-4aab-b249-d38867987739", "comment": "Malware payload", "value": "93753509314c80da6d6c369ecb8900c8b1f43db9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769643, "uuid": "6e3d1ca8-f1f0-4f54-aa13-d3be7865bd17", "comment": "Malware payload", "value": "2cdc653e4c09d33cc2375cd83ece772adc3e1ff6e3f17be8f184c938463fe492e867a00cdac42b96a1a267fbf2e4a309", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769643, "uuid": "0b75d552-132f-49af-b70b-88b291d4dbd2", "value": "T161E69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769643, "uuid": "767bc353-2fd0-4f61-82d2-ea77690adf5b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQb:cqYUQuVDt0TZE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780769643, "uuid": "5ec9effe-4dfc-4f7b-9252-68ce97e26302", "value": 15073280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780769643, "uuid": "f97a539d-599b-47ba-8eba-3db4c72033ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769643, "uuid": "3ed90ba8-d98d-4ae1-bdd3-808b0d606bb8", "value": "1fdd1176933a786be5aec4814c143f4a192a32284a015bf3a28d96e6df66a3d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1442380-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759069, "uuid": "7569121b-7031-4885-827a-c27021a945e0", "comment": "Malware payload (Mirai)", "value": "1b695994c1adf6735c20296c271d9cb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759069, "uuid": "bbab0eb2-e9a7-45c6-9b0f-b4badf2259c0", "comment": "Malware payload (Mirai)", "value": "20001163c5501357c08b00ad9ff0139be8c0c048d9e8f5325fcfd11e79759c14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759069, "uuid": "25f2f498-34a1-43cb-8f2e-0cd40879a5b9", "comment": "Malware payload (Mirai)", "value": "71f35bbe48e195818d70692f105481240d5c8486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759069, "uuid": "ced56785-a22d-43e6-a16e-1db28fb04ef2", "comment": "Malware payload (Mirai)", "value": "857c60aa1daaaecbf3a2001e8a191cd87d455055ace948218b6fed100738026b84e103fd454f1f4dfa5eb25ba8328f68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759069, "uuid": "13a8f659-44a6-4ea8-badd-3d2f37efeeee", "value": "T184F33B46EA804B13C0D6177AB6DF42453323AB64D3EB730599287FB43F8679E4E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759069, "uuid": "2dc83b70-7f2e-4591-9df9-a500a27016ac", "value": "3072:45K0AKZlKXuaBMGiN9L/FZknJEz7nJsZvoLkp6M/9xbcMS:ehAKWua+GiN9L/Fqn07JsxoLk8M/9xb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759069, "uuid": "ec8bfa84-5db6-4a8c-a4c7-1b5e46993522", "value": 157489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759069, "uuid": "30735a0c-eca4-41af-bbb1-a507ec154064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759069, "uuid": "3ebe5aaf-65a4-4b2d-8c78-dff9f489110a", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e995689-61b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780754582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754582, "uuid": "5eb24857-d6db-4dcb-88cc-3d4791ac3d5e", "comment": "Malware payload", "value": "7286efd4fdca9c4cbc8ecd492ebe0e13", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754582, "uuid": "2fb1fa79-d2dc-4af0-a0b3-97b18de0c3ed", "comment": "Malware payload", "value": "20886efa4aeafc1e13b0c89a103b53311d1868250c53823ef83ab307c2c827a5", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754582, "uuid": "eb54f98a-4727-43fc-80b5-889cf72f1d82", "comment": "Malware payload", "value": "ec3623bb35e3cba07903f9bd8c2423c5f7d61a03", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754582, "uuid": "81e6e255-290d-47ae-8a4c-b83d6c7dd0ac", "comment": "Malware payload", "value": "f451f8c442a34e9aaafb697df5f96f33d2b1d10620c1fd59ebacbd0eb2e3779eaefeb7577afc24f6eae58d8f6ffb68b3", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754582, "uuid": "8ed594f4-8ff6-414e-876c-594e5125b8ec", "value": "T16796F15AEB0CE43FC8776077CE6A11233266AD414A56AB73750AB2082CB39CD5F49FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754582, "uuid": "72eae52e-b675-4f74-8b9f-f70272b08b6c", "value": "196608:VgqIQ7WPT4idnZhUuykfmU0WA+xsK44IYveumotbkEJQ:ZIQ7WhykOU0WzxdIYmu/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780754582, "uuid": "87a43fcb-f29f-4531-861d-8f625b0cc8c0", "value": 9371828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780754582, "uuid": "cad996e2-1b2a-4e6d-9ee9-80eaaa71232a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754582, "uuid": "6ef9e8fd-f803-4b62-ac8e-73da683e8322", "value": "Pro+Cleaner_1.2.30.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9846179-6150-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780713503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713503, "uuid": "693ed20e-da12-40b8-a8ee-4a40fdd08ccf", "comment": "Malware payload", "value": "e5401fd7efe92ac5d3a081a3a633cfd4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713503, "uuid": "968c36a4-519c-4896-a5ad-62c8b01d9ae9", "comment": "Malware payload", "value": "20a5bae2fafa688da609b4fa7e0553fb59cd9599fb1560723eb5b13be80c86e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713503, "uuid": "98d6a27b-498f-49e2-9d69-5f53efc235f5", "comment": "Malware payload", "value": "11c639e7e645f1f7f38787458559f8428e9bbf4b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713503, "uuid": "d2b679dc-3b5d-44cb-b265-e5f0eae2fb96", "comment": "Malware payload", "value": "d55948e05378835a583d207800baac7f958998589bbf8ff279a8378edd9bafe93576a066ee3be3235ec85418750c714b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713503, "uuid": "7c5ca84c-a4b3-40f3-8dac-d5bcf8d1ec3d", "value": "T1C4136C6566853C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713503, "uuid": "ef9927b9-77e3-4506-953f-acb63c9bf36a", "value": "768:9XRWNGxVM9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:Hlxnco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780713503, "uuid": "15c1644f-34dc-4967-bbfb-f10240b1ae32", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780713503, "uuid": "f3bad683-8dcf-4c6b-b11d-b3f832aeeae2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713503, "uuid": "d50aadd3-00e4-4de8-9901-1b4a1ad760a5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c1c492-61db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780773228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773228, "uuid": "b357596a-de3f-41a6-9259-9048655ced3e", "comment": "Malware payload", "value": "22953376e0bdfd0af05804a66957289c", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773228, "uuid": "dc38b441-690a-4da9-8eef-1b2430eacefd", "comment": "Malware payload", "value": "21ecba80411c7c157621d316182bbd94be1f2b79e1511f65aced819ace364091", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773228, "uuid": "14ce6c7c-6aa8-44eb-858f-0b30725e9f01", "comment": "Malware payload", "value": "028bbac0c3e96c65e85d54d3d68d92025e1973f3", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773228, "uuid": "03427615-ff25-4c6c-a708-01bcce461433", "comment": "Malware payload", "value": "895c334515011695310d53c4cbb6e41445b71c7c6d4e8b91aab1d3ee92e7ce7dc452a1a5b14c144e4a23fba55d776dea", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773228, "uuid": "06cbdc76-ebfd-47be-879c-a4d0931f634a", "value": "T1530833376078C4A3EA2F10BB51C9F761E1889A7997B1319AFF540058BBF1A0885ED7F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773228, "uuid": "79f17965-8bdc-41cf-bce5-cd3054e1b579", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773228, "uuid": "d5de95bd-b76d-4b2e-970a-1c3efce0fe08", "value": "1572864:Gt9IKPXY52SDbRWYdUuYkhzzSZ3OyH0jcRCL+7:GUKPiD/RWwU+NSFOyQvq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780773228, "uuid": "72e635e8-1be5-41c8-9b5f-41b7799ee4d0", "value": 77793711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780773228, "uuid": "62473ef1-c202-4612-b3c0-20eda79cf852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773228, "uuid": "d1a0b65d-d948-47cb-af24-ec45a2ce8a33", "value": "CreateAeronautics.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76043da3-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748152, "uuid": "0b6b7947-9b3f-4671-9e55-a590449f7c55", "comment": "Malware payload (Snojan)", "value": "ab9d07b18d11a5cdc268a0320619c335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748152, "uuid": "0f6a32b9-81a2-4c05-81e3-dd0a0ac6194a", "comment": "Malware payload (Snojan)", "value": "22215872979d2f8466da89ce64a179d17f38dd8ff3b514aa9ce0ed32eba3de90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748152, "uuid": "7dbf9e41-89a4-4b79-bfb9-9e203a6b8558", "comment": "Malware payload (Snojan)", "value": "8839df35d8c0978bc56560ac99d17f536c95d1b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748152, "uuid": "2ca538d4-66a0-4414-99be-2eb45af57e84", "comment": "Malware payload (Snojan)", "value": "57f60da148f3f76a0ee65022388ec5be42275c70c08dab34000a8a604c4c0123786f2f3a006f65746f43feed57012a85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748152, "uuid": "39a162bc-63d3-4e76-a7fa-e8795d947a21", "value": "T150F3021646DB58F7E49B127D469DD063B1FBA06F4BCE3EDBE1FC224DC6062B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748152, "uuid": "6bb13541-1bf9-4613-b943-1f9c85f565e9", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748152, "uuid": "de4d2ef3-2160-4c99-8f50-80bb063d89fe", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+NK:QJ0TAz6Mte4A+aaZx8EnCGVuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748152, "uuid": "8c444016-9fdd-41a1-88d8-1038e1316b21", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748152, "uuid": "3293b6a4-c2b7-4214-b81f-1fbe7ffff4f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748152, "uuid": "77ece669-1d0b-47ac-8fd8-b51de9161b41", "value": "RpO7lhXfZAuf3cPd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d56d3c-61cb-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780766113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766113, "uuid": "71fdfa30-0773-4d6f-95d7-64472dc88825", "comment": "Malware payload (WannaCry)", "value": "c055dd2e190e3f5dc1c1b9288635857d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766113, "uuid": "5b13b812-1486-45ec-bb26-41e80108d197", "comment": "Malware payload (WannaCry)", "value": "22aa718083627200e0ac3cf2b99d3ab9b068fabc504f35a77d95c860f76736d9", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766113, "uuid": "db8caebb-7f9e-4e6c-9a0e-1324d6f84224", "comment": "Malware payload (WannaCry)", "value": "1c9813a1181bb358a547c12aea239eed97b60e73", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766113, "uuid": "a276bc26-6a01-4877-af51-16f1f9ce6133", "comment": "Malware payload (WannaCry)", "value": "66669ab16e4f8eb6f568340e580aa76282d15ad269ab14ec48edc2c88d7a192ae7ddd7e4edac4a8bcaed6f887061ac0a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766113, "uuid": "b5b62ada-07f7-4ffc-af3e-626a5b0eb1e9", "value": "T10E36334931B891FCD0060A7884F78E57B3B37C5A67BA5B0F8B80866E1D53B45EFA4742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766113, "uuid": "2171446d-2af0-413a-8dca-572b91f44360", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766113, "uuid": "46197b01-556e-4991-9a24-95ca79988c2a", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvZ8yAVp2H:DXDqPe1Cxcxk3ZAEF8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780766113, "uuid": "5ad439f3-d4cb-4e9b-a272-5d4707b3ef33", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780766113, "uuid": "c8a45d7f-0ffd-4f24-864b-de51b59d1233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766113, "uuid": "ced08740-c91e-44ea-a2bc-89ea11d2ab83", "value": "22aa718083627200e0ac3cf2b99d3ab9b068fabc504f35a77d95c860f76736d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b6489b-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780746854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746854, "uuid": "ea00dc07-07dc-445f-86d1-60e964905449", "comment": "Malware payload (SalatStealer)", "value": "e76712cff2e7c66d74094b4dbbe905a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746854, "uuid": "79513ec7-7bbf-4d0d-b0fa-5bd74e2431c0", "comment": "Malware payload (SalatStealer)", "value": "24e4edf1c4fce9ad3907447c49241465c0d4424c19716af1ad288d33e55d6726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746854, "uuid": "91a53403-91c7-4b6a-b5fc-bbd8ae1e7951", "comment": "Malware payload (SalatStealer)", "value": "ae6d6633ec9880dbf09978f0cd78da4896630893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746854, "uuid": "b0a80f24-1da6-493c-8ce4-9cc0664c7855", "comment": "Malware payload (SalatStealer)", "value": "4ae7373b0c302468603800c9bf946a891e033592a8cf9bc93aae38ada79c5449bb1a59469da0bb60babaf4e71d20bdbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746854, "uuid": "30df703b-304c-4309-a4e5-579c7ddb3153", "value": "T109F533463852A12ACDD8F37AD2CEAB6F70D352926BDD98CEB449C50A5EE4FC3462D140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746854, "uuid": "ced06dd0-89ea-4ace-b828-866c94459fe9", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746854, "uuid": "6a9dfccd-8298-44ec-ac56-6afb4355e793", "value": "98304:RMvGMj2EJK5DcqPcJp428vJgjJHNlKjbBC:6h2E059kPB8v6HNSbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746854, "uuid": "41b01dcd-bf92-4414-87ab-0abd1f65886a", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746854, "uuid": "14c9b95f-f83e-4eec-8c3a-62065d0f59a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746854, "uuid": "578c1e72-8519-44c1-bed1-026cc15f8cc3", "value": "FIX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2b0a04-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759066, "uuid": "d078defe-c51d-431f-bd3d-da54e6da2b16", "comment": "Malware payload (Mirai)", "value": "0fc963ca3a0c4703380ff010e9596257", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759066, "uuid": "fa12ffb2-9833-4cba-81c3-64e3781587a1", "comment": "Malware payload (Mirai)", "value": "270fde17a9f061cff46f5eae65620245e8928be6e8b05481915d42671a3c92ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759066, "uuid": "0e081f75-1329-4fa1-97df-444d24432fd8", "comment": "Malware payload (Mirai)", "value": "0e6a9e5da9ed9c746dac6302a6cd607e39441615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759066, "uuid": "0a302a85-6a92-4104-896e-d6a6fa963879", "comment": "Malware payload (Mirai)", "value": "355e4b45b4c552b4afee903a3dc59340f7ff914f1743a5ac045c8221f1dde023e4841056f10297abd83f67ae2e1cc320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759066, "uuid": "7b88f2ab-c5a8-4559-891a-5bf75f4cdf73", "value": "T18193E606BB650FFBD86FCD3746A9070229CC551A22F93B7A3634C918F51B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759066, "uuid": "5ec92b96-64d8-4f1b-91e7-c0020f848c2b", "value": "1536:pis09QqkZ/I5JT2490tnB0L2DhMtGlYZ43rICVYTCio+hGs/xYP:pX09QqkZ/IsXDhTY+A5hVYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759066, "uuid": "b3deefac-e5f4-4583-971c-ce37e1737986", "value": 97596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759066, "uuid": "2d0c2170-d8d9-4751-8264-77ebf6486b30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759066, "uuid": "4dc6002e-b3cc-446c-96cb-ea8e1e2565cb", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b06354-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746703, "uuid": "497dfe98-7f53-4607-9f54-5455b2656038", "comment": "Malware payload (Snojan)", "value": "605352887ec15800d3d0b75323ec6478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746703, "uuid": "50c49943-a6c0-471f-b0fe-a2ec096fc867", "comment": "Malware payload (Snojan)", "value": "2712db7fe4a9c78264a46c5e7f8906cd7e0b1780441ee77446b26924fcf7ce2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746703, "uuid": "4e48bd84-154b-4430-959a-22fd73e39670", "comment": "Malware payload (Snojan)", "value": "b1e1819c8d3a9e2b6559c2abcaf8603628337d65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746703, "uuid": "20bbb6ea-b844-45f8-8c8b-ecb9ce08535f", "comment": "Malware payload (Snojan)", "value": "00e60b22e9cf4fa9b4625399c54ed9be869c9156b72c14be40010257e6a446835ef3f6bcc440522a8376f2021a82d9f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746703, "uuid": "229cb898-dfb9-4362-9759-d01e7e087419", "value": "T1EC15222471C0C4B7D46B413544C9CA72AA76707247BE99DBBBED63B9AF203E163342C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746703, "uuid": "7ad07349-ac3c-47d7-bb87-6b225bda8bf8", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746703, "uuid": "09fd300e-679c-45e4-a9ff-04e08b1c545f", "value": "24576:/Y+Bk70Trc18BSnLW2CRBKViu99LK1Rad6yZcTx:PkQTAKYS/v6h3+1uhZcTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746703, "uuid": "1fe58f16-6f4a-4ca8-8de9-e3b7dbcb8fba", "value": 923104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746703, "uuid": "4a8184f4-f3b2-4be2-b6b3-f14f4df6bb57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746703, "uuid": "ced8e219-394a-4253-89de-f302bf157d53", "value": "8HnaVLFPID6tDACI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0df1a16-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709596, "uuid": "64e42f1d-78f3-4a2d-b268-ed41defbd114", "comment": "Malware payload (Mirai)", "value": "0d93b574b4d930983440409a0bebf83b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709596, "uuid": "c2ca3a30-0bba-4e3d-bd56-c9c97f354cf3", "comment": "Malware payload (Mirai)", "value": "286fdf3ee19f38c465460ee637023b5be1011b782d49e22abe9147054e63b7f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709596, "uuid": "b95847d8-92d1-4bb2-85dd-2542c668b408", "comment": "Malware payload (Mirai)", "value": "a32f070cab747dd86d11efd5c15a75bc75885b17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709596, "uuid": "7ec85188-6c3e-423b-b6aa-863f9f7fb0c8", "comment": "Malware payload (Mirai)", "value": "194831901c9173e1804c06ca1edc86a07bcaac1df2bd55297ea43de14fa6f7073c7074a7cf9c8354fa4eadf77a2de33e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709596, "uuid": "749f2b02-44fb-4eb8-83c9-2e5ef4812454", "value": "T15AD30956B9919F12D5C321FAFB9E814933136FB8E3F93102DD206F50638A9DB0E76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709596, "uuid": "0776078c-0971-40bb-89e1-a53b5b502170", "value": "3072:5P6vJeuJmBJDk4y+T6h0PraBBbIzoF4BYR90Ba92M8gc02:cBemmBJt6+raBBbIzoFFR9J9Ndc02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709596, "uuid": "d16e0168-73c2-467b-ac64-83c55fa579d3", "value": 141524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709596, "uuid": "d487ece7-680a-49e2-8f7b-e3c4ef275204", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709596, "uuid": "71c186f8-336b-4ceb-90b7-1b716f3fcdbc", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ec1cda-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729420, "uuid": "50d40fb2-a9aa-48d8-bf83-7472e68fb748", "comment": "Malware payload (Mirai)", "value": "b0b455f872a9cb99df2b44ae30fd2c28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729420, "uuid": "c830e68c-7540-46f6-80c8-f118e302d4ff", "comment": "Malware payload (Mirai)", "value": "28f2ffa7ab41ddd7629188e5e292d8395aa0503bdb59d91c12fe7f992b81bb5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729420, "uuid": "3887ac9c-5cb8-41bd-b916-0c1fbb669416", "comment": "Malware payload (Mirai)", "value": "dc31a6ba2e79249c004c15b4559421ee49a13623", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729420, "uuid": "a18d76b8-00bc-4d92-9d8f-b85a78e25882", "comment": "Malware payload (Mirai)", "value": "cc236abc6ccf86dc041e5cd65e9a8fd8130e7d3aff2a41660614ab8ce46e50a15b3b4feba3da985aaaf68af900a716b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729420, "uuid": "74d54a66-6094-4e61-b44c-186296b8ad6b", "value": "T1BCD31B49F8D0CA63C9D427BBBA5D018D335257B9D2DE70029F146F242BDBE6A063F506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729420, "uuid": "67e061f7-515f-40cd-a43f-da26e073459f", "value": "3072:WV35Drc1tOaBxXR+NlurWn8atC5iR1lY4DnifSAQ1yBk0M5SceMHETaEX:WVGWn8a1XctBRMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729420, "uuid": "5c090497-dac6-4354-9ca4-d8ed0b9f5a21", "value": 140580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729420, "uuid": "03b34dbe-e450-4864-9b43-0f28ade058b8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729420, "uuid": "3435c4e3-82bb-4f16-a011-19745073093f", "value": "kaizen.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c39c917-61ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780752699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752699, "uuid": "4d102364-7287-43b3-8786-73ad77bfa77e", "comment": "Malware payload (Mirai)", "value": "61a8341555344e67e569d0ad4644f649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752699, "uuid": "35d74f5d-07af-4fe3-b6a6-8e2e7b7294dc", "comment": "Malware payload (Mirai)", "value": "2914e9d97b1ca2bc12a02e68b562f701d53fe974cb149515cdd59e9b8e2f467c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752699, "uuid": "6be9d3dd-3071-41f1-ba53-a2f20139dd2f", "comment": "Malware payload (Mirai)", "value": "9b7c87a1f82179852d58e42ab566ad8781deb2e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752699, "uuid": "b90f3ad9-7ecf-4742-b16d-6fde195f7a10", "comment": "Malware payload (Mirai)", "value": "feed57ef712b878a4d3500b63988a4616320f65e566aa67a7b09c1653260980e6db0212345d535001288ebe4ba8befb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780752699, "uuid": "97a4a6f3-2dc8-4383-9d53-07973cf6a44d", "value": "T15CB3F80ABF711EFBD46FCE3345A94709299D560621B93F3A7A74D818F24A18F09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780752699, "uuid": "fee86f8b-a3d3-4c45-afc3-7b1114c9c4c3", "value": "1536:gls2sYMBlxAN9bwBmYhYt6J8xhBQS9oj4dDb8HMY5fMoO95aqyhAexmKxNvR0C9c:gi7xhYt6J0XO91ctVqglS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780752699, "uuid": "82f6ab25-918b-4b75-ae2c-5b15337ce608", "value": 118148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780752699, "uuid": "f9c73b47-356b-44a8-b3e0-440022c571bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780752699, "uuid": "b3ac0d49-31a1-4f8f-b369-e08f3e50033f", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648c0058-61bf-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780761007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761007, "uuid": "5c79ff04-de38-4307-9582-08862472233e", "comment": "Malware payload (NanoCore)", "value": "3c68eefeb8ffaf783339e58e7e7a3e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761007, "uuid": "42b58b31-1387-473c-af79-c2e086b9d19e", "comment": "Malware payload (NanoCore)", "value": "2966628a54237ac01ae01f1f0d2389dfd2b7d5cb4e9615679fc146a62974a016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761007, "uuid": "4c9c7007-7e97-4607-a919-bb51e74addd3", "comment": "Malware payload (NanoCore)", "value": "b76a2887728af59edf3f0f27f5741e0d79f14f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761007, "uuid": "f606139d-a5ab-4548-b84e-64e59ad578b1", "comment": "Malware payload (NanoCore)", "value": "6c9e20a6ee22af69247a87c59f6cd9f5690629a8e08409956b6089a1ff1490defc306c8df4fe66e137168f5d6bb7d198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761007, "uuid": "d0d1cb24-828a-4175-9037-06e4806d3a69", "value": "T19514C01677A84A2FE2DE86B9A12212139378C2E7D8C3F3DE18D415B78F267E546071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761007, "uuid": "4c91a86c-f708-40d1-b345-3965ab22cf63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761007, "uuid": "1a611177-b08f-4a62-97e6-57a3ba1c347e", "value": "6144:MLV6Bta6dtJmakIM5ec0kTgdXi6Wv7zoEh:MLV6BtpmkZc1cXNYAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780761007, "uuid": "a96effaf-6fc4-47b0-89e6-cc98e882c4b2", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780761007, "uuid": "d339549b-5415-47b6-a6b5-2f16b79a2746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761007, "uuid": "6bf25c2c-328c-42df-a380-d6474e5581e1", "value": "bodegaycocina.com.co.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77693ce2-61c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780764475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764475, "uuid": "c5157638-b934-427a-9e90-ddb2c7af8cb7", "comment": "Malware payload", "value": "edb097c24e46edcf8265864e8212ec8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764475, "uuid": "bd1573d7-ba4d-445c-9316-39d3c14f505d", "comment": "Malware payload", "value": "2a1250c09ae34bb41dde29aa74c7f1e4c7fb9073c2ea9e175f94fa279fd76f15", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764475, "uuid": "ffe243da-de2c-4a76-9ede-c8744903c1df", "comment": "Malware payload", "value": "68b559bfe766cab55505f0d55adc094a97fc1fd2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764475, "uuid": "53a4d9bb-bac2-48b9-9617-2257af2515f4", "comment": "Malware payload", "value": "7d8c1931fa058b8d09fa8184ba0dbc3d801381597c2f329158c5c301893ac75014e8ae9d362d4c8013cc32c5e8b7840b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764475, "uuid": "81a9d47a-597d-4f96-b0ff-d8f766c1828e", "value": "T126F44B30B640D03FE5F309B5A42D87AA611ABE3217A558C7B3C41F6E56B81D19E32F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764475, "uuid": "c560d2fe-0862-4f82-a3d0-ab91455c48a7", "value": "b49abf9ac0d8ff78fc424d0e1b30e042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764475, "uuid": "6d3c376f-5622-440c-9a3f-377089004db9", "value": "12288:ASOTJwJZsJFJ4OBJ71LrKsfUcCBaUalmrMJB4JF0NSnE5xNcQlyRlSR5AX:ApTJwJOx98rZgJB4JF04EXNcsyRlSR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780764475, "uuid": "8ad15b6e-ccb1-41a7-9c63-80681f07dd28", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780764475, "uuid": "fafeea96-9013-4efd-baf9-db05f92574a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764475, "uuid": "d2a1490c-de25-4c27-8ff0-0420e1fc2477", "value": "s287.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bab69a6-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780748081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748081, "uuid": "4cdd43b3-2e42-4023-bf8e-ea6d80ca4cea", "comment": "Malware payload", "value": "f905129b147e63e3e4a8cd21548a8752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748081, "uuid": "cc05ce1f-625d-45ae-83d3-9281f29a79c3", "comment": "Malware payload", "value": "2b57f3f4a5173904b6ed9d1fb55218ec0320fc75e0c3485b8c6201bb9014077e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748081, "uuid": "fd7b069a-a355-4a33-bac2-3a9f38dbaa01", "comment": "Malware payload", "value": "6f9ee940f71e20ce804e0679ab68ff0bc78be2e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748081, "uuid": "9b387552-c43b-4da5-983d-21d8679889d6", "comment": "Malware payload", "value": "d40e9843f7fdadd6f9e332950d54a60a9623a2d5faffcd377d7cb368f0429cf1b58873a199f426d224111308cedd6d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748081, "uuid": "8a282b4b-75de-4d40-b846-09c8efb774aa", "value": "T18F84F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748081, "uuid": "71039f61-1811-4c8f-b74d-92a2357a8de8", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748081, "uuid": "ce8e6690-81b6-4c18-adcf-d2fe11745cec", "value": "6144:NrFZaaZmEJuhDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uRh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748081, "uuid": "57f9b9de-16f0-4b1e-9490-59bdc8d847fe", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748081, "uuid": "cc695bba-304e-421c-bdc7-9042efb689aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748081, "uuid": "68d6f294-debe-4a49-9d1a-90fcd6cc4d9d", "value": "bj0WrHWJA3xoCzF6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43110c6f-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746778, "uuid": "b763ed7f-d3a0-42cb-92bd-e3c5dcfd2cf0", "comment": "Malware payload (Snojan)", "value": "cc1f1a7002ef2b15563aed84ee58a692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746778, "uuid": "399f2a8e-07b7-489d-9dde-8c773e2247af", "comment": "Malware payload (Snojan)", "value": "2ce9eccb1341accda06bf43fdd9707d1feac2a0afc3e1c3931cc6ea7448f0673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746778, "uuid": "d35d0ed7-6689-4693-8faf-2207184617c7", "comment": "Malware payload (Snojan)", "value": "54edcb21fe0dd1334b00a65e5fd4db31c079e779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746778, "uuid": "80d750fb-b5a8-4671-b6f8-d10d7c42d294", "comment": "Malware payload (Snojan)", "value": "33c485aa13bfdb6e03a59b459519f2d167ba1a3bd2bd7dd9d84713dabab90763358cd0e58be799a4a3101cff314cf132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746778, "uuid": "93fb9fb8-3632-457e-a035-f67a6e1a7ddb", "value": "T15E345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746778, "uuid": "cb2b17d2-6900-41c3-893d-8ce3118ebbd3", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746778, "uuid": "fd063e83-c927-4de5-ab5d-b92e345c4574", "value": "3072:FJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/I/FnncroP9:PwDeM7iNEkgiOb31k1EC2J/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746778, "uuid": "b814c2ee-d5b2-4f7c-9f21-7265a0d0fc94", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746778, "uuid": "c6c2cae0-d61e-4004-8230-7f154e28aa1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746778, "uuid": "48f0e6d9-45e0-41c2-a511-56f87062487b", "value": "xPzs1J2FgP8Z2l9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4724428d-6176-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729605, "uuid": "11fdb7da-7a59-47a3-b795-f8fd3a4f782c", "comment": "Malware payload (Mirai)", "value": "d413ad5e5cdd8b7cd0d85774907f71db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729605, "uuid": "ec35e973-c0bd-4f9b-a2ee-c17ab485f2db", "comment": "Malware payload (Mirai)", "value": "2d3d2fa5b999ade6900aee5f932a87f833d1a5be340b164844c589a0b6f59679", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729605, "uuid": "142fa704-ec12-4120-8eba-4a8cbef4bb85", "comment": "Malware payload (Mirai)", "value": "e13d5d945f906498983b937052892218d4e39883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729605, "uuid": "34d60289-39e6-4b7b-bda8-fbf873dc19ab", "comment": "Malware payload (Mirai)", "value": "b13fecf58521c6cd75a49357837022f35a1388267a3a896c37f5cb6fb23d0232419415f08b4a38b6dd0f92e8e1975bda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729605, "uuid": "be900425-8426-47f3-aed6-d69dcb19ca90", "value": "T1EA2608C1B9A0C24AC63D6A31EFD9EFC8D2277E315CC45A4BE5D4F73E18B614484BA5A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729605, "uuid": "cc3b2b0d-f291-4f49-bfcf-5b451cb1cd7d", "value": "49152:0UEOZTktB/4lllUD+r8MZ1rvRfoyrdPu67Biby0V:0UEOZTUB/4lllUDy8AvRwPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729605, "uuid": "ddd6ba09-4194-4bd7-b678-ac8a17ce600d", "value": 4784128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729605, "uuid": "29e9abc9-26c0-4d8f-b137-fb1a1fdbb265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729605, "uuid": "a4f3087f-24fa-4c06-b6c0-e95110ad65df", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604fd149-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771308, "uuid": "f743d80d-cd53-4abf-b545-43642af6faf7", "comment": "Malware payload", "value": "d5cd4498ab4d080899221878944092f7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771308, "uuid": "fb9f5adf-6bad-4f41-ae21-582779079662", "comment": "Malware payload", "value": "2d4ae91d91a9869ff6cfafdea29bd76d655bc95ed27048180959f1234276a620", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771308, "uuid": "c6a0dd45-11a3-434e-8478-5535b4e12141", "comment": "Malware payload", "value": "3934c5237333d62a50c557b454dee57452a7b730", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771308, "uuid": "855ec86a-cc07-4698-a38e-6373735e9754", "comment": "Malware payload", "value": "74b710bba96189fe3b62e469c26f7eebac1913e7e86a21c5303672bd87d8efc1bda66f08c02cadbbc197003cecd906e4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771308, "uuid": "0e49581e-fe56-4434-a9b3-cbf2970e53ad", "value": "T11291CAE162B3A9DBC9309A311D17003567D46609F436F528CB3E47716EC2438985ABEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771308, "uuid": "6fd03719-bc52-444a-ab61-77f012e73b0c", "value": "96:dwIyjWnfpZJaK4y4n+Nlvy7BdFxFcIenTYkkhAXVwa:dyK4yDaJ6nTYksAFwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771308, "uuid": "9f267383-128b-4cd4-8f3f-877807c4771e", "value": 4262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771308, "uuid": "7e56424b-a7bc-4912-8806-671fc3a654b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771308, "uuid": "243a9a74-70f9-453a-a022-ada8480fcc55", "value": "MONTAJES_EL\u00c9CTRICOS_TER,_S.L_REQ_03060026_(2).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b895b878-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780771456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771456, "uuid": "e24879db-26a5-410e-9b6d-7226f1b2700a", "comment": "Malware payload (PureLogsStealer)", "value": "51dc3fb7a35ecda417550164a872db04", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771456, "uuid": "1f35d86f-426c-48e2-b90b-95023c7a572e", "comment": "Malware payload (PureLogsStealer)", "value": "2d6292ce5aedb2cf1b7bd9c3adcc53924188312eab99946c0cf5f0b1fc049817", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771456, "uuid": "0f001ee8-4180-4c8a-85ed-0181f6c6e53e", "comment": "Malware payload (PureLogsStealer)", "value": "bf3bc5a2755eb61a51ff046d2ea5f075d0bf8607", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771456, "uuid": "7cf7075c-19f7-4f29-a512-8861ad3b9ce4", "comment": "Malware payload (PureLogsStealer)", "value": "af6b4a47316d77b08bb2c72f5641a32e72bda99c5a183e3e04395d175ed69d3c53dea0e1e7f21e54b99a2d380ed374f0", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771456, "uuid": "285aac5e-d6c9-4d30-a42d-f92348c86caa", "value": "T13DB3120C25267B558196267C073019760856BE9F79C60CE6F0D8C7ADF9E48BEC0C7EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771456, "uuid": "9ba6ae9f-e7d4-484c-8488-acfcf59e4005", "value": "3072:aOubZrQIAcZ3mlNQttXWldWpmoOv1IJDshUA59h:a79ZSQ3uoONeA59h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771456, "uuid": "0040a013-792a-49d4-933e-c0c8f17edeaf", "value": 114449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771456, "uuid": "34503027-677b-4b73-9d16-2e2f2d46d441", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771456, "uuid": "5d6cf402-1e39-4e6a-bd8a-ed367d9fc1cd", "value": "PONoX34VIVRES5052026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fb54f1-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780771459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771459, "uuid": "769b77cd-533c-4af3-a835-741bce0b3a6c", "comment": "Malware payload (PhantomStealer)", "value": "9d9cdce2ebfd8c79eca923d086e72a5e", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771459, "uuid": "6efc00b3-3d63-46b4-bcab-fcb2e0278990", "comment": "Malware payload (PhantomStealer)", "value": "2d88643aabcdccdf1cb5fcb42d5597f3b230057820b17674f7764e1942530067", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771459, "uuid": "713ee71a-4391-43d9-a22c-1dfaf1f5bcf4", "comment": "Malware payload (PhantomStealer)", "value": "4ad12bfdfb196c16d5f09852791fdd71f495a489", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771459, "uuid": "b188f403-471c-4912-abce-64869205fc2b", "comment": "Malware payload (PhantomStealer)", "value": "8a4ca15bbde26cd936408d943e052084027863db59a2dca65fdc972bd78d4ecdf3b33918e243abfe8ae9d082f242986f", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771459, "uuid": "e95ac8e5-7774-41b2-a8e8-06785786f322", "value": "T1ABE1AF7A32B12DBA9449F8761161235FA22C345166DDDDD7A31468E8F43B801D0F16F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771459, "uuid": "eefa4d48-0e2b-4538-a25d-699edecc7d82", "value": "96:vIsjaN7zLNo1XdEPhaLb0JeA+NRwX0BjAzyZZN7mLTBGJ4bbSnBhFmUYBYHg32Pq:vW7Pe8eNRwX+AbeYghmUYBYHgC8dYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771459, "uuid": "d3640b77-cd30-415c-b606-c368d1b5f4df", "value": 7415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771459, "uuid": "21e0592a-35cc-4640-b461-8b7d658ef933", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771459, "uuid": "0475a8ee-627d-4929-baea-201930959576", "value": "scan_doc03750004.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3213f256-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746749, "uuid": "7ada8fee-f3ba-43a4-8f5f-b8477e2050a0", "comment": "Malware payload (Snojan)", "value": "520f47096760c9b97910750f6bf441c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746749, "uuid": "4963794f-0ae6-4cd2-8a92-bf8051b49f99", "comment": "Malware payload (Snojan)", "value": "2d9073ff55e98256f678094b0562c752fec3c04108b31df40a7c37efc5efbe62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746749, "uuid": "ca7e31e1-70a7-4b11-a00b-9caee7280be7", "comment": "Malware payload (Snojan)", "value": "dba5184d45af743e56cbac1dbaba2f9f9ba4a277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746749, "uuid": "f4d109ca-07d9-41b1-97da-8824366a47bf", "comment": "Malware payload (Snojan)", "value": "bbfe78a47121af6d59a4b564cb7c891d668a9a9898f78edc6c6118f39a94e97af7f299b81f0c68a9ecb7114839e9618c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746749, "uuid": "b3089ad7-c976-42d9-b3c3-d3aceafdc97c", "value": "T164345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746749, "uuid": "ba3010fb-48cb-40bd-be8a-aa41386c4705", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746749, "uuid": "7001e579-a2d1-49c3-b7e1-b156b38ed66c", "value": "3072:FJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/S/FnncroP9:PwDeM7iNEkgiOb31k1ECEJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746749, "uuid": "f9e28495-cf69-4dee-9bd1-f0c72422132e", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746749, "uuid": "578a83dd-db5e-41af-87db-bc90890ff6c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746749, "uuid": "c11e2430-22fb-4fb0-a1f6-bf7bb845fb74", "value": "NLqILYoCB2rwaqdu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e020553e-61de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774529, "uuid": "4771d9fc-d2bd-4434-9a63-0b80b248b42c", "comment": "Malware payload (Mirai)", "value": "3b2aae2cdc33acdf2264ba82b4aa24be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774529, "uuid": "f578b4d9-22c9-4203-b467-378009c54af6", "comment": "Malware payload (Mirai)", "value": "2d9bd86f98e00aeae196d03d8650fa5b69c0c29cbb4239bf7858888e1bb8a1fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774529, "uuid": "e84ed24f-3c72-4a59-b66e-eed7f5cea43d", "comment": "Malware payload (Mirai)", "value": "0a841897745dd747f4e470210ff2f1c3cecf7ff7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774529, "uuid": "8cf04f2d-d4ba-4613-9ff6-2030a6e33771", "comment": "Malware payload (Mirai)", "value": "1975635a9e13859946b98419607a022617fa8d2b8eb6da3aa9dc87b03fa84f510a47e92eefef65b3dae8dc471993575d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774529, "uuid": "1ee9fcd0-3904-41d0-851b-766c9799673a", "value": "T1EA4302EE6A4D2855EDBCCE7F11AB077988E5D6463B1DCECC5302C105DF4358EA0EA0A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774529, "uuid": "e8657c54-c416-40e4-8c95-970efac902ee", "value": "1536:Ax5wiumbVC9oAr9tG/VXB2dM/EKlgp3/ne8Pr9NH:A3oGeoABtaxB2ucxE6r9NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774529, "uuid": "b1a9b8fb-7f5a-46bf-bf7b-db608b69e4cd", "value": 55868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774529, "uuid": "e8ba79ff-4d5b-4a75-8047-27bbc8aa3066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774529, "uuid": "1fb4a163-d753-4d48-af1f-6ea98f18854c", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42734e6-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777462, "uuid": "b597002d-6268-47e2-8d46-f7931ba0ae3f", "comment": "Malware payload (Mirai)", "value": "bb9dde710c9374c9c2c784fb41fc5adb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777462, "uuid": "bfe8c774-b606-48ab-9295-4fa63c2a29c9", "comment": "Malware payload (Mirai)", "value": "2f06d897b9b178512c715942f6ed54d4d0f67f03fdf5cf338b964683e9c0d022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777462, "uuid": "01732ca1-48e7-457f-a090-d2cac865bdac", "comment": "Malware payload (Mirai)", "value": "aa6d903be439afb832065ac0949b1e8398f7ce78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777462, "uuid": "4b39f0ba-da10-49a0-87f8-7f976d59b601", "comment": "Malware payload (Mirai)", "value": "190204753b366ad7d1d1ba485d7ad474f17cea57135d94b78bd4fdc2da1c8d44bc27fcc775b7d0fa28264db8e6b0d610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777462, "uuid": "dd92bd43-0cfe-4b2d-a1ac-ea3ef43114f0", "value": "T13F83F685FC819A15D4E823BEFA6E018D3363576DE3EEB1128D115B2433CA91B0F7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777462, "uuid": "ba74382a-290c-4e9f-9fe1-7cb0e40e8662", "value": "1536:LcngmeKKJ0AYaX/Y9Zq6dmoLmpMguHcUXVUHalw7W7uH0psfC96kxoGSiq4xDQuD:We4SoLmpMguHcUXVUHalw7W7uH0psfCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777462, "uuid": "7a5a7851-9de9-4c3f-89bc-fe440c81e7ca", "value": 81996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777462, "uuid": "9505b583-5615-47f3-9efc-cd95a06876e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777462, "uuid": "5719d379-fdd7-4f7f-9276-19814a3eaf3c", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b77a58-61c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780764474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764474, "uuid": "6be0b89c-fd5e-4aa1-b528-793a6099b8cf", "comment": "Malware payload", "value": "8c8470ef932014e9a034820656e68f89", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764474, "uuid": "c74872a0-089f-4bac-8b36-311531cde7fe", "comment": "Malware payload", "value": "2f25dcf66945cd695580f83afed2a76fbc0051ce64f1089e19b04c3cfdabeee4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764474, "uuid": "97eadd7b-9a06-45ba-b473-d44b7e390fac", "comment": "Malware payload", "value": "0512f04369d8761112a6313213b403eefb752735", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764474, "uuid": "86369d33-961f-4fec-9c1a-a05459a3edee", "comment": "Malware payload", "value": "840c01a72b1072f01db9fae98ec05f1f8534c70b39649c1f69a2767cd37be9de042179d3d149ae8e0c551f8640221c0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764474, "uuid": "0f4c821d-13ed-4c96-af57-9cfbfe046028", "value": "T198146C4777E521E5E5738678C6658616EBB1B4322310AFEF07A08A1A5F233C1ED39F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764474, "uuid": "55d781c3-b48b-4740-91a4-0f4d542d7025", "value": "0be878847a955d68de7730bad92f9303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764474, "uuid": "33cf70ad-a187-4edb-b22f-c5c86a54d450", "value": "3072:sjsraqe1ZYZ/QOVQkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:sj2e1ZYZ/QODyrWpAKhhvORHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780764474, "uuid": "d71c9eab-5dfe-406b-bde6-2d4cf91072b5", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780764474, "uuid": "078a3d2d-9dd3-4a9d-b48f-cbc2cff4b19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764474, "uuid": "da19bf0c-92f6-4582-8a4c-06db241fef8a", "value": "20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48281385-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709420, "uuid": "659dae73-3668-41b2-b04a-e1ba6aba8483", "comment": "Malware payload (Mirai)", "value": "bff8960dfd8abe80664516c7223abb44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709420, "uuid": "4c5097bb-b66a-4a94-a2f1-cc1a6e69686a", "comment": "Malware payload (Mirai)", "value": "3040524f603723512701f2bcc785814c2ca2d842a52d4553907ee996a3bd3789", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709420, "uuid": "16ceab21-58ec-4001-a008-95522ed6ebb4", "comment": "Malware payload (Mirai)", "value": "cec5d500c81a40326d7a384457c41d557c424350", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709420, "uuid": "e5c95ec3-3a7d-4567-9c83-a5b2fa1dd992", "comment": "Malware payload (Mirai)", "value": "18cb64b06f444c9f18ec14d1ad53e54de1d674104cd4074d90a2471faa23b53e9cf0f2f026ed2a2628ba5b2e2f2bce7e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709420, "uuid": "541426ae-f32c-4acb-b1a1-87675033483a", "value": "T107415BC943D0A04EF4DA8D017CAA89756086A5D221FD2F08DEB02DB2E5FF944B3F9755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709420, "uuid": "8ec57673-b224-47c3-a2e5-30e0c69524e8", "value": "48:sBOXVxWHlAwyqn6JoAB5767+rbdUKZW1xuFULUlZ/rVoBKYHHZuFAUf3KI:r+RyDtBBWON7ovkFiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709420, "uuid": "c129b007-af2d-4334-a540-9abaf155ca38", "value": 2041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709420, "uuid": "97d8cb76-33ae-4743-bdb6-cf2a8c43da83", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709420, "uuid": "cd4ebd61-7e2e-470c-8bdf-f7b792684931", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc53d510-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780771463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771463, "uuid": "4a22736b-deb8-48f9-8163-b811910a8903", "comment": "Malware payload (PhantomStealer)", "value": "036ba29a0c5b36773ea1c6dfc55d2575", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771463, "uuid": "6da9a2af-f8bd-44d7-9c0e-7b7f392feb0d", "comment": "Malware payload (PhantomStealer)", "value": "30ede84486455cb721d4da7513b2c050e67fe4473e84f2df1cffe3fcfca5c0e2", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771463, "uuid": "e588af67-fe1b-4939-9bba-1e424c8e1253", "comment": "Malware payload (PhantomStealer)", "value": "77a34f3c8b79a670697ff041342843752cbd67b4", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771463, "uuid": "913134e7-e260-43ab-a4f4-8f54696e6c0c", "comment": "Malware payload (PhantomStealer)", "value": "9b14998224df27d01ebcb518c6a0b5036f075b02811ff7c8543ace669daa7c73657af6ab36080f16b773c54b418dcf6b", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771463, "uuid": "b6be53e6-7122-4027-8952-87c554c50b18", "value": "T195E19E1D65B8F6267E4483CA6992E4FD72CC4DA120ED3C6A51E719E241002ECB3B1FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771463, "uuid": "bfb04961-eed9-44bb-afd8-f8f2e8f39d71", "value": "192:JDgVpJm6r/XXowl/Xq8pSUyui6TprZHJXPmpbAy/DkfMA:JDg1nr/XYePDQDRSrCmfMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771463, "uuid": "dda76f0e-0c34-40bc-93c5-ec9a0d71fd33", "value": 7435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771463, "uuid": "b904afa0-4e9a-4187-af7f-f220f5989cff", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771463, "uuid": "03cebc66-925b-4361-9e92-327272c3079a", "value": "Quotation_RFQX0465732_4.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582165ae-61d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771724, "uuid": "ec262a41-8925-4509-a8e1-da6ce1f664a7", "comment": "Malware payload", "value": "5851aa74a5d9e1d34ef4f6a93a179f17", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771724, "uuid": "75dfbd1b-04bd-40a9-aaa1-b412fd9f4590", "comment": "Malware payload", "value": "31806a4d42c9adfcab0b03872b9391ee349d38de1418b2b2339b75ff33a22c73", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771724, "uuid": "939c88d5-b824-4e51-9d5e-3c6e240c1d97", "comment": "Malware payload", "value": "3b270e6e4655b567fc933677b829048228b6b5d6", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771724, "uuid": "83fb8a7b-24e9-4147-9c03-d2ad8e85361b", "comment": "Malware payload", "value": "17826b08acb8d2d5d6f915e133c275c1efbe54dd7f13a5489f2b5c97d9d38c95260d5067f9e6d3e4e3c8e850db6bc997", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771724, "uuid": "f202e507-1ea7-4427-810b-edf626ef0729", "value": "T16908337D9A2B933EE87388361377FFA5C5D5862B53311C6F534D2020AAF214669E422F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771724, "uuid": "9ff630e0-0828-412c-866b-a9b85076a906", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771724, "uuid": "573a199e-7563-4343-9267-a7d900f75ae6", "value": "1572864:bt9IKPakWyvfiZT14QRWYXxjXDS1nLzNOX3151WF9dVEpzfWu+mRL7:bUKikWyXiZaQRW0xS1NOH1jWvEVBRL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771724, "uuid": "ee1dc953-39c0-428d-ab23-272d7b9111e7", "value": 77424761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771724, "uuid": "0804dfda-7e05-4656-a1eb-6aa7bf9c63aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771724, "uuid": "ae042eaa-1340-467e-b6ee-3c34776430eb", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758228f0-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729253, "uuid": "579ff91f-d759-4b60-b25b-ee1e36819821", "comment": "Malware payload (Mirai)", "value": "2921db358793476e0ec6a148091a24cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729253, "uuid": "94c50c87-4e49-4403-b267-5408bd64683a", "comment": "Malware payload (Mirai)", "value": "31f9b594df424117bb6aa354106f60448179c507fd743d8d5cc8b4a6524aee2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729253, "uuid": "bad0baf5-14c9-471a-871c-abe22ffdfbbb", "comment": "Malware payload (Mirai)", "value": "c7d5b60c8d1528c4e0fb903b36a44269fe950421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729253, "uuid": "7cf5326b-5fbf-4ac0-b8cf-acdeecfae4f8", "comment": "Malware payload (Mirai)", "value": "e079c19cb815610865edb65141af2fc95496a7d8cbb2134ce3bf4eae12885b012b2ca84f039ea153a764b12a81c1f653", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729253, "uuid": "5535137c-07a8-4972-8613-073d3abfde07", "value": "T11DC4D0C777023E3DE0BF993AC9910F166B36A3950183671F6078F95AA92317D2F22647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729253, "uuid": "51c9801b-7ced-47aa-8f51-ea0fcecd16c0", "value": "12288:mRqaw2qXJ/ZQD7g/yBbxkdrIo3K0yMNTSKAhVcC:mjwtXVe7g/ab8srlVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729253, "uuid": "f87209a1-4aa0-404f-af85-13743d950763", "value": 566816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729253, "uuid": "4b25881f-aa06-4fdc-ae78-a25a17e0aaa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729253, "uuid": "ef71f110-a800-4188-8bcd-0140639e6a28", "value": "kaizen.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e51722-6158-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780716669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716669, "uuid": "33c23165-96ff-4bb0-8291-ca8d9d171f2c", "comment": "Malware payload (Mirai)", "value": "8e70f434ac55bf2b33f6f6ae3c237479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716669, "uuid": "ed511c72-8ddc-4831-88f2-b1e7b8a3066d", "comment": "Malware payload (Mirai)", "value": "322068ab6ac4ace4fd9d67b650a87717a5ce15bfb5323ddb7cab6c5e8b04cce8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716669, "uuid": "52181f5c-27d2-463d-ba17-ca1de0a5ca3d", "comment": "Malware payload (Mirai)", "value": "303c09695dd2b331dcf0f2390049daaaf8990b78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716669, "uuid": "f7844065-0d55-48fd-8425-cfac08de9b01", "comment": "Malware payload (Mirai)", "value": "7c41d51e2188ca6966fa572a445cf9a8e7585aee4caa91ab13fa60180a2433ba762e23e6e16b742fc129529707b17460", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780716669, "uuid": "82464764-a511-477c-88a0-7c9d32d73ea3", "value": "T14F75336F5942FC8B953795F3319E096DB1CE35155A3F8A78A4B29C88C3ED4E34A1F088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780716669, "uuid": "4e53124c-53be-4a57-8d81-2d31bc65f103", "value": "49152:r5lnb+ha6ncJlmMk1Qaz+D6eBzadgYHZ0E3Efu9nCFaOxvRh:r5lAFMkxIrhSTHZ0E0G9nC0OxvRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780716669, "uuid": "292ad339-3b1a-4863-89dc-fa445dc1976a", "value": 1675524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780716669, "uuid": "52e97bf6-b7f2-4e5c-b8af-12ef022b84ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780716669, "uuid": "e476ef2e-83bb-41de-bd2b-d3aea9b4e69b", "value": "SecuriteInfo.com.ELF.Agent-BQZ.73916246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87946334-617e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780733149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733149, "uuid": "99f4c654-eb2a-4003-9d83-d11369aa647f", "comment": "Malware payload (Mirai)", "value": "57cea8b4d663262c1cc087ce96eb78c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733149, "uuid": "7545c717-7590-4267-8dec-6977ea8c02e8", "comment": "Malware payload (Mirai)", "value": "328112f973da8f2c0b42153569b045ac5287e7797072d8b04623f9020430ea44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733149, "uuid": "0b2b2e83-52f5-4627-b4b1-7bfe02c56963", "comment": "Malware payload (Mirai)", "value": "e35018f08d477d4265be63863bcc4aff0f1e42b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733149, "uuid": "68569f7a-bc80-4d40-a0f4-dede142598f5", "comment": "Malware payload (Mirai)", "value": "6e25ea4093893596fa1f73b8a7189072762e438a3282b0f596bf46685093ec7cab3a101c3776099585ad70e228766c1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733149, "uuid": "f75c9551-855b-49e7-8544-1ba364bc5d7a", "value": "T157D30845F8405F23C6D112BBFB5E428D3B2A17E8D2EE72079D256F20378695B0D3BA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733149, "uuid": "dfed9269-922a-48f5-9ea3-9569399f3e4d", "value": "1536:3j12TALH2ahquEt7Qlbx/NZ28E2UAj4VxRKTNlcbOaQ9OtuDA1llMwywIyBbSZbU:3j1wulo8Em45K5l9OtajZWOjhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780733149, "uuid": "04b7f38d-b24e-40e8-8df5-5ed07266c75b", "value": 137856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780733149, "uuid": "79da9855-b1c7-4932-a84e-798fa77d360f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733149, "uuid": "f7c29fdf-7a84-42e1-bc1f-f5788e1d9a1e", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48eb2b7-61bb-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780759504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759504, "uuid": "522dfbe8-5d45-40d6-8eaa-be4a4078be5d", "comment": "Malware payload (NanoCore)", "value": "f39d6c7e6565a098d510f5e4afa546b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759504, "uuid": "01eb6806-1405-4ad9-a624-c9ebdf1fd98a", "comment": "Malware payload (NanoCore)", "value": "332ed43c195f4a2f045a5269e2180ede202be688519160561c83d0584d353069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759504, "uuid": "4d984194-bb66-491b-bd00-5281328901b9", "comment": "Malware payload (NanoCore)", "value": "02002842034e9273affdd12ad0d95bd8827bea96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759504, "uuid": "9fb219d6-026a-4987-bc05-09db2d595a0a", "comment": "Malware payload (NanoCore)", "value": "14308cca86c82b662588c6ef2e7cf9606ac888340cd27426fc3990a0da1cd2e7957515efcb6905f362d2d95a788c8bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759504, "uuid": "69346746-3e69-4175-b5b1-085a0c13e5a8", "value": "T18514CF163BB94A2FE2DE8679212202528778C2E399C3F3DF18E455B75F163E44A0B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759504, "uuid": "010e2b92-f862-4667-a16f-f14e4e2f5dd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759504, "uuid": "e8e2ffa4-cf65-4071-8f86-ea71781585e0", "value": "3072:UzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIM+Cw9JwT41pn0vDajY0bHLm42:ULV6Bta6dtJmakIM5YVnoD8HiV9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759504, "uuid": "fdeea3f3-72ee-476e-ad35-92142a6363de", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759504, "uuid": "84acb4d9-0dee-465e-8d6d-540f6e09b42b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759504, "uuid": "4b8788c7-4444-4012-b72c-e59c1874a062", "value": "j88vip.host.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45417e77-6176-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729602, "uuid": "bf8a6e76-28f9-4c9b-ac99-928f43b3c4b0", "comment": "Malware payload (Mirai)", "value": "676449710739e1b306cbc752e2e7e813", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729602, "uuid": "7d500d38-9e62-4788-a2b1-f5ecc44697e3", "comment": "Malware payload (Mirai)", "value": "3352d437537c84be0834ef915c6e77747678368fc7d38d9ecbcd375f57647d0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729602, "uuid": "7ed9cfec-3e4d-4dc7-aacf-ba8087bd23e4", "comment": "Malware payload (Mirai)", "value": "355940402b2c39f9bb7baedd8edb51c01c75768b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729602, "uuid": "2446dddb-83b3-4ef2-a62f-df93c6cf5f82", "comment": "Malware payload (Mirai)", "value": "c98dad6c29a4844ddc802892fcc57f9d5c897996e81040485c2c6bf3f7bbf1dfabf344a2c73783c4ff5bc44236d49b59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729602, "uuid": "2b59763a-9564-4253-a5ac-c3fe9931e464", "value": "T1D0262A57B8918A83C4E4267ABCBDC1C433675EB99B9B12675D00FE3D3ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729602, "uuid": "3407f20a-670e-48a4-a94b-b6dd8dee28a3", "value": "49152:6iWjNRLtU+x3JcT6urr9w2dmxYKYU1F1:jWjvLPx3JcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729602, "uuid": "466ae538-16dd-4810-92d6-914cef68910b", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729602, "uuid": "6b0b58da-4b27-4beb-afcf-cad1429bd7c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729602, "uuid": "4fc30d02-7821-4cca-9b56-08b20f791871", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a0131a-619f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780747314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747314, "uuid": "1e8cd80e-e82f-4b02-8cbf-ccc46096f188", "comment": "Malware payload", "value": "bef897851dfae855075a5cac012d6a10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747314, "uuid": "e6c1ff59-6694-4138-bf04-f7db847120c9", "comment": "Malware payload", "value": "34ea6a7739eab6741c7334866e1bf354d0d6862a3b5938e3537a25a0ab1d7580", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747314, "uuid": "7cae826c-58c2-4890-b85b-a7e1c5d0959a", "comment": "Malware payload", "value": "738a78f8debe430312311280101bac8e5cb7ccbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747314, "uuid": "744e97ca-7a20-4c6b-86da-e55ab692ac70", "comment": "Malware payload", "value": "2fc85a3ba30f328f7003d2ea05998d33f1e941eb34a49e41c66134f1174aa8fc091c0dbd7ae4a62450d6343152fc22b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747314, "uuid": "77b718cd-05f4-4422-b181-dd00d9ff691a", "value": "T1C8F3021646DB58F7E49B12BD469D9063B2FBA06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747314, "uuid": "8a3b9e79-a652-4654-9603-e484ce90f366", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747314, "uuid": "17427bc9-9be9-4dfb-9658-6b0437f87e05", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+5K:QJ0TAz6Mte4A+aaZx8EnCGVu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747314, "uuid": "9bd2b8ab-9bf1-4691-a3c4-468a2a4157a0", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747314, "uuid": "9fe19a51-75ad-45cf-8916-d7595506d3b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747314, "uuid": "15285877-6f11-48d2-a123-7819e2a4a785", "value": "HFdLrokfg6s2uZzw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecfbec4-615d-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1780719095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780719095, "uuid": "cb4ccb82-c67f-4725-b1fe-85f79448a346", "comment": "Malware payload (Berbew)", "value": "189a6b289c59184eed51ee4980861472", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780719095, "uuid": "2172581b-950f-4f7c-8489-1e0723511144", "comment": "Malware payload (Berbew)", "value": "362df35906c51bcf799b7afe4f85dcf721a286a9a68c38862eefa2cdb403ba7c", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780719095, "uuid": "cf3f5c07-8270-4344-9cfb-edb2e9a3e3cc", "comment": "Malware payload (Berbew)", "value": "49d1b0cb0107d97eb91186b673bcabb8a2a4ae7d", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780719095, "uuid": "886beab9-1d66-4586-b38d-ea26be3e2bc1", "comment": "Malware payload (Berbew)", "value": "8e7c3ae9c2c2d72ecda1bc8a7f7a7b5f60258058edd119ca0dcb2b961bbdf18b189a0907de68de9defb53a57c7d8febf", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780719095, "uuid": "63e7271e-ee39-4da5-ac23-ee5a310d0d32", "value": "T104938E27B2F54E52C99D02F214939BFD970743F8F22797991878E2583737B3062E6A90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780719095, "uuid": "752209c9-60e0-4776-a9c9-b7c0103f00d1", "value": "5ea15a9145b2a4ebd1ffff42444ad78f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780719095, "uuid": "25803a16-20fc-407f-b697-e1099e702f70", "value": "1536:nzJ4mi+WF6B/Mms/KK0/TG65cKSDCK5TgskULU3/O53q52IrFzTXMtDhGJ5taRFa:z2mFJ/Xsw/v5cKSDCK5TgsjA3/g3q/h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780719095, "uuid": "f880efd6-2a77-4ab0-98a8-ef4df5f71a40", "value": 95888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780719095, "uuid": "e0336f9f-2769-4de5-b9a7-b9846f3c41db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780719095, "uuid": "4b27c6d0-fcb0-450e-b26b-04a07be8f2a6", "value": "362df35906c51bcf799b7afe4f85dcf721a286a9a68c38862eefa2cdb403ba7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bd201c-6157-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1780716239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716239, "uuid": "fcd8f992-c763-4eb9-a04a-123baa3fb0d7", "comment": "Malware payload (Amadey)", "value": "2e0d25087de57454f6e4d6cff2be73c9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716239, "uuid": "8496a152-f236-4567-83f5-2947bd70e526", "comment": "Malware payload (Amadey)", "value": "368ce35222791d00f2bdeacb1206b7f54898f5f847d290a85c7cffde8c8f0d2e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716239, "uuid": "e7a55081-65f9-4b21-ae46-b4f6b7c6f9cf", "comment": "Malware payload (Amadey)", "value": "ec0a12e5b6387c7654664a17abe53d349c5b9aef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716239, "uuid": "7b423c54-7365-46df-a98d-baa7166ec56e", "comment": "Malware payload (Amadey)", "value": "7cfbd4dcdc2413911a28de5900e450018bc0836be57a520cc5d8fd998e5abf443987484000cbd3e38a4c19da08c5955c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780716239, "uuid": "05b11a27-95f1-4b45-b1da-13663cd03da5", "value": "T19B66330727A6A4D3E06749B94B564888E32A7E730794DB7F5ED143270E2E4E05E0EF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780716239, "uuid": "73d124c3-4269-4a61-91ab-38ef4465b18b", "value": "753375591aacf62c29fa5daa215a217d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780716239, "uuid": "01fa5df4-d94f-40f5-a09d-42ae7bae5eaa", "value": "196608:wD3InTc8GG0ecdPZbiL3n7D5eid1rKyT:YIn5gdhba3YiDmyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780716239, "uuid": "6cbcb5c6-10cf-4feb-a350-f6d542b903fb", "value": 6558720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780716239, "uuid": "4d412ba1-81d6-443d-9e95-09f31d573707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780716239, "uuid": "9e92cbd7-443f-4def-998b-59e8a8455297", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44558ab8-616a-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780724446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724446, "uuid": "ad3163cf-cb96-4c2f-8faa-e2c24aaad430", "comment": "Malware payload (Expiro)", "value": "2c36095ffef64ee6cdabe0e9db0ab0cc", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724446, "uuid": "fe2339b1-f87b-498e-97e0-fea34bd9b183", "comment": "Malware payload (Expiro)", "value": "36a5d5d8e948bbcc4a61fe06053e8657467ea9bbf563a529735cc1fd51679fd6", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724446, "uuid": "f3431c20-fea9-49da-9fdd-0211d12549d3", "comment": "Malware payload (Expiro)", "value": "387bcc7c6bb064ca896642a2c785a34017d3c570", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724446, "uuid": "8675664c-d6b0-43ef-9638-68f2d7f9aec2", "comment": "Malware payload (Expiro)", "value": "8793c4c9d2a02cf4ab3a1a95de4baa510c87f2870d562966513b882e06728039cd5db186e35589685184541478afee07", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724446, "uuid": "e9002d0c-7292-48b4-acac-49d41df9ecc4", "value": "T1CF369C5E269859C3E8AA413496C50315CAB2FD0C27D18ACF226976CE4F7B3E27F36711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724446, "uuid": "198e3204-da40-41d6-9557-349c75800174", "value": "865c812e4e3e6e8c398a0757574c8da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724446, "uuid": "9bac0dee-5010-4b8d-9a89-6734ebf0eaec", "value": "98304:R9jZqizBqvCNLLH5HcjDabv2WTrMDhwtLm:R9jDzBqvCzHcjDar5Tr8+tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780724446, "uuid": "731bb9be-d163-4ec2-a40e-04e77462038c", "value": 5161984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780724446, "uuid": "a53aa670-4a01-4278-9a16-6b218bde9c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724446, "uuid": "839cc2d4-9e96-4432-a50b-3ed8f815661a", "value": "36a5d5d8e948bbcc4a61fe06053e8657467ea9bbf563a529735cc1fd51679fd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b9f0d7-6196-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780743346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780743346, "uuid": "5a57f9e1-68b4-4193-be6b-2a20c6803cf7", "comment": "Malware payload", "value": "178d327d87243a6d937ea9f1e4bcb20e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IronWorm", "colour": "#B4F703", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780743346, "uuid": "3e40f803-61c6-4a5c-8a26-8c91bca79d5d", "comment": "Malware payload", "value": "36abd242ddaa27f0160c539377a0e92cf781c1695137850acc87e3892b436d36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IronWorm", "colour": "#B4F703", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780743346, "uuid": "d84a2349-c5ee-42bc-b626-8496b7bb8596", "comment": "Malware payload", "value": "7befd633f4744a436ef6d122381276c43401be3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IronWorm", "colour": "#B4F703", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780743346, "uuid": "7d6d1f39-3edf-4960-8efe-e9af3f03eb40", "comment": "Malware payload", "value": "85b8dd463a2a326807dac37ebe17f4c2ccff2a3331618d1265b483bcb52a72a5598ac9c9f6fea92e37586b21d4e837f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IronWorm", "colour": "#B4F703", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780743346, "uuid": "20510a7a-0978-4b37-969c-2806be10058f", "value": "T10C2533AB0025062B904D957A58963BD279C17C81AFCC3662664DAE742FB59C3CF63FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780743346, "uuid": "77427bdd-b549-457e-9487-fe3ac2fcb75d", "value": "24576:WWbfOV5FMxYHAoexxzxYp3cy6CUo5KCfSWL6J+/hSw:NbfQ5FMmgvzxG3J6h0BLL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780743346, "uuid": "a95688f8-72fa-42b2-90b3-37530f9b5754", "value": 976568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780743346, "uuid": "9fd2790e-4cbc-450a-8d71-a6f8b807826d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780743346, "uuid": "875b3e5b-fdd9-4e41-bf43-617c0c3563db", "value": "postbuild", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2422c979-6174-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780728687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728687, "uuid": "08c3d87b-d60e-4ec9-9589-be092021c9ba", "comment": "Malware payload", "value": "06db615ffb60030ee5982e9c255e60c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728687, "uuid": "71357be4-ab57-4951-bce9-b3d862278d49", "comment": "Malware payload", "value": "3834cb159a3b63502ff738840a0a68b55901af7871f33a4b0d78be92498c8ebd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728687, "uuid": "85651dc6-2945-4421-a1b2-6b5aa15709fb", "comment": "Malware payload", "value": "8f7b9c614b444bda0c2cb65be2d104331b08e718", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728687, "uuid": "6ea4ccff-f70e-4b80-a60b-ba3c02e48282", "comment": "Malware payload", "value": "e6311f85fa6ad74b541ec519e62395d751326cc64df531317932938a133af0fd5f5a4a0174842202607dfa8512ed9cda", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728687, "uuid": "30cec2d1-e26f-42a1-b926-681b80fb9ddd", "value": "T1B34138EBAC2075347C18881F768A30D48C424EF764623E5D7E4EAD2B459C68EB37ED64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728687, "uuid": "9539dd75-0609-433d-af9e-70870f74591e", "value": "48:c5hUwL771vji2771vynjKh771vBvmk771v48L771vjZooO47CJ7CK71247C2b72I:cIwLNji2Ny+hNB+kN48LNjZooO4WJWKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728687, "uuid": "2a98033d-716a-417e-947a-0509b3c63df2", "value": 2421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728687, "uuid": "f641fc35-0f72-4a03-a2b0-65096640e56e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728687, "uuid": "3ec88542-7265-4cc4-a61f-2425a4d2626c", "value": "dlink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eec69dc-6183-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1780735228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780735228, "uuid": "f6f6a6e7-b3e0-48a6-8cd0-765d5f185676", "comment": "Malware payload (Berbew)", "value": "6394e360fdd813fc4a0449c22cbac738", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780735228, "uuid": "98bd81a2-f8e1-43a6-b9c5-407cac178f40", "comment": "Malware payload (Berbew)", "value": "38672563bb7cb452e4b66ae246f99ca20bc64736a204642760c78e6a9a799d71", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780735228, "uuid": "a6881f5e-f814-4dae-b728-d59ace4316f6", "comment": "Malware payload (Berbew)", "value": "fadd3a750ba98f565abc134e48aad5a8ce0ff576", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780735228, "uuid": "c493c07b-307f-4c2d-afd9-815897dbab8b", "comment": "Malware payload (Berbew)", "value": "f6f7d42a314f307c14dcda55a373f995a7ec39e67c7cefb223b3679ef49992664df45bb0d050c51da4a9ddf6a09544b3", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780735228, "uuid": "6121ad83-11cf-4bfe-9f67-7e271b9bb513", "value": "T1A2736A6EA3A61FE2C9D80FF1143A7F06C614C27D45274EC53069C22D0ABBB4C9AF569D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780735228, "uuid": "e542cc02-2a05-4858-8a0a-8d6e53074845", "value": "d864d432c435ff40afe711bee7daedce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780735228, "uuid": "b0023b3a-fb6a-4aa0-ae53-ea9727b0c934", "value": "1536:rqA/4dwxMhVSlwVFty8lqc7/fQie46yf5oAnqDM+4yyF:34uxpwpy8lIiRCuq4cyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780735228, "uuid": "6e55bb1e-8eb3-4982-9562-83fbb0a0270e", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780735228, "uuid": "b9f2f9e9-7e89-415e-bea7-03a139ff4f0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780735228, "uuid": "49009b03-eb85-4be6-818b-6cebc13156a6", "value": "38672563bb7cb452e4b66ae246f99ca20bc64736a204642760c78e6a9a799d71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4818b8ae-6176-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729606, "uuid": "4e1f37df-7670-47f8-807c-acca61ef0443", "comment": "Malware payload (Mirai)", "value": "2ecaab3ec5d865c21f8f920e37d87ae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729606, "uuid": "3e79e658-a7ad-4f51-85c1-60cee1a79a72", "comment": "Malware payload (Mirai)", "value": "38d4c14e5c9feb99f5693c7db31c354266313567218efb8fe94665c2245871e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729606, "uuid": "d9d2631f-0624-4442-9f48-063bc1a96b6c", "comment": "Malware payload (Mirai)", "value": "467d503bfe673a686ad677eb187e72079e5949fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729606, "uuid": "876f4a92-78d1-45cd-8992-5def57f365f0", "comment": "Malware payload (Mirai)", "value": "2b3b4880f4f40d383b1c0279b041384791fad7cfdf72d4da4f21c31954645821610f914ebbd33ae147c1f44ca523dab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729606, "uuid": "f9aea944-0ec9-4267-ab77-5b8581fbb3f3", "value": "T1C2261A57B8918643C4E4267ABCBDC1C433635EB99B9B12676D04FE3D3ABE2990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729606, "uuid": "cf5d945a-c010-469a-8099-88aa65c9bd06", "value": "49152:mo9KTXqzZFpev0/nm9CNJ1WYoD/1U1F1:R9KG/pev09Kb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729606, "uuid": "3cfd7ee4-fcf3-450a-ab14-9b6525bf4f37", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729606, "uuid": "040411e8-d5eb-4754-b3c9-f584808f1e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729606, "uuid": "9d2f1333-773c-414a-8c33-f3ab854e4997", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbcc043-61a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780747787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747787, "uuid": "dc250b58-09a8-4172-bd82-0a988458c7ae", "comment": "Malware payload", "value": "78cc4d921b6813df96029532655b33b3", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747787, "uuid": "f66bd17f-b81e-4199-bc43-c825c7ed91df", "comment": "Malware payload", "value": "3953a675ba8ca1bda87df3d751ff5d7013a94f8f4c9cdb140d26833fa39d23a2", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747787, "uuid": "c86dd5de-33e9-4fc3-a4ae-0359f12d4409", "comment": "Malware payload", "value": "0fca35fdeb92d78814252b0df6f576f31b3a35a2", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747787, "uuid": "dc8da96a-03f1-4f42-87fe-7b51a25aad3c", "comment": "Malware payload", "value": "adedd6e63ebdff07f1674d8d1d32cc8b71b0f1065105b246fc512fb9dbc554f23ce267f0a7fb84978ee027c266fbe6eb", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747787, "uuid": "6405beb8-df0b-4e86-afa9-260bf4de9ce8", "value": "T12F935DEFA2D61F21C7DD0FB1652B858EB61B44B5133A8390252C815C2363D69B3B678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747787, "uuid": "318e40a6-335b-4d23-9c6e-add50494ecdf", "value": "3ee11032a62fe9ae89669891ab01af7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747787, "uuid": "85074bdc-9714-49a6-85c8-53ded104f68e", "value": "1536:oWppehmJyitbbsuRosLh63LejXq+66DFUABABOVLefEq:3shm4itbRo7Lej6+JB8Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747787, "uuid": "70966709-d3aa-4021-9042-97f058516ada", "value": 94760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747787, "uuid": "475622fc-9dae-4091-a30a-4123dcd33684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747787, "uuid": "71cb08fc-7cdb-4700-b42b-54da388e9f7d", "value": "3953a675ba8ca1bda87df3d751ff5d7013a94f8f4c9cdb140d26833fa39d23a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764d3221-61ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780752877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752877, "uuid": "53587db8-73e0-486d-a186-3f471b33753e", "comment": "Malware payload (Mirai)", "value": "4f69356038b9be4187539547df09f502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752877, "uuid": "6093a404-4a22-4697-8b1d-a57577d47205", "comment": "Malware payload (Mirai)", "value": "3be078d7d78dc15aed6b0f3443ef1e86ec60a2c7b6e3b3a28ae9d231df6fd89c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752877, "uuid": "2a2ff9fd-8522-4e11-ae91-5af6e8d3db1e", "comment": "Malware payload (Mirai)", "value": "f9c71e635d663c4c47bd82522b20f1f06cd9d691", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752877, "uuid": "4c4cb3cf-04bb-446a-8221-4f26dfdee959", "comment": "Malware payload (Mirai)", "value": "67ef0964d33f39ad34b58f5067b4227b91c09da54804130784c25112a09c3eca1862c154eae4d53e82b64bcd98bde677", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780752877, "uuid": "f2d77c89-df31-4dd2-9069-9a38236ecee3", "value": "T1F7933BA6B400DC3EF45BE6B7C5470A15B724A3E44E422B27B227FC63DA790781C66D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780752877, "uuid": "35605231-bbdb-4f98-b6ce-92ff9fef9bd1", "value": "1536:KiSr5iJqmPZMnztBUgEL9LeBE/a/uzrbE5OnYDxymh488wQo:Ki2iJqmxMnB2BuEsuD1noxymhNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780752877, "uuid": "91ac59d8-28d1-461a-b829-22b0e95ad83b", "value": 93080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780752877, "uuid": "e38b7fcf-8c4b-4f97-9f2b-5aaf4aa59a9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780752877, "uuid": "98190f40-5d8e-49dc-9190-47108fed0016", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b981df-61e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780776210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776210, "uuid": "2ecc6e47-7143-413f-841b-a5b46a7d3042", "comment": "Malware payload (Mirai)", "value": "23edbbc91fb5f43b975501a570dc4cf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776210, "uuid": "eca5a8c0-3dc4-40ac-ae66-ccfb1ef159a4", "comment": "Malware payload (Mirai)", "value": "3c36a4c2ec3356645c245936cbdec825278ff67b58408faec3fb18b97a3522f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776210, "uuid": "95744e2d-4405-4943-8438-bd792bf97fd1", "comment": "Malware payload (Mirai)", "value": "df1fe304ade584c09d6b46886b7b4e167e3392b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776210, "uuid": "da578128-23a5-4396-9a6a-7fb7b4ababf0", "comment": "Malware payload (Mirai)", "value": "a1b49afd1e9e8f1ac01b8f7599428338699ae47357c5b2ac2f28320e70b9054b056aac715c04d891e8f7b6391bd3b36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776210, "uuid": "5326757f-c97f-4ff1-923a-076bd335b73a", "value": "T194F32B51FF83CAF3E40304F081EAAB3F5A30ED1A4432C559EB657EAAD5539D5E20A364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776210, "uuid": "313916a9-d8d3-42b2-9611-4ae2ebc17968", "value": "3072:tohH0V3JL6BTMTeZRf7tzJVhDvAhstnGx:tI0n6OyToutnGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780776210, "uuid": "923b8204-6b8b-4c24-bcf9-7c68efa16e62", "value": 159432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780776210, "uuid": "ff3d4bd7-95c0-4f1d-b95d-d831c86d8952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776210, "uuid": "92850a2b-cd24-45fc-88a3-8e769ae4796e", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e130cb-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747298, "uuid": "57f1d94a-3522-4322-aa6a-df3d9656c519", "comment": "Malware payload (Snojan)", "value": "9f49b1c847904cff6edbd0a7024c6bb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747298, "uuid": "b712eed9-efe6-40cf-b05b-4bfd460617dd", "comment": "Malware payload (Snojan)", "value": "3c721de61f2c3c1273f68cbe56906ecd69a2cfca6f39bdba379cf455fdddbd5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747298, "uuid": "39d25018-9510-4d5a-8295-47c1c200dca7", "comment": "Malware payload (Snojan)", "value": "f1b8b871bc7d419c74dc7a9df4c634e029daf7b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747298, "uuid": "3ecab0c0-5ecb-48d7-9f84-7c3b19921c34", "comment": "Malware payload (Snojan)", "value": "99e1ed53ba2fe7e2067a1b01f6090d3efc35c2ca6eeb2a7be6e7d8cc2a4a4a95653a5d15058fe8357750d4e6e3d39e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747298, "uuid": "f0bc4d39-566f-443e-88cd-2ac3626e6429", "value": "T1F7F3021646DB58F7E49B127D469DD063B1FBA06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747298, "uuid": "ad14a39b-da33-4a5f-bd55-5c995c735759", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747298, "uuid": "f921cdd3-d6b1-4dca-94d5-0487fcb5ee30", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+XK:QJ0TAz6Mte4A+aaZx8EnCGVuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747298, "uuid": "d6ef2020-16a3-4c78-bca8-4fb704135da9", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747298, "uuid": "a31cf97f-4401-46ea-990f-aea7765f37b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747298, "uuid": "6a053c66-8788-432b-9a9b-dde9929ec46f", "value": "fQEJdl3nncnjHxvE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbaac3a-61e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780778444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778444, "uuid": "a53bba16-8733-4b5e-a516-3a48561e02f4", "comment": "Malware payload", "value": "6d5b169f8a9a6adcc700238ee8ae22af", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778444, "uuid": "ab66793e-a18e-4cb7-ba8e-a89655dd5cf1", "comment": "Malware payload", "value": "3cca9fe86d5c84e59be558155c8bb5bdf8e1f4cc04ae72a1ce043c2473fbf4c5", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778444, "uuid": "4b3aeb9d-ca7c-4291-8fbe-9fb12ffff418", "comment": "Malware payload", "value": "9ec036a061fbd18967e426607e766aece8338b42", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778444, "uuid": "ec63e293-af28-48e3-ae57-2f6bffcc9481", "comment": "Malware payload", "value": "61400decef4aa617b64abb783f74883e8765bcd98875998530e9443bafec3cca46183d453336b3f01429ce59a52c4ea3", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778444, "uuid": "21d3527b-7781-4ce2-a7e3-0965def659c0", "value": "T136735B10A365933EDEDEC73934F10553067C99C1627B9A9A268C6EED2DB3B9047123E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778444, "uuid": "771d099e-4255-480f-92d8-0ce8c2482bc5", "value": "1536:KT3/lCgzr3tMA4s66UHWjucMLoJARLVXyVb0EZIb5:KLLv3mAP64ucMLLLVXyVwaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780778444, "uuid": "bade60ee-46a7-4300-bab4-a908e38d697b", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780778444, "uuid": "17ebd8f5-e4a5-4423-afa4-38268b99f662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778444, "uuid": "6c8b6311-90f5-4579-bf90-1f99e90425dd", "value": "3cca9fe86d5c84e59be558155c8bb5bdf8e1f4cc04ae72a1ce043c2473fbf4c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da532f74-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759057, "uuid": "2816d53c-5a78-4353-9dff-13fd05f7d588", "comment": "Malware payload (Mirai)", "value": "9e26d47c42fe2d4a432862aaf3f40bb9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759057, "uuid": "f21bff42-766d-41c1-92d2-9c35a4bd1ca3", "comment": "Malware payload (Mirai)", "value": "3d128c8e07d969d43afce0bf3906aaa6761ef1df20b3e8e0ca87a16109a3a728", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759057, "uuid": "ac8f74a0-c3b6-41c1-a6a6-4ad8f1bd5a29", "comment": "Malware payload (Mirai)", "value": "2e1c93e1a738483e395151e0e643fa37b06a873f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759057, "uuid": "1abe7844-a239-47c9-9aa0-8de112936f3b", "comment": "Malware payload (Mirai)", "value": "56d584c858f911c53d8329b503ff3f6a0d0bbde643a0708254635a27c6f7240ffa7816d0c73e7d9e80fdc55216b90725", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759057, "uuid": "9af8a18c-fab6-426e-99c7-03f56631504a", "value": "T11E011EBF02236B019DA2CD5C79728CE06017E1C1E699DE49FD44052ABAC86873074EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759057, "uuid": "59e2466c-4983-460c-94f7-2a36566c1522", "value": "12:nBSn6v/P3rvZBGFGgHGj0Xbc0/WHnA6d2QzNI1dT1BdRBM5dF:BDz9RwKtXNIjNMfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759057, "uuid": "4e4055e9-2d03-4b63-9b60-988b6a23fd1d", "value": 700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759057, "uuid": "0cb6a09e-79cd-4378-ba54-97fc6a43d0c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759057, "uuid": "759743ea-7191-4d3d-80a9-1aa715ba469a", "value": "kozak.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4440414-61e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780776630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776630, "uuid": "76071a5e-5ae3-458f-b4ca-8b56010ae0bf", "comment": "Malware payload (Mirai)", "value": "98774bce5cc07dbbeaf36aef9d82cc1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776630, "uuid": "c80e1a67-2a8a-408c-99a3-4e3423f98928", "comment": "Malware payload (Mirai)", "value": "3e08738e74afb237a654444703d27a52c32ccd135a0bb5588daf145918fd3260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776630, "uuid": "deaa0315-63ce-4be2-af42-468983ac2330", "comment": "Malware payload (Mirai)", "value": "41f4c5fcd553c3c8f9092a6f152f66812771bf55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776630, "uuid": "cde991fe-93a7-49dc-8aa6-bbd2e77c57c2", "comment": "Malware payload (Mirai)", "value": "18049c978141c1d0bfc197ec5b12826eb1c9b3393ae3b85c5648d0d646c14b27950649a2d3f70b0001d54e6cfb8c3f73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776630, "uuid": "16a9fe7e-0f56-4ac8-bd18-a5ddb0095e32", "value": "T1FA734A2B9693D47BC1D786B02BDB8561E523B43D0733321673D8BD75ABA68C82E6C311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776630, "uuid": "cf4f6cc3-d94c-4586-93d6-5adecc4858bd", "value": "1536:17RUg3fg893QvPmaySVTJLGUYbivWFRZI2DN8oP7gwgpKDM:lbfg893QvPma9VHP+RSy8oP7gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780776630, "uuid": "8dea86ae-269f-43ec-94ba-d526cf73f562", "value": 77529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780776630, "uuid": "bd35f3b7-1704-40aa-a2d4-d65c33be5347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776630, "uuid": "d128b040-00e9-4b81-8d14-37acf9c581f0", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43ac22b-61f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780785676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780785676, "uuid": "1769a0c6-958b-42b2-baaf-587aa1ae9302", "comment": "Malware payload", "value": "4dc6b70b738b09ca50c51fdefd1842a5", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780785676, "uuid": "75472012-8384-4ee0-979c-805758e3671a", "comment": "Malware payload", "value": "3ea33da21e2745965c0f2884a7050635d9e72b6f72df48bb763ebbc810a88aca", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780785676, "uuid": "ae63ee95-7585-4b0a-850f-168c95611633", "comment": "Malware payload", "value": "fe7c83881746bb111bcfcfe932ece767c6112cad", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780785676, "uuid": "0eec5a20-1a82-4fda-90a2-f86b070b4157", "comment": "Malware payload", "value": "c317a9d1d88b57b50f8bd664b4cafc09302861f12a3fc2bd65f66b3ef45302ca763b26eaaaf4fb2170a0373081247080", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780785676, "uuid": "9f8d798f-fd32-44f5-9c66-10eb493de75a", "value": "T187D38D3B769A0F71C18202B5345F8097E62AF47A63EE925DEC349D0C8F33E5A6672354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780785676, "uuid": "48fd9f3e-6c79-44db-a9f5-71ff0143ac3f", "value": "d195dd9ffad463d4a93ccdbc6f52582e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780785676, "uuid": "9f30a6e3-7de9-4899-a015-c9e518fbee06", "value": "3072:EJDWgJobTQMkMhMvTbxILddrqAEnk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/gU:EZJoBk2ddEnFtCApaH8m3QIvMWH5H3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780785676, "uuid": "7c2f78da-83c6-4fcc-9aed-df690eee5c9e", "value": 139319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780785676, "uuid": "67364871-5111-42e7-89c5-1aca06364f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780785676, "uuid": "bc1b8cc5-3a55-43b3-9e76-91132fc1c51f", "value": "3ea33da21e2745965c0f2884a7050635d9e72b6f72df48bb763ebbc810a88aca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c09242-61fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780787871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780787871, "uuid": "bcab481b-9ab9-497c-8a47-236a583ad617", "comment": "Malware payload", "value": "30325aec283324a4d1d89c30fe4d8f93", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780787871, "uuid": "8806b1cd-41d0-4cee-b4e0-bdb7dc7e4004", "comment": "Malware payload", "value": "3ee3329e3b880e7fa9d89ed0a5675fe590c1ca403ea4515e43cdbbbdae19dd5f", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780787871, "uuid": "74f99b50-1aa2-4f17-9dfe-a0926119b344", "comment": "Malware payload", "value": "ca8c0f22a994b8d8656afaef369a2a9d861259ed", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780787871, "uuid": "af9846bb-9264-4ce6-b389-d867debabeab", "comment": "Malware payload", "value": "b5c07d5aa0edddb907f9273d811d62e9737a19f79e1c08a74b4e2272d5c5b2e1f03173887764f07e721911a56b03792f", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780787871, "uuid": "c5d3587e-28ac-4e08-ab15-359e6c2bb935", "value": "T13745D013F3A796B9C566C2788AB2C726E7B4B84513214ACB569097793F237E0273F341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780787871, "uuid": "56924ba4-aa9b-4042-ad44-cb2645a13cf5", "value": "7678b7862d40d5ac38768f5f18beffb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780787871, "uuid": "2a7364e4-4f07-4080-8b42-1800237e4d78", "value": "24576:w3HPW4Yy7Nt52XJqQ5egYwlVOuzSpFcsDtttt5k6SZQbNyBo4kx929bL3Hnx:yW4Yy7Nt52Xne1wlV9G0sDttttWBB+kh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780787871, "uuid": "7dc40967-defb-47e6-82bb-375117d14c7b", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780787871, "uuid": "3ab929ef-552c-474e-88bd-982ce6f6f649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780787871, "uuid": "d2136427-1e4f-4f2d-9fa8-eb6df9e55f34", "value": "3ee3329e3b880e7fa9d89ed0a5675fe590c1ca403ea4515e43cdbbbdae19dd5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0bd7e5-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759059, "uuid": "f599afdc-846b-4f70-865e-36031797b000", "comment": "Malware payload (Mirai)", "value": "ca476caf7f1a2c82d2c810476ef975bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759059, "uuid": "eec02bc2-bb8f-409e-bf1a-010e0fcf5a20", "comment": "Malware payload (Mirai)", "value": "4041e6034b940d0d487dd1f8b2108ef7d25f0f1c22997dc3c77601e0fc003d97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759059, "uuid": "0da876ff-12d8-4890-80b0-0ae0ef7d8767", "comment": "Malware payload (Mirai)", "value": "5de2047e08c06bd49de6ed42835629a72f21d4f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759059, "uuid": "10a52958-7a20-4e73-af76-16576ab3083e", "comment": "Malware payload (Mirai)", "value": "b5dcf2211b539c7bce08a41501ef26f6656dcb9304f2079d1da34d04df7a4bd8c5d8ab27a6686f9b9c9890b85e514174", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759059, "uuid": "e238f8b7-a44e-4547-8b9d-ff204e4e24e6", "value": "T159632B91BC819A13C6D026BBFB6E428D372653A8D2EF73139D216F10378786B0E77645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759059, "uuid": "3dc59275-5812-4235-9e30-f245d2c11517", "value": "1536:aTBFEMs/trgRFLwWQsXaq8/OS1+rqVpnbWWUsZJys/FQl3:aTBZEtsX/OKWfxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759059, "uuid": "6eaf5d18-13d0-4381-bcbf-dc24478ac163", "value": 72980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759059, "uuid": "5374f113-42c0-4816-bb5c-2f72329f2bc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759059, "uuid": "1cbe34dc-496a-4d45-b687-1f47d449c54d", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d19562e-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748110, "uuid": "d9a0dce7-fd61-40ee-be7c-98033f0b2b9d", "comment": "Malware payload (Snojan)", "value": "2ce2636d79aeff32b1a5a96fc793f351", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748110, "uuid": "84eafbfa-bc46-4454-987a-b4a44acd10c2", "comment": "Malware payload (Snojan)", "value": "40f9b681d94f0408c7efb16f91062db53f84437390938fadb5bf37e4780262a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748110, "uuid": "7dc9d6a6-5199-4ec6-8251-4d3125f769ef", "comment": "Malware payload (Snojan)", "value": "40bf720a1dde57a472460265c1adfef6229b3a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748110, "uuid": "923b9918-1e89-480e-827a-68a70f61b77e", "comment": "Malware payload (Snojan)", "value": "2fa681a990796aa02f7ed5b1d68e95954f7c0690ba64e699c27dfa27ca2985bae79f39460db35fdf1da24585d9c7266d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748110, "uuid": "52252762-5ffa-4ea9-a2bc-4623e9457749", "value": "T1E084F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748110, "uuid": "0a861d31-78fc-4cb4-beab-eb8cc147fe2c", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748110, "uuid": "5db73345-add0-4259-bdb6-44c4f37dd10b", "value": "6144:NrFZaaZmEJuDDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uXh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748110, "uuid": "2f1de687-9219-4796-8a47-7f5cfe630190", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748110, "uuid": "d22f0190-4145-4305-9842-a54568d8f5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748110, "uuid": "f067e793-ac11-4f4d-8ab5-e29238b41326", "value": "Hg1M5RzLTaDA3RTB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be5238a-61df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774710, "uuid": "dd2cfc0f-b414-4564-ada1-3795b779729d", "comment": "Malware payload (Mirai)", "value": "65438d1434f273ef69a27378fbe8ca80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774710, "uuid": "78f4db4e-f3d0-4e93-970b-4eb071d5af37", "comment": "Malware payload (Mirai)", "value": "4206028d220e9d734d2ff034df454fece28051188ff7628cbb5194fae043f914", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774710, "uuid": "e7cec480-a2e3-417d-bc97-58ab419793e5", "comment": "Malware payload (Mirai)", "value": "8766784892da84a685107ceedaca93a4a7ff7d35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774710, "uuid": "5d993b06-4c46-4331-a6f7-72b2ab50cc93", "comment": "Malware payload (Mirai)", "value": "c05e2422a8650503335df2ba5f2252b396cc620721d0fa1415ae3675d2ff2e74d3fae2287a14d2a6672ca6caa29162dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774710, "uuid": "c8f83b25-8012-4b5c-86a7-085e4c9c908b", "value": "T1D033F17322B1F1B2C1A8E1B124520BDCC1A23E3753255D4F457B25E8ECB98528F69FB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774710, "uuid": "2c8f5395-23ac-4c99-9eb2-e47e60b12414", "value": "768:FD+OFVHUhkTHp9WGTflnhsG4gJbg3hLg24vLmlta3KoMl/d72DIe+QbqX3Ojc2/:NDr0hEPlNhBngy24vwtNlF72XrOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774710, "uuid": "7ed92259-c63c-4099-a183-d4a9cf6bd3af", "value": 53536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774710, "uuid": "34773dad-2c82-439f-aace-dc38583898f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774710, "uuid": "4f4b5264-3281-45bd-a2ff-14e823b4861d", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3674ff-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746766, "uuid": "579dbf98-e02d-4b99-9fc0-d8afcb6d5da6", "comment": "Malware payload (Snojan)", "value": "95dbefa5cdce30cd18b7de5e45336e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746766, "uuid": "fae4c644-3867-4446-9427-eb94d8f57f9e", "comment": "Malware payload (Snojan)", "value": "42a7d6e92e1149fe9bb22b87c62eb3f0cf7238e93331c34017b9bb6ad846e0cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746766, "uuid": "7753abee-8b8a-4df4-92c4-dfb18c0620e4", "comment": "Malware payload (Snojan)", "value": "c35dd382c44167b9a6382158ac65298991e25f81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746766, "uuid": "2de53ce0-b00b-485b-8b90-141d32c92c85", "comment": "Malware payload (Snojan)", "value": "f53c42a0a88f77190b232aade30ea0763d27dab96222a3bd229c8da9c9f7de183e0e6d991de6e93814412a8f7cbb9b83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746766, "uuid": "8c7fca77-1dbf-4db1-a2a8-7cca36fb46cb", "value": "T19515222471C0C4B7D46B413544C9CA72AA76707247BE99DBBBED63B9AF203E163342C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746766, "uuid": "7d931651-7149-4544-aee4-d2ee618bdea2", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746766, "uuid": "9d57b7af-9725-4a53-9f42-4b35b74579dd", "value": "24576:/Y+Xk70Trc18BSnLW2CRBKViu99LK1Rad6yZcTx:JkQTAKYS/v6h3+1uhZcTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746766, "uuid": "84af460f-4054-4c06-8aab-03f46d263ed2", "value": 923104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746766, "uuid": "a45e0f0a-7e77-4230-a2bb-303536eda0a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746766, "uuid": "c322ee79-379d-4c40-95f0-a1414c9582db", "value": "UVbJXZMy4UV88zdr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e40576-61e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780778243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778243, "uuid": "e29adee1-bf79-4309-a442-0340cf6a87da", "comment": "Malware payload", "value": "0a3c1aa406cdfc124cf75181909feb73", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778243, "uuid": "2730fbaa-475a-4180-a011-3021b6363114", "comment": "Malware payload", "value": "433ff5fd6c97d415f8d81e572fe491185e7cea1155a54577d8f9a3c773d6bc67", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778243, "uuid": "dbfc0573-9a8f-4d61-93ab-2d727bb85c21", "comment": "Malware payload", "value": "dd1c07ac75bf8973f2dacafb6ede5aff3e2a15d7", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778243, "uuid": "0d3bbd7e-84b1-4311-955f-b19b943e6313", "comment": "Malware payload", "value": "ee8e0cbb3d0ba55c35376fa625c15f5238d287682914a70103a61df9b4c48b62e5ff51ddaebb8050590dabd21a824065", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778243, "uuid": "e88212e6-550e-4af4-8c82-6645f8b8ba76", "value": "T14AC6BE1DA3A407A4D7268174CA964E33E6F6784503E0A9CB02D7D7172B339D36AFA335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778243, "uuid": "7599ae2b-fdae-41e7-90ab-aac546cac969", "value": "a9b17981fc19fa148675dcf2ed81717f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778243, "uuid": "3f0df5cc-252a-4441-9d4f-9b0ad9a4ddc5", "value": "24576:1f+Fta1D0ATxvVN2Zt2jSA6lIvlsATlAr6wTs3UVUcjEcIltMSdPY5B9UUlS1:p+Ft6QAdjSA6lIuMlg/GcjEvtMiY55a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780778243, "uuid": "7e6ea037-70b0-439c-a427-317006a18d44", "value": 11944448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780778243, "uuid": "d7fb9ff5-6029-4d48-b0d9-4d7ad05d2d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778243, "uuid": "a617a2f2-d322-4633-b586-512a83fa7a89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec35057-614b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780711418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711418, "uuid": "1f3f5f36-3ea9-4033-b635-b6a7ed403df6", "comment": "Malware payload", "value": "3e6c0d7e236bd25e197ec7bc095e6163", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711418, "uuid": "703a50f2-fed8-4b42-82be-e404b0bf027b", "comment": "Malware payload", "value": "435a8a31e991d76cea4f8f0080760951e413e2027cdb7ce977a984a0e3367de3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711418, "uuid": "c96329ea-3358-4761-b6b8-7492b7fdd29b", "comment": "Malware payload", "value": "eb64a87315b8e1731c58373a4067a63ec2634e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711418, "uuid": "168f067f-40d7-4cab-9d4f-270c46ffa54c", "comment": "Malware payload", "value": "d2fc914d9b25de34c0e837fac884e7e3c0bc760f9faf0a9b2add0ee1951c156614bccbfdb7d09cee35141beb92d15474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711418, "uuid": "d5fea6bb-74ba-4b81-b90c-783620ba0f96", "value": "T1CB8533E744392BD692FCEE13D81E7FC95E0816352278D40476A8D06DC213BBA1F26F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711418, "uuid": "425aac4a-e744-48f8-b1e4-f29be1397004", "value": "49152:Zl2XPHPweh0rJXmLRrTfyAvXL3TQeRj7S1hNceW4:ZlQP1h0Ni3f6eRHet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780711418, "uuid": "2afad719-c7d1-4673-8856-b895f7060cfe", "value": 1835788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780711418, "uuid": "5d449f9f-bd2f-4f81-9cf2-81f0c42efe9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711418, "uuid": "964e88da-00b7-4540-9578-db87b889d4ad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc07b4ef-6174-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780728996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728996, "uuid": "450e86eb-3f46-4dad-a968-b24f70f58a98", "comment": "Malware payload (Mirai)", "value": "0eb669e98340f9554f9c71bd97b18b5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728996, "uuid": "009ffa66-b798-4cbf-979c-289920a993f5", "comment": "Malware payload (Mirai)", "value": "4393bd7bad0b4d1283d0db65d2bed45f6a7fa27b8c607cf73bcf8d57079701fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728996, "uuid": "dd7edcaf-aed8-44a4-9a81-67c038402ad8", "comment": "Malware payload (Mirai)", "value": "b064d31805c7485f02499b4296186abc46d426dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728996, "uuid": "e3542b8a-48d0-4c21-8c9a-9c56dac7e3c1", "comment": "Malware payload (Mirai)", "value": "f4672ee81d8dc15da274c5f9c1fef78e8981742f129d1d07b85cdbbdf30d63647017ae96a988d5d5c25d6efdcbd35d57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728996, "uuid": "3b530a9f-6af1-4407-b8bd-132544f5593e", "value": "T135A3F697F801DFB7F40BE276489748057530BFEA0EA25A72732378A79C760D52863E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728996, "uuid": "3ec374f2-097f-4e3c-8c4e-51d841e4f4b6", "value": "1536:W/7CWrDGC6LcjL8wps2CNYGJZ5UZtkTvG7v6z1qKyuJWfR0OP:W/+W4cjdsbJfUnBi1qKyuJWp7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728996, "uuid": "08fefaea-f3b5-4ac5-93f8-ce65440d3bdb", "value": 99232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728996, "uuid": "b49af148-82f7-4676-82a5-571eb25298a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728996, "uuid": "caaa5484-a82a-4139-a63a-0be738d11d7e", "value": "M68K", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a23be09-61bc-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780759809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759809, "uuid": "620254a2-315d-49af-9015-25f3a17466fd", "comment": "Malware payload (NanoCore)", "value": "6a8b3f2ea885553ba5fcb24ca97c2abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759809, "uuid": "cde814da-aab3-4cf5-a1ec-81ae10be2995", "comment": "Malware payload (NanoCore)", "value": "455ed788c575a5270884e4852ef83f5707321817b0054c9aafc6ea9e4cfa86ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759809, "uuid": "86ac144a-a363-4d67-b827-8f5a83cf0811", "comment": "Malware payload (NanoCore)", "value": "f2e9e37d32c9d59f5c755964c4030db8f82a440a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759809, "uuid": "0990ce7a-2bdc-4ca4-b5f6-a8fade7cb3b8", "comment": "Malware payload (NanoCore)", "value": "9b4679a30fc3e62b7cff41d950fcd15e50925aa879c22e3be34ddaa3f6c98d89f52a0b4728e98f742cdb62347b011d6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759809, "uuid": "feebaf38-d9bd-487e-8a65-365bf129066c", "value": "T1FD14C05677A88A2FE2CE8679712212429779C2E3D8D3F3DE28E455B75F163E4060B0D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759809, "uuid": "f58fa57e-013b-494b-bf9c-9da4186bfdaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759809, "uuid": "8d11654a-817c-4fd8-8cc8-2996da710bd2", "value": "6144:ULV6Bta6dtJmakIM5D2B/XMekQlD/7W6Qyf0y:ULV6BtpmkjZXxVpQyf0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759809, "uuid": "529ef9f6-5096-487f-9f24-d9441d9a743b", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759809, "uuid": "820d260b-e2ff-4328-8f30-6253cf36ad24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759809, "uuid": "220a768b-af1a-4f5b-92ff-8e3b4b235df7", "value": "tcc.jp.netnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fea3e9a-6148-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709836, "uuid": "305368bb-40a4-435c-8acf-01b91fbb92f6", "comment": "Malware payload (Mirai)", "value": "481a3c3ff39d963c315e93635483abef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709836, "uuid": "de5c01d8-8f64-4abc-92b3-b5c4dc03c0ed", "comment": "Malware payload (Mirai)", "value": "47495d09d1c4f0478241a2584f4eb409c22f361e27505a45336024fa4ebd6202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709836, "uuid": "8b7829e6-8e97-47d4-8068-c5171777a1ab", "comment": "Malware payload (Mirai)", "value": "864274471d2f8898f4ac86233da61b852b2406a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709836, "uuid": "43d26f5e-35df-4729-93de-47d771dad633", "comment": "Malware payload (Mirai)", "value": "9661abc279b1618dbe7c786ce2865b7be390ba2a0f58682636bae886363a07d183f7833bb77d5c0cd4ff475ecead3c21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709836, "uuid": "0343a9dd-daff-4869-806e-e02bf738effa", "value": "T145B31B427D419F13C5C221F6FBAE42983B126B7CD6EA7102ED257F91278B8DB0E27611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709836, "uuid": "80343f70-caee-4df4-afa8-5293bfe8d61e", "value": "3072:o5eeaDjBh0Ks9KhaNm3K44Iq37bjRVkY60qS6:o5Wh0Ks9KwiK44IA7HROY60b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709836, "uuid": "cd4e1618-eb1e-4175-97c4-ea43aaf525d1", "value": 110500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709836, "uuid": "5a87baeb-946a-40a7-96ee-a6b640ede551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709836, "uuid": "21b654d6-ac7f-4235-8f99-153af709a30a", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df56700b-61de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774528, "uuid": "599bfd53-a900-447c-95d9-2b590bf04a3c", "comment": "Malware payload (Mirai)", "value": "08d653f6e087185436a8f11cfd7ef776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774528, "uuid": "53c6215d-4db8-4646-bfba-c754b37db62b", "comment": "Malware payload (Mirai)", "value": "4968752e7952ae7c4df1670c272ca724f4bd1936c1e1ff5da98294dcbe6ace74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774528, "uuid": "0b24002a-7d2c-4f66-9a16-71451f04cf73", "comment": "Malware payload (Mirai)", "value": "9251b5acd920729f9b35fa2515043faddc61b0eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774528, "uuid": "851f3e0d-9cb6-4036-b0a1-2d757cb1f461", "comment": "Malware payload (Mirai)", "value": "5e233f9a69573a4280b1884209b2c150f2ae17e654e15752c8e94cf971865b65bbe3703ccca9a1ce595a420d88e7dee6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774528, "uuid": "40469c78-32e2-4012-9d5e-e9e3f63b399d", "value": "T199C36B73C8296E99CA28D574F1648E392B63A41490876FFE29A7C3B14047DDCF6097F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774528, "uuid": "2c81e388-7e8a-415c-b295-8a8067f47794", "value": "3072:8JzZ/HlbU3l14ApG+TBJUc39NKygTWpeVr/TD5:8JzVlbU114AntJUSK1Cp0jTD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774528, "uuid": "b504ffea-483a-4667-a09c-9fa00c62fa81", "value": 128496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774528, "uuid": "9965fd03-0911-4b47-b9a0-e3f847117dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774528, "uuid": "c54d8fa7-241d-4c49-8758-de76f00f9c42", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d0c3c3-614d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780712018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712018, "uuid": "3c391589-37a9-49bc-b7b9-86fccc4e88c7", "comment": "Malware payload (Mirai)", "value": "84107fb98f3d69dd1aa8797a619a4c07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712018, "uuid": "092318ec-2d89-49af-8bf3-da1400912997", "comment": "Malware payload (Mirai)", "value": "49bc6d109c66cc979983499f6bfab4cdd1fee75ad133b6a6468575b96850f49c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712018, "uuid": "1b9b4608-7485-4949-9b3c-1298c8a6a9c0", "comment": "Malware payload (Mirai)", "value": "e6bde7d69f31e2e843db1a55717e0fc0219cf7d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712018, "uuid": "ad9eda91-f00c-4bd9-9ae0-29725408ca37", "comment": "Malware payload (Mirai)", "value": "c6bb1041f2f7fb71922c29df04b89fbd26678e1285416ca562f4cbaeceb1f01ae232f578467157c17773970203f8b46c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712018, "uuid": "29c41077-a3b1-4c0e-be33-a191fda4c5a0", "value": "T1BA04E819AB510FF7DCABCD3702E90B0539CC654722A93B357678D928F54B60B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712018, "uuid": "2f9c82e2-7bf1-4b5e-b828-ea88be76f788", "value": "3072:ZS4TBjTcn1TUauvg/OlOCpIFczAxsZ2T:ZS4TBfc1TUNAOIQP0sZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712018, "uuid": "bb1497fd-9e9d-4d76-9f2a-03f24627d2f7", "value": 186412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712018, "uuid": "2b8a946b-6073-4afa-9e5b-14edbb78db40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712018, "uuid": "4b61909a-e968-4c70-9b9c-9bb6f4cb28d1", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b9e6c9-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729257, "uuid": "969985d3-dec3-4397-91d7-bbb47026c069", "comment": "Malware payload (Mirai)", "value": "132523da0432de2d78d0ddf3b667e756", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729257, "uuid": "19e73e46-3f9a-495a-aff5-286e6bb6fa44", "comment": "Malware payload (Mirai)", "value": "4c90bfa7d90986057411e1e63e8dc14c752297cce13170f4d4ccacdbfaa640f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729257, "uuid": "9e789e25-08f1-407c-aabb-6e950d571970", "comment": "Malware payload (Mirai)", "value": "def1f7e89fec0f63d58e8d315dc03ad4252f13a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729257, "uuid": "5a64c7b6-47b4-43e1-8f41-a906f91b216b", "comment": "Malware payload (Mirai)", "value": "aa9ff7fbc58f1fdd19adc4a74b00725d4ff6c10fb2eddb4b1dd3516a4c1cb343ae15450b5878b770b806ab726c5f0710", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729257, "uuid": "8970a22c-6175-4865-9649-c1b71f4c81e9", "value": "T11A54238055E188B3DF04C5AEB6A3DCEB75920BC55A6E1581C7C4D8FEFD7A1904CC89C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729257, "uuid": "4a2b689f-6df0-48f0-a1cc-b7edb7444254", "value": "6144:Qt+dmVl//qjlBEGZI2fvbEro7y0WcsWB2JrzaCfua9gdwCB4mo:5wlqjlbLIroW0N2JH1ua9m/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729257, "uuid": "1f7fef6e-c0e9-4dae-9b48-9e9217702c36", "value": 296492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729257, "uuid": "e24e3e52-95c7-49b4-8bd4-8d122b1de43e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729257, "uuid": "84d326f1-f31e-4eb9-aa5d-903d4f3bc811", "value": "kaizen.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94598f7-61df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774893, "uuid": "c4fcdd50-ecf8-4531-b0ab-5c71b7bd8b3e", "comment": "Malware payload (Mirai)", "value": "7eda076b0981ea1552a306be825740d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774893, "uuid": "b50438c8-bdeb-439b-bfa9-f414f6ba0e25", "comment": "Malware payload (Mirai)", "value": "4d3ad1c74e4beb322c432c14bb45012f3aea8408d83db8598b0e1d091c7fac0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774893, "uuid": "35e5d7ba-4549-4b3b-aec7-a77d60f09b5e", "comment": "Malware payload (Mirai)", "value": "ccee5edc2a5b8061ab714748af38c0d0beb6a4dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774893, "uuid": "63a30020-6f23-48d0-91ce-5b8310761857", "comment": "Malware payload (Mirai)", "value": "8f169b5251ee57082b3f3296f0885ae67d44a3fc481e66ec3d4f1277d2bec04daaae0c90cd76bb5e0a6c9b24f9685225", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774893, "uuid": "b170dffa-82a2-4a77-9e10-724892a48a05", "value": "T116D35B0A79D274FCC687C170826E9F61EA3A745C42183DBB93C2BE711937DE05E15E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774893, "uuid": "7dabd932-f660-464b-bc77-6c0448a6f18e", "value": "3072:zzU0RT+3iPk9gZIfYYvk9d5tUxkq3FEU84YTQbl:PU73iPygSATUxdVEtH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774893, "uuid": "b5f86012-67db-45e6-ad85-fc9bbd72d589", "value": 140320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774893, "uuid": "51c76e80-3c98-4f7c-86a7-2dba6cf0a22b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774893, "uuid": "19d6b87d-f0b3-40df-b108-6d07687ef2c6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0666054f-61bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780759990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759990, "uuid": "055d647a-3d92-460a-822c-8cb28c7e7cfc", "comment": "Malware payload", "value": "dc11cdf629b06ce714425ea6ca1c45ff", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759990, "uuid": "5c9e3731-7ae2-4c1e-8ed5-acb6492be472", "comment": "Malware payload", "value": "4d48a386f6f6a4e61542c7882b020d7a8ba71dbb79f0fdf00e8de2e68ad248b9", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759990, "uuid": "bdb3a090-3260-496c-9618-2da855b662a8", "comment": "Malware payload", "value": "36cb65a5b8f4889110ef4018b62fbf23c1d7874f", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759990, "uuid": "d0561dfc-a3f4-4033-bc61-9d11ace8963b", "comment": "Malware payload", "value": "f9f7ee48b99b2ac9778167a7a57a6cd0b5e837fb7e5f40c43f071fdf9e093095b339eeeb4bda23f54b8d64265659516f", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759990, "uuid": "e51e722c-8d72-4051-9c65-ebc9718a0cb0", "value": "T138D5E0802BF41304F176FE768E7AA789493BFE85EE31876C4950DC5C2964A00CE75F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759990, "uuid": "61e47b94-a9c3-49e9-83f9-fe9119384e6e", "value": "192:TZlH6Nef11VUlH677edZ+KzeFHpfh8e3ynCp:tlH6eUlH6rK2fhUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759990, "uuid": "306c7123-9d62-4580-9ad8-35bac7f90bac", "value": 2784491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759990, "uuid": "13bc0d17-3625-49c2-9391-0eead4322ae0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759990, "uuid": "59226617-bc0c-43e0-a2ca-6cfa8f23197a", "value": "spisokszch.xlsx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebe368d-6145-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780708841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780708841, "uuid": "62866215-1142-4351-b70e-65698bea7fad", "comment": "Malware payload (Mirai)", "value": "6bf9af1b62a3f0ff4d0d24ce6af3c2af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780708841, "uuid": "47191124-9a77-4086-a715-86e4f81ea01c", "comment": "Malware payload (Mirai)", "value": "4dd75dd1d0ed6c9e8dd659dbc46b5a16e473147c47fd7a7a0a15fd1cf76c62b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780708841, "uuid": "469d2df9-7874-4951-949d-a7e85a50d8a5", "comment": "Malware payload (Mirai)", "value": "789af071376eb652a99a9c20b9b1d6164291df08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780708841, "uuid": "f1b8fcf6-51d3-4afe-92bd-e2d3fc2805c9", "comment": "Malware payload (Mirai)", "value": "94445fcd68844f4605d9bef63a73950f42715f4fbba05443e51b3471c1795b10c874a314a655857184a2b908e6d5162d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780708841, "uuid": "d8978ed6-6722-46ea-b922-4056f5115a10", "value": "T12D7533C52836BA2DCA3FFB6D86A214825584D17721ED0FAEF6E0C2BC054334A7D56B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780708841, "uuid": "b78fde4c-4b44-4de1-a0b8-4d7f889a7f49", "value": "24576:7xIs+RnvxbBLuXY3ThtSQbIlacUpHLLbVohMKqoy3jN70AtmQf1dSjhtrzgloRTQ:YVxbBLkYfbBpr/VoLqJ6Atme1dSzUlKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780708841, "uuid": "02c1e895-23ff-4804-9566-75708ac11b42", "value": 1618084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780708841, "uuid": "7dd1c0eb-7297-4044-9f7b-05bf85a40f3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780708841, "uuid": "d8720305-f185-4d98-9f02-bd50798ef8e7", "value": "SecuriteInfo.com.ELF.Mirai-AGE.76883659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e4e073-61da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780772626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772626, "uuid": "287ad48a-b13c-4785-a94d-caa1fa1598d1", "comment": "Malware payload", "value": "7e3922e81189148c20c6ccc37b321bc6", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772626, "uuid": "78a2623a-efc6-4257-807e-132f64df2686", "comment": "Malware payload", "value": "50602d12f0e1007d164726e547c53c86eb0a5719dd9a702b839fb396eeae6882", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772626, "uuid": "e4b73310-0793-4a9c-a698-31e96b45f519", "comment": "Malware payload", "value": "c997b62b94c26bcc7fde4d30c9a1ba18b9fc8acf", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772626, "uuid": "3ed6855f-c070-4325-aee2-2064c35f7c1b", "comment": "Malware payload", "value": "d5d54a7d46cbbae1113f23eb63987c85a646190f78ba7ab914198b9e3c1acfd568578d7627901e45a2f40d9ba0e57684", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772626, "uuid": "9d0b1680-1d61-460a-8cfe-f0b21a07d295", "value": "T18A0833A94772C01FD6E296378DA6CD60F52C832E9B965C6C191DE73CB7A248600BCDD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772626, "uuid": "9380c919-64fe-4840-9914-9db2046051e1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772626, "uuid": "1e12fd35-6a98-49fb-8e2e-f5509cdc7057", "value": "1572864:kt9IKPUVRWYIS7l+8s/zaIftHYMGESy5lFhTG7:kUKMVRWT0o8s/zaIFHBnFh67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780772626, "uuid": "37dd491e-c2b1-4b70-889d-b9fa9010e446", "value": 77756798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780772626, "uuid": "9038b894-8328-4678-8c60-5d1114286623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772626, "uuid": "c2b9dfa2-30e2-422b-bf2c-91361184848a", "value": "GitSoftware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcce4a1-61ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780752403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752403, "uuid": "6ac7046a-9806-4251-bb37-d5c291fd8f73", "comment": "Malware payload", "value": "af4c40412d99e353cbbbf5a0428f7262", "object_relation": "md5", "Tag": [ { "name": "bat.starter", "colour": "#B27179", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752403, "uuid": "6bc3d026-fffa-42b5-91d8-5136bcd78374", "comment": "Malware payload", "value": "506fffab758d4d97bda2dd0c897e179b2149e4e9b0e34e5e001732d95d316294", "object_relation": "sha256", "Tag": [ { "name": "bat.starter", "colour": "#B27179", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752403, "uuid": "c7e4ea96-b9c3-4e27-9eca-7fc35d0cf1ec", "comment": "Malware payload", "value": "6541c56fce0afe0a8809983309d9c58750c496bd", "object_relation": "sha1", "Tag": [ { "name": "bat.starter", "colour": "#B27179", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780752403, "uuid": "fecdc3af-692a-4a60-880a-9d4a4c011e93", "comment": "Malware payload", "value": "e0671de2a3f3640b718d9b6d7b23ac4a728c74593608a7f85556cd0ee064bcdc74fe86524abadc321affe080f9672e4f", "object_relation": "sha3-384", "Tag": [ { "name": "bat.starter", "colour": "#B27179", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780752403, "uuid": "9825b380-6cff-41d3-8d5c-40833c4636b5", "value": "T1C216334454CB70AFD35B89A4CEE139A835D464C1BC26CD23AF7319B73A72BAC5198372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780752403, "uuid": "41d5fa81-ba53-43bd-b612-4be39eecb601", "value": "98304:g9eGcAbBxNeVbNJ0M7W1Dogts77hKtPOWbmnwiF8JZfaIKEHJJIF:g9nbcJB7ODbts77Qhi9F8JYwH0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780752403, "uuid": "e4781a7e-7978-4d60-809a-16b125736124", "value": 4310698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780752403, "uuid": "b2d08cac-e45a-4f7e-9daf-33b65c6402d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780752403, "uuid": "aa73e523-8bfc-422e-9892-5117bfca42b0", "value": "CashProxyVPN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db54a40-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709429, "uuid": "355051bd-ed45-4068-8de6-913ddabe3d54", "comment": "Malware payload (Mirai)", "value": "90dc27f088e7bd3ecce9efa9931d84b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709429, "uuid": "e9639d67-4c00-4ec4-9a42-2b4dbb4eff6e", "comment": "Malware payload (Mirai)", "value": "51204981e2c3afa72f226e5ad2ac8a880ac6e3c139931959756ad5d94694edbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709429, "uuid": "bbd38d82-9d55-4bf0-8194-f8a56aafeb61", "comment": "Malware payload (Mirai)", "value": "055381912f1b2ca894b28ff65d07d117d7ac5dbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709429, "uuid": "4c136c70-ba1f-4c1d-b460-087faf9699a9", "comment": "Malware payload (Mirai)", "value": "df0bd05784b0ee8fc192de0a54576ae52da302dc0a6c818ba9b32121ffdb4d30eda21dbb62824550aff74939bdb4734b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709429, "uuid": "8b911308-0474-4431-9895-89a87d5794a7", "value": "T1AEC30946F8819B12D5C151BAFF0E124E77131B3CE2DE7212AD24AB34778B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709429, "uuid": "59d6770f-a62d-4345-b44a-43f12431a60c", "value": "3072:IGUwakIgXihzasMjMDOR6gVn9xAI4SYSE1V:IG3ggX6zaZjMRgVfUSYH1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709429, "uuid": "d436d53d-43ed-40b8-9753-21231738e36e", "value": 129948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709429, "uuid": "e3d135f0-a141-464d-94c7-6951c059a183", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709429, "uuid": "caa75858-2b2d-4ddc-aeb1-2410311eebcd", "value": ".Sassy.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5ecaf2-6160-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780720081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780720081, "uuid": "eba6fc45-6f57-4871-ab28-9b94ac5816aa", "comment": "Malware payload", "value": "ae0d6ae8378479155c4259380142f68c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780720081, "uuid": "46c8900d-e9dd-4095-b02e-f83755d6e6ba", "comment": "Malware payload", "value": "51387d93a70ef0ff9007c91e536f37c51c2009cd78d09ab65cbb91bbfce856f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780720081, "uuid": "2d8d8f6f-603d-46b7-839a-2be86022d5e8", "comment": "Malware payload", "value": "c44605570117ad4d8c339ea50ceb0ec2006012d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780720081, "uuid": "bcaa88b0-a030-49f9-8a8b-7a7de30f15f8", "comment": "Malware payload", "value": "df345deacb42789a71493fe789bbc294c64808922eb8cdf37d9e69da91bfcd20458d07a2e9062637dfd3364507964105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780720081, "uuid": "424bc025-6984-4c80-b47d-dc7cb3b10b62", "value": "T1C2753393736CF322FF1E660B06880407110CE1CC25B0DE969DA2BBBD561F62999FDA5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780720081, "uuid": "2371550e-db9b-4141-841e-b49d1825cbe0", "value": "49152:ESxpqfCHZKNrXBaF7MzyUFW5DIvMGVY59g/:ESxpSCHZIOuBp2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780720081, "uuid": "b01fe523-cdc1-4e87-b675-9adf8e24aa90", "value": 1702768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780720081, "uuid": "fc027069-e7a1-4f65-b985-cf9202bf88b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780720081, "uuid": "c0a1a892-434e-4187-8406-715cbbf6a9e0", "value": "SecuriteInfo.com.FileRepMalware.76616917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e2ed56-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748071, "uuid": "9d20d4d1-415b-4441-bc38-83a7f4d4ed5e", "comment": "Malware payload (Snojan)", "value": "98945aa4a9f87a1f7ad7cf7c7f9395dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748071, "uuid": "add91e55-7759-4fd9-9882-1de2a67a7fee", "comment": "Malware payload (Snojan)", "value": "520a9669d41412a8a0e2641b50ee69ab7d9cafaa398d136523abda9b5e80b523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748071, "uuid": "7b19e4a4-97ad-4d66-939a-80c459d1a212", "comment": "Malware payload (Snojan)", "value": "226897eaae90e2fcd9151e96b452c6f2390fc411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748071, "uuid": "01880e1e-1081-4784-a48a-3c6106717775", "comment": "Malware payload (Snojan)", "value": "ccc9e060e1ecf3cda8f07927c74e2f77a0c27c98a8e6b9a0aebf062f198185380fefea638422f47569d223657575cf5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748071, "uuid": "f1901bee-5a36-42a4-8547-2527853e3298", "value": "T16C84F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748071, "uuid": "c49dd389-6ecd-46f5-a0ff-e5b257fe0f46", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748071, "uuid": "fa9a8704-dd42-4f7f-ad30-41e6668f4e72", "value": "6144:NrFZaaZmEJu+DKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uYh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748071, "uuid": "cec8aba1-5114-4671-954e-a6595286ef4a", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748071, "uuid": "9ae48b31-b3c1-4d37-b9a7-133e6814c0c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748071, "uuid": "dd1f80fa-a947-4f6c-b2a8-1cc85e0392b9", "value": "9iPqJwEpxxoWgogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f01e17f-614f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780712787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712787, "uuid": "e6e0277e-2090-4c8f-bcda-f47a9dfe2300", "comment": "Malware payload (Mirai)", "value": "4384e8fc068d60abad938de6ebe3756b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712787, "uuid": "f8d5f780-7071-40a6-b7fe-81cea140d251", "comment": "Malware payload (Mirai)", "value": "549e69ff629c5866fe7885741c59ce62e0c47958fd31df1df7b7e3f356336c45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712787, "uuid": "1f568939-0fe1-457f-baed-758d6baf4a36", "comment": "Malware payload (Mirai)", "value": "411c2f0e7110645219d3887d4e376c40b248e359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712787, "uuid": "a9e30272-00d3-49bb-ae7f-76363237e99b", "comment": "Malware payload (Mirai)", "value": "a3f79da126b140310fc9f3850f3ff94d763390331927f17d9fbaed095e411573f5b9b163a13c10101d5b418eb32623c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712787, "uuid": "e03f3b9c-1707-47be-912a-1473480d875a", "value": "T15813072271BD2F17C0D1A97D107B0B91B6A16ED923A8C68FBD721D5BEE613005913EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712787, "uuid": "887db1aa-02b2-401a-8f3d-3b083d5e1e81", "value": "768:qUa8oxmwOVolec85yQg1AI+VZA9jgGIk0FFexR5QQecwwu:qU1DwOVolec85yX1x+Vy9jgGITrexR5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712787, "uuid": "f77b7569-ead1-4f2a-bb56-921d99cdec8f", "value": 43464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712787, "uuid": "fc9aa0eb-ffa3-4f85-8a10-d9c4ae0fd454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712787, "uuid": "e090925a-6be6-4817-a037-fd9dac20ba41", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e279fbc8-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759071, "uuid": "efa670c2-9132-4502-8231-49e6b5d6e5df", "comment": "Malware payload (Mirai)", "value": "719ebe4459f940fae1eba9fab5bd3d5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759071, "uuid": "c11eb8ee-1d8c-444a-ae9b-97f12232511f", "comment": "Malware payload (Mirai)", "value": "54b8a11267ae2127a5f7101f90addee26b0e29ebd99af449557e6e7f917486b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759071, "uuid": "5a339872-ee5a-4eb8-8baa-63dfd7ab5fd3", "comment": "Malware payload (Mirai)", "value": "9ff51477bc56a0dc5025dcc3c893f01d358b458f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759071, "uuid": "6ab18ed4-ea30-490e-9959-499ecf32a600", "comment": "Malware payload (Mirai)", "value": "1b1a0a19a5d79049c01c423474b00d7103ac0a7af7ba49b22014c0706ba6bd4b3d6ae81019b739684467da1cf7f64c8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759071, "uuid": "4b8c3d30-a2f2-45df-a01c-0636c3df92fa", "value": "T177733B81B9815A13C6D1127BFB6E42CD372A13A8D2EF7207DD216F21378786B0E67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759071, "uuid": "cad6094f-984e-45d4-8321-0e0bdded9256", "value": "1536:mFPsVakHx7zCb4+U3G95Ez8tOkcekdt/EVJQvls/FL:KPsvl295E+ohw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759071, "uuid": "ec45f99e-0c65-4c5a-8a7f-0d06cdadf68a", "value": 76492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759071, "uuid": "c4095d83-6596-4d88-b775-a5dfb2c3b4f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759071, "uuid": "592179cb-811d-4c06-a2be-587b2d53bc87", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcc83b9-61cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780766690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766690, "uuid": "78a16768-4056-4f2d-a0a5-8bc3c0ee7dac", "comment": "Malware payload", "value": "52edaa8fdb15fdd169c57cbfd5268959", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766690, "uuid": "cce0f51c-26b0-4d87-a12e-6d857a23a582", "comment": "Malware payload", "value": "552c71822ee4b0c21ddbca8df0905c19b9d6192376766773f99fd3dca6ba27ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766690, "uuid": "eaba9d37-c052-415b-b93f-915c0a700568", "comment": "Malware payload", "value": "c9c60eaa895a462d8bda6020da945adb301a0ed3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766690, "uuid": "aa60adae-73fb-47ee-ba4a-887ea3db1d91", "comment": "Malware payload", "value": "85e553f4b87c70702db857e7d2eaa260a92e1340e83ab9cd1f65b711ae1a43d04b2757957e1cf2ab1e07f361c0bfce0f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766690, "uuid": "2b117c2f-164a-44ad-b187-e78896049328", "value": "T1D951ECE2B825D435F98DA439EB9D63987482241F0A18BE14758F783C0B8C94C23FE679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766690, "uuid": "e90144e7-cebe-42e6-a518-86a2e335b8c7", "value": "48:q994zVz1FbRL9uXuHVjHVKQlnv8f1nulDtGGDErfyX/HFd/E+MG8hJ:694ZjJ0twlfXN8G8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780766690, "uuid": "97b5a704-ba54-46b7-85a4-396991152dd9", "value": 2453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780766690, "uuid": "68176daf-5cb7-40b3-a1db-36d666ae98fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766690, "uuid": "bbc25fa4-ea9a-4f86-826c-ac5c711cd804", "value": "nova.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d19c2d-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765710, "uuid": "9aca7a07-b40d-4913-b6a6-bf6de4dc107f", "comment": "Malware payload (Mirai)", "value": "b824a8a3aa8551b2006940c85fdd6d23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765710, "uuid": "8beb26da-592d-4f20-9435-3465851753cf", "comment": "Malware payload (Mirai)", "value": "56163abfecf275a40e2b6a4aea702e2f1ea9d65e4de316a425d3cad688963937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765710, "uuid": "40ca8bdb-d3d2-4c7b-883d-c44e514859bb", "comment": "Malware payload (Mirai)", "value": "c80c716629ea98f362574fa4205bc866e582da9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765710, "uuid": "fbc41e4f-a53d-4530-9516-0c1440365871", "comment": "Malware payload (Mirai)", "value": "273881381544fe34edf21b121495dc05ff3bbf77ed135ce6f90b4841e27dbe69f0e33fe8416a2eec68b4c541a8113cd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765710, "uuid": "07cf7026-1170-4811-9e9d-13aee6254af4", "value": "T10343961A2E658FFCFB6C863547B78E20A25C339616E1C545E15CEA011EB034E785FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765710, "uuid": "222fce4e-2dc0-4698-b449-31df2fda83a8", "value": "768:wWx2ZQnvd3UPb804j80lLdRJt/XNt3tEwWzwsnusBkDwwP+ToSnOdiuxb+yzBHNC:d2+nvd3UP27rJ5NnwBkDwtOiMiyzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765710, "uuid": "c55ec325-c617-4eba-a0ec-eb515db73e65", "value": 56784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765710, "uuid": "819f3cc3-7148-4f89-b234-83ee9efc0ce3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765710, "uuid": "c6307c37-6a3b-4324-af2f-5e7081ab5765", "value": "35cdda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcc3e7b-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771468, "uuid": "22b099a4-59f5-4f75-8f4a-ea6f4577b55a", "comment": "Malware payload", "value": "b4918b890bff5900a0507dc8e6eb9b60", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771468, "uuid": "9949e146-c678-4086-9523-b2601124bd6b", "comment": "Malware payload", "value": "569db0772ea4cc44f10614bb6f1b5f1eb55bbb123e2f83d0f3e192c511675486", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771468, "uuid": "30310c03-9385-483a-92ed-0273fddc69af", "comment": "Malware payload", "value": "76e8b3ea89cec4be761fd6cfcdc3e43414f5295a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771468, "uuid": "06b153eb-26cd-4e59-a187-672b9304a2ad", "comment": "Malware payload", "value": "92df7116fc61773f90896a52a9374fe4a94bdc83c76e2351a9731ec57262b304044d8faead43312a41e15e84fc86a463", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771468, "uuid": "82dcfdc2-2a83-4fd3-9e8e-4c991347f22b", "value": "T1DDE313D8DE0F3D3A9C0ACC656ABFB0A4710890FE59DB60134DC868B6D7484B5D77A70A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771468, "uuid": "f10ddab1-f93e-44c0-8e37-d237bcdb3c7d", "value": "3072:jy5J8SE+6hUtO3v+YO6QW5H3i3IAV5jn0Zirl0vz75FQDuuN1tqlWTpcpOdkGvd:25J8SE+6mAvZz75X3+kz75Fo1tqlUpUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771468, "uuid": "7a460038-a386-414d-80ce-ecb69131701f", "value": 146317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771468, "uuid": "b3182e5d-97fb-46cf-b558-754d2ad2db0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771468, "uuid": "baf84825-ecff-4645-99d4-4cb6e51716b0", "value": "PurchaseOrder_006231_Shanghuigou_20260605.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614c3764-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780748117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748117, "uuid": "36fc5697-455b-41a0-9833-4d39f698383b", "comment": "Malware payload (WannaCry)", "value": "fb8fedb8875fe1fdca98963a50f500f5", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748117, "uuid": "78bac2d8-a816-41b1-99de-fa48b8cc8b92", "comment": "Malware payload (WannaCry)", "value": "572a24f5fa378e40078769917b19dd727cd34c4a3f1e3ca80d6b85fb69353fc2", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748117, "uuid": "0474f562-6f75-42d6-aff0-2165efd16b74", "comment": "Malware payload (WannaCry)", "value": "4f6504f4c7d87af9bc2bf4420bf65f43c462302d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748117, "uuid": "22dfcd1d-0a98-432c-b1da-298c72073a71", "comment": "Malware payload (WannaCry)", "value": "88c6cb4d835b70cef3b1bbff289a5c7c946b9c46a807950decd2f519d8f9a1c4b67fe5d60de400df1e16c6ec550682d9", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748117, "uuid": "eed58587-171a-4cfc-b176-dae00299caf0", "value": "T13036128932EC80FCD1176274D4B74E21F2B37C6A227D970F9B9086661E13791BB25B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748117, "uuid": "a701aab4-0bd9-4bf9-a90f-c9b1863b55ea", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748117, "uuid": "a8e1bbbe-cb00-4c92-9809-bd20fb3d9e40", "value": "12288:jbLgD1bLgmluCti62ybaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHe:jbLgBbLgurihdmMSirYbcMNgef0Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748117, "uuid": "ce414d8c-b548-49e4-828b-4ed234414b06", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748117, "uuid": "7629e13c-71c7-4877-af41-2e5af415b918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748117, "uuid": "ffff0540-b84b-431b-8a71-a1639f5dd704", "value": "572a24f5fa378e40078769917b19dd727cd34c4a3f1e3ca80d6b85fb69353fc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162cc77e-614c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780711484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711484, "uuid": "6e39c34e-cd8c-4eaa-abc3-f9b58753eec8", "comment": "Malware payload", "value": "9c10b5e6d87e8dab0b21bd3e50369b22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711484, "uuid": "ea12b570-c5a4-42f0-84ba-69549a0035ed", "comment": "Malware payload", "value": "57b4907df628c2135089eed941467c20089c6ed9e2df518ca22eb18e0fc01b5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711484, "uuid": "199e9b7c-d624-4e16-9770-d1a01049e1c8", "comment": "Malware payload", "value": "27e0423f7db3ca41e62e52d7bc7e67253deab69d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711484, "uuid": "27a32a76-933e-4b7b-82a9-bf93c2c36549", "comment": "Malware payload", "value": "73fc81985237920b5bf6fec63bde33e66c2158240f1128f883e3e754871e89b46c593e4eb5c4f1e99500101e5242e0a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711484, "uuid": "02dd7398-0255-40aa-9400-f1e820cb89ec", "value": "T194562711FE8B44F6E9431E3014ABA22F63315C094F24DBD7EB447F6AF97B6A11932219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711484, "uuid": "e60583c6-acdc-4352-94ee-02f449017a6c", "value": "49152:2aiZvfVXusJ+/tEATIz8Nz41AYVLT1MZyd5xvH7v4h1c9SM9QyzQEgBR5E25EFQ:4ZvdXW/tJsP75xvbw2XMEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780711484, "uuid": "e4463d0c-bf85-4452-a244-0c033e8f47c5", "value": 6041784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780711484, "uuid": "fc821fa9-50ed-4ecb-b933-01a8463b9be9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711484, "uuid": "438ee678-f6b1-46e1-a86d-6c86b161a57d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b07b0b-61b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780755379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780755379, "uuid": "d0a188cd-717f-4612-97b3-0daf679bd434", "comment": "Malware payload (Mirai)", "value": "a39b9bc43524d29fb7f335fdcaa05f73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780755379, "uuid": "d9ed3e04-e525-4061-b844-92c77b26e8d9", "comment": "Malware payload (Mirai)", "value": "57f73e320adae0ec0259bbedde81c2510a246be05db6598a1e7dadc0bb12fc0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780755379, "uuid": "16ef9739-c4f2-4cfa-ac14-d6fb1064021d", "comment": "Malware payload (Mirai)", "value": "cdc8380f26b41bb670ee0d4f0b93727dd9609785", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780755379, "uuid": "4aeabd72-80bf-4a75-aa66-293e3e78b9ff", "comment": "Malware payload (Mirai)", "value": "aa1c8cf10730dbfdab6af41bcb138673a3c614394ae6e486a03ffe68bfedb694615b145b0cf00bcf541775ca8630eeb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780755379, "uuid": "2fe24dfc-24ff-41c8-a608-73e0518148f9", "value": "T19E558E5AF2B370BEC057C030839BDB62A935F46541322E7B65C4DA352DA2E701B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780755379, "uuid": "02e00b82-480d-4cd8-8f18-c6317916dca2", "value": "24576:0bYe6+L+KdO9FTxFvAVyH1ULWu+u+wdLPqVr:0MV+L+KdO9FT7vAVyHuGGLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780755379, "uuid": "189850bd-473a-414f-9909-fc9b14bf777f", "value": 1335800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780755379, "uuid": "6691a347-bca2-4a6c-b601-c2d4bccf133e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780755379, "uuid": "383d5f45-996d-4373-b32c-68a0e180ef0c", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7299d4df-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748146, "uuid": "6bf31ba8-6955-4a8b-817f-45fa55692ba0", "comment": "Malware payload (Snojan)", "value": "1dd241d2abe91d2a384907341651d205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748146, "uuid": "d98a8a90-4fb3-43dd-9386-0626141ac353", "comment": "Malware payload (Snojan)", "value": "592cb1a608f3e693e2415f8c8e1c9bb40abdaa7c75c5350d25c0cba1322790e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748146, "uuid": "6de41b32-2d17-4b2b-bbba-19c42372a2ee", "comment": "Malware payload (Snojan)", "value": "8b3af0fefa4b022825db3709156d271241d6ff8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748146, "uuid": "52b69862-ef19-4f91-90e1-3756304a214d", "comment": "Malware payload (Snojan)", "value": "1457a9217a6ea653edfc6bfd56dbaa8c30a99b83545d0084cc9cdb78fba76a364c69601a1fd8ea29c270b7088b479316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748146, "uuid": "d5fb285d-0d4a-4f93-aa49-c4a21eb758fa", "value": "T14084F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748146, "uuid": "f649bc8c-6cf7-4a1a-8ea0-454824287eb3", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748146, "uuid": "1871a120-4f78-41a4-8099-66ab22f02c2b", "value": "6144:NrFZaaZmEJuaDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uch1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748146, "uuid": "6bbfd1e3-9b21-4500-a9cb-7b845cee573f", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748146, "uuid": "7badcef1-3987-4156-a8d6-28c3676f3234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748146, "uuid": "d4864662-99ed-41a3-bfbc-ea9b56f60ef1", "value": "MlQw3MhCUzK3jhF0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf6d30b-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747331, "uuid": "ec3945ad-8523-4905-97e1-fce5827d9e7f", "comment": "Malware payload (Snojan)", "value": "c1f3d27c1cde7bdc419962c61d5b24ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747331, "uuid": "19411ecf-7228-4fef-b8e5-2a3a8083c5c9", "comment": "Malware payload (Snojan)", "value": "5a0adb74411f2faeaab652eeb0261cd776d1286d8aa843e6de353e7b63d3a207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747331, "uuid": "71319754-10bd-40cb-a8a7-0ae0367c4012", "comment": "Malware payload (Snojan)", "value": "aa20faf75cb595587005cea6c591291f3ae80cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747331, "uuid": "0947a21f-e228-454a-9c41-8f1c095d7aba", "comment": "Malware payload (Snojan)", "value": "34139945ffc47ad454ccae084b772006c1873c463ae7774ef6480babfe3795891ea72317d02d226668064a72c9cf7bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747331, "uuid": "481a1061-bf98-44e1-b4fd-7bc4e6ab622a", "value": "T12CF3021646DB58F7E49B12BD469D9063B2FBA06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747331, "uuid": "e06ec1ef-993a-421e-b76f-c9a517e4c9fc", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747331, "uuid": "7e5fc152-6f6d-4b63-a3d9-354646cc7bcc", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF++K:QJ0TAz6Mte4A+aaZx8EnCGVu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747331, "uuid": "88432217-fb9a-42e4-8aad-2cb6a9da2982", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747331, "uuid": "76d3951b-5abc-4229-9e60-7cb91959dfa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747331, "uuid": "d25a8a78-b4c0-46b5-a137-e4cfbbd7d6f3", "value": "m7VAT6oq2CVmY5Fr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2aaa145-614f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780713142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713142, "uuid": "cd5827b5-d4ca-4680-8775-33095c766220", "comment": "Malware payload (Mirai)", "value": "0cf83d0b0c1a68355e24ad72f881bad1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713142, "uuid": "fe9d2c67-ffa5-4d64-b131-fc5b113bb128", "comment": "Malware payload (Mirai)", "value": "5a57d14783a0b84d1e302f4d40c2db654480ad53d33d837b42ecedd5377740af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713142, "uuid": "765faa7e-4cff-4fd3-b79d-821d547d56a2", "comment": "Malware payload (Mirai)", "value": "5724416a2106f74b1bd759d0b7f9ff8062d45e5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713142, "uuid": "d1aacffb-3050-4b7d-8873-098126323aa5", "comment": "Malware payload (Mirai)", "value": "beb6efcf936afa175e71b997f17a6db7aaa8d8f243ca33af9cd67cbd32b1aad97226ca3e9c200ae4d0600ae749e66796", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713142, "uuid": "5417a57f-55eb-46d1-896d-f17ea048e6c1", "value": "T1E83301ABCD42F9F1C498E532382DC1A8F615CE3EF33A477BC96136B90532B581D14992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713142, "uuid": "766bc976-95e5-4965-a32b-82a63c651cb6", "value": "768:R5iKtJQI7o3Kn0pe4Kvs04TR3tTTLb3gBppasy6IMZyOrnoCwl9rVra8coIXo/sl:HiKlaoB4t3tTTn3gBp0EaOrshVeBokGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780713142, "uuid": "17af6cf1-e5d6-4592-851a-b37b8dfc9916", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780713142, "uuid": "776e152a-f5d0-49a8-ba35-cba8e1643447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713142, "uuid": "6a67843f-33fd-4a38-94ae-0ce7852c7841", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcb0615-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759063, "uuid": "ee6ea6b1-fecc-4e31-b5a3-c75df039d5cd", "comment": "Malware payload (Mirai)", "value": "6e84e366e3b280484878ee5b94c1dc30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759063, "uuid": "4d280110-fa32-4b88-b1fc-5fd805b20330", "comment": "Malware payload (Mirai)", "value": "5ab013ae83e454d3a194668932415d7e58a4b74f9607d59d5926960772467352", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759063, "uuid": "894d55bc-7586-4344-8c45-628e9f0c330a", "comment": "Malware payload (Mirai)", "value": "dcbb25a6cd3cd8ab08ee190b7663b37c83575a89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759063, "uuid": "74493326-32b8-42ac-b377-2bbf2f52e464", "comment": "Malware payload (Mirai)", "value": "393b8604abcc7ea6b004176a8326fb1d3763b123112ccd08893f9f18083766190a485ba0be11a696a0f8aedea587d85e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759063, "uuid": "90156b1d-71af-43a7-96c2-c6269ee81a28", "value": "T10C634C42B31C0E47C1635DB02A3F27E193BFAA9120F4FA85651F9B869675E321186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759063, "uuid": "dd08e49e-e1b7-4bda-b36a-f6f538e4bd12", "value": "1536:IqXDegYm3ZXNA0jyyTNoV4IabA++UpPAKBs+s/Bg:VnhOX4ID+376g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759063, "uuid": "1264d1b3-28bd-4d97-97b3-c55fe1d0b63a", "value": 73348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759063, "uuid": "6121204d-10a1-4467-8f8a-f8162dbc2424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759063, "uuid": "1fe63dd7-f5b2-40c1-b462-8984a168f3be", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c75eb61-6160-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780720111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780720111, "uuid": "c30107ae-0fdf-4fcc-8c42-68e78e521c24", "comment": "Malware payload", "value": "ad2df681832a91fbf9d81021b92bcbb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780720111, "uuid": "1c0beffd-f92f-4bf7-8160-b3a8df317524", "comment": "Malware payload", "value": "5ae73f67f96cbb0b130e3ed04f7be2272647a65784e2b96c1af6f1805c9610d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780720111, "uuid": "2058c73c-1912-4ea6-965c-d0813e2859aa", "comment": "Malware payload", "value": "5063c2cc4aac1910060d8278e06c768c86b8bb96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780720111, "uuid": "bb4005c0-b6c1-42ee-95a8-8b4ff445dd84", "comment": "Malware payload", "value": "8b17bf2d55fa2f251b9f09a9d5b84dbbd047de541a7f89d47320a3f92d2488e83b230891463b1ca72477129ddf963dbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780720111, "uuid": "8f4eeef6-357a-49e5-bc42-207ffd4079c2", "value": "T1C766E809AD842BAAC06C4B7444FEC95623B45D140AF2473626A5FFE9BC762397F47C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780720111, "uuid": "1642206b-bb56-4f64-8a09-34791b14d606", "value": "49152:OnXt2RfVImSPZ6bAo0BKSxXr97B2uKJrYeAF4QyISwD/y0UFEV6Eg5Em:0/RlBKe7cYF4Q+Em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780720111, "uuid": "b3238816-4ab1-496f-ab6c-926bd1f0c7c8", "value": 6881495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780720111, "uuid": "890aa0f5-8140-4d92-81b2-c473068429fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780720111, "uuid": "08a55ba7-a229-4907-a6d0-5c1dc51d03f0", "value": "SecuriteInfo.com.FileRepMalware.76616917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f59099-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777460, "uuid": "37aaf224-3ae0-433c-8d95-c0660e785e5b", "comment": "Malware payload (Mirai)", "value": "927f167ac5cc7f09d22755d7faff4183", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777460, "uuid": "306b7f8b-9655-4673-b209-624e575e3b23", "comment": "Malware payload (Mirai)", "value": "5c1b05d1ec38157d0840ddedde396b2df8e3e360fc904cbfa721bc8909660a76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777460, "uuid": "5f2c0725-99cc-43e5-97b9-91b40ed6f17d", "comment": "Malware payload (Mirai)", "value": "b9dfee1712cedbdb3fb01af56c8a1a212e4bc59d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777460, "uuid": "f738d918-4aa8-40de-87c9-4ebe55bf4a98", "comment": "Malware payload (Mirai)", "value": "5b81426fb867ed7154bc54808339a8e151e7afec16e0c2d90bdddb5c4a50c8f221c7f3e47e80afd3ebdaa161263a8d7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777460, "uuid": "b3c6c8d6-be91-476a-bc5a-9306d0aa99e7", "value": "T1F8E30946E8819F16D5D512BEFE1E128E33231B7CE2DE72029D14AF24778A86F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777460, "uuid": "1cc757ad-cdb5-4f6f-8a78-6d216a1b242e", "value": "3072:q22oLmpMguHcUNVUHalw7W6uH0fsfCfJxdrSXY6CdO/sh8gwzLXLw3av2CZ0oMQ:q22oLmpMguHcUNVUHalw7W6uH0fsfCRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777460, "uuid": "cc77ca71-dcea-4778-9016-85dffc7c6292", "value": 156304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777460, "uuid": "2d5f3dc9-41d9-42e7-b37c-93c5c7b5d6b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777460, "uuid": "13418c02-d1c7-496c-b2a7-989064ca0cb2", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2c7b96-61ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780753397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753397, "uuid": "aa394b29-afe6-4a6e-be51-643a54bc1407", "comment": "Malware payload", "value": "fd31696d8d54e9ac273f94da510b2fe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753397, "uuid": "1230c180-53bf-45bb-8a65-b6c6682c34bf", "comment": "Malware payload", "value": "5cada927a1017cf369e5a99e253a4771662c101a9849f6430a528aa841d06145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753397, "uuid": "1af62af3-0ac8-42c8-be23-5d7c01be0277", "comment": "Malware payload", "value": "e118fba0a9283ba3aac6a039cec6f21f98bb34eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753397, "uuid": "6a71360b-caea-4a41-9978-cd3c990d6ef1", "comment": "Malware payload", "value": "b073487ac4b1f3e3cecc61723fabfeaf16d386a14311f2db15a3d3d9f06a4b4f1c25d89941b44b87ff031710a595623a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753397, "uuid": "a9ab5574-705e-4f48-b9e9-d45fe2894e9d", "value": "T11A0833A0613AE6FAF5723CF547E06911D345CF1C81B95B5E5A9B31C672A028A01BC3BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753397, "uuid": "5bd691e1-b106-4288-b221-50d68dde78a5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753397, "uuid": "cccba25f-46ce-4241-aba1-6d353a5b86ed", "value": "1572864:Lt9IKPfypXudKxGtEOP0So3V+Z6wh9t2s9hAbTkdFnVBfYwoqZw6TgjPSBo+W17:LUKCpe8cxwFobh9Ys9GbTkHwb6MX17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780753397, "uuid": "92eb4692-279d-42f8-bc5b-fda827372b66", "value": 77324013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780753397, "uuid": "549252e0-3781-4f6f-85c4-6ed79e259873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753397, "uuid": "1fa8cad2-c842-477a-8ff4-af6cf6c69a35", "value": "activator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b292d9-6180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780734172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734172, "uuid": "1623d176-30f2-4b71-9f59-04ce3260373d", "comment": "Malware payload", "value": "ae13199239d91e27aacf644df78894ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734172, "uuid": "a27bcafa-130e-4bbe-b4b1-026b7e6a0612", "comment": "Malware payload", "value": "5ddca587da191f27cf189f2231a0e8f90cbe1739f8a6236b5180c658ae8be512", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734172, "uuid": "6fb60327-0169-449e-898a-d0b3bf4cd271", "comment": "Malware payload", "value": "e71b05d2a0b2b920b1c6dcf473c2e77b06a2737a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734172, "uuid": "aef1e541-f052-4999-a713-4dec1a91d698", "comment": "Malware payload", "value": "9b120305b0fe8fea12401c7209c47f0f2873667d9db9df628c07869f5d42bfd8dda8fbb65a7d1d0d55973e492bf871da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734172, "uuid": "31efdcee-8c31-4099-a986-b0cff37aba89", "value": "T1F8D2DF34C4C82FBDEEAA2A1D06FA6620D7D68B1E9498860737037D9B4F37C80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734172, "uuid": "1f09038c-235a-480d-8706-b6b69401f26b", "value": "768:eumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:eu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780734172, "uuid": "0e21bbc0-73d2-48f1-a6c2-788be638bb02", "value": 28658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780734172, "uuid": "a44fa332-9d9f-4cf2-9637-ea4815eaad6a", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734172, "uuid": "afcf7baa-12f6-40bb-9ec0-7f7c56e6242a", "value": "23.94.110.24_1780734105107476_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b3cb23-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771311, "uuid": "6c6519a5-fa66-4855-968c-19c8a406df25", "comment": "Malware payload", "value": "c233614e1002b91e5020ad6a9a4d9f83", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771311, "uuid": "276e9292-00f1-4386-9125-832a00801ad9", "comment": "Malware payload", "value": "5df1f43eeb9210c54b4a31f067f264f900b7bb3dc16658939d86619afa781133", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771311, "uuid": "1609dc39-c4fa-44ad-9347-903a5eade622", "comment": "Malware payload", "value": "7cdf5be3432c2a1220d9d96e7a6d5ce80872ed75", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771311, "uuid": "8c42cde3-6de5-424c-a0ad-ebff71a4aa2d", "comment": "Malware payload", "value": "210ae70654ef25eeaa1833c904edb7955db8d211ca214a19d8036978ab710ad4d44ff37b074891bdafbbab294951965d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771311, "uuid": "ab7c0c8d-d505-4bcd-bfce-32d5987df33f", "value": "T1D9513B028FD7F49E3D1F25A24625A147A1B4844CEDCEE038476AD4793A2C30746A8A1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771311, "uuid": "0d8dfc96-4f65-43f2-82d2-d0682a2e9893", "value": "48:ZSw9D+yT6n3JDXaJQYBRdGSP5dqn6PrJ3V3+VlCm:ZSwp+95DXaGYBRAXsxzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771311, "uuid": "e1e31f91-7785-453b-a3d6-43b6cc065dc9", "value": 2676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771311, "uuid": "83e0b98e-f993-4b39-bb8e-f55b521f7aeb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771311, "uuid": "ed527b6f-e5e3-4979-868f-1a64580ad76b", "value": "MONTAJES_EL\u00c9CTRICOS_TER,_S.L_REQ_03060026_(2).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9921e2-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729399, "uuid": "16e28c4f-b4d3-4d8c-a984-6e78acb41ee5", "comment": "Malware payload (Mirai)", "value": "198353c4616be4b24595479cfabe78fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729399, "uuid": "6512a58a-43d2-4c8d-89de-a393fdba6ae2", "comment": "Malware payload (Mirai)", "value": "5e9f2982dc7297f19b1d67b32d983adec4b9fddace182a7b4c248125028bc206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729399, "uuid": "72f5222f-3c29-4a13-99f2-5f76334a43be", "comment": "Malware payload (Mirai)", "value": "e57bdf017fa3b5be5cfec647ff45dfe246f0b7e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729399, "uuid": "0ca27996-5a6c-4de9-a498-6c6c43580658", "comment": "Malware payload (Mirai)", "value": "9a3de442e992f753462b79917349425b067d8c106d2df01bfdcf79439d6e285300ec3d9dd1ca2eb4d2122b9793fe950b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729399, "uuid": "b5f8f19a-26fa-4770-a0d3-553aea39a2d0", "value": "T14F157D5AF2B330FCC55BD03443ABDB22B931F46911216E7B13C4EA352D51DA12729FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729399, "uuid": "6c79ab51-9a1d-4fe3-85fb-ad1bf18e5c36", "value": "24576:gwRPppUjZ0HpXqbv3jIW4JRSAa193SVqsO2C:yyTSAaD3SVqd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729399, "uuid": "4bdba426-6d9f-4b0e-a5b3-b2b6cb71f8d4", "value": 933992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729399, "uuid": "02e68886-f73c-4339-a695-eff77d6ba4ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729399, "uuid": "4ee67172-d113-426c-a378-f25b12cbe846", "value": "kaizen.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaee002-618a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780738419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780738419, "uuid": "2ecf7945-91cc-493e-8a40-8e0a06895d28", "comment": "Malware payload", "value": "4144436a55e743337e0afcfba4bad9c0", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780738419, "uuid": "a68f7dfa-1143-429e-b2fe-0038d1c64809", "comment": "Malware payload", "value": "5f45ef66729f71b68d7761835e9d3a39016e44d093b404351b30860ad7f5624d", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780738419, "uuid": "b4f4cbe3-4988-4029-a054-8b6f18e9d8a4", "comment": "Malware payload", "value": "828083bbef197c617bec4ebe95f6f250a4774903", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780738419, "uuid": "d2b954e4-04d5-48cb-adf2-89a6aa57b250", "comment": "Malware payload", "value": "c8ccf9d9f05ed6d9f6f0596853591a419ca3d80cb4dedcd77208fbeebe462eb87966fe3c552cb77e6578ea853939aceb", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780738419, "uuid": "c9af44b2-8f2f-4bbb-977c-3de850df1313", "value": "T111B43A376E296D84DF950EFF8232C5528DD9EAC7A0A5C0E5BC400901BEE97C4F968763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780738419, "uuid": "6b5aa774-0baa-4c17-b5b7-7caf9b14c4a6", "value": "6144:4FIRhqO1ViVAj4Z4FYfeL0/0O+IL4YCeWj1lNTuR:4GBC9Z4imL0MONcYAj1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780738419, "uuid": "cf0e2784-cf86-444d-8b81-df01cdf1c7d3", "value": 533854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780738419, "uuid": "9797c56a-ebad-4c12-843b-95fadb7178e2", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780738419, "uuid": "3fa9fd41-b3f7-46e2-8368-fd20a65d0f40", "value": "Software.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72e4822-6174-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780728987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728987, "uuid": "eb2f684c-b63e-4bc0-9a74-5368b670ea53", "comment": "Malware payload (Mirai)", "value": "d0b4baa66faf4b2e8387f69b9a3c6af3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728987, "uuid": "f58e4f53-2ce2-4c6d-91d7-e3fbdf515818", "comment": "Malware payload (Mirai)", "value": "5faaa87d605e11d4a55545e5fef13c4f3e72ca3d7873789ca96756d68ab5de72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728987, "uuid": "dfa3e436-049d-456b-8e1a-8677b57c08d8", "comment": "Malware payload (Mirai)", "value": "546065ea6bf6c265768a2304cba2cf0459a0f515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728987, "uuid": "8bb24a90-8d58-4b62-af57-10646e86d95e", "comment": "Malware payload (Mirai)", "value": "24427e74538143ff058beeba1f905c8ea4788f32f110b6577f6bf9c1a678a23917f98341e52adf5816d0f04ed72cb1e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728987, "uuid": "6e96e38a-4357-44aa-bc5c-586bf5a4426c", "value": "T10D13F1A4F46AA670DAF0C970D45C8013D2789F65C5FF34BA977881A56EE23426BF4833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728987, "uuid": "208bce92-8a84-495d-8925-6a82074a612c", "value": "768:sgD5kwqg0/5MrZ0FMxJlooLNWID+WlwsKNxQanh1q3U7C3kE:sgDKw2yr2FirZW2+CBZoh5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728987, "uuid": "296893a7-c122-483e-a69c-336930e0e60a", "value": 42120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728987, "uuid": "a0123c58-8c72-4456-8b88-a49c3fee1cbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728987, "uuid": "ef531155-6502-447c-ad2c-153251e59aa6", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b822b4b2-61ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780753417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753417, "uuid": "62f65751-79dd-4713-ba02-ad734572f3a2", "comment": "Malware payload", "value": "bbb16f431b37b8d639137755877461b8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753417, "uuid": "19d45b43-bf44-4e64-92ba-a504cd68422d", "comment": "Malware payload", "value": "5feb26de5895690dc911c4e6a714f67f185cef3508d8833bc0e390cc8a1debbf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753417, "uuid": "c5939886-2ac9-4003-8435-3843c904b723", "comment": "Malware payload", "value": "2cd4ff93660d2b8a1739c395312d3fd2940c5847", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753417, "uuid": "65b2e2df-6a5c-4d9b-a5dc-92066a7c3009", "comment": "Malware payload", "value": "ab754cc55637fce78cf50de53c131539ca796132b71c92c3596ea819690768bf0046d1b0fa83e568561e29ae0472e1bf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753417, "uuid": "4a481c1e-aede-40dd-9398-fad32bdee9f6", "value": "T11001ABCEC022DA208196E89D62E7A1807824C3CB66464FED7F8C043EDFADB687015FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753417, "uuid": "c4944a62-b5d0-4ec8-9d70-47f1abb5dfb6", "value": "24:kXCKysE2hi0ziQvZohaOzJiq7BAEvwYpG7:e9Qp+MsOkkGEvwYpG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780753417, "uuid": "3e528e90-46f9-4ffd-a0c9-4bcb94015d45", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780753417, "uuid": "462b38a4-94fd-4dc1-947d-51b2bf52f375", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753417, "uuid": "0d15e171-6f7d-488a-8980-a9ff4a9ed817", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8e0d2c-61cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780766683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766683, "uuid": "3e9abcc1-cac0-44d0-a77e-e6b3f160ecb3", "comment": "Malware payload (Mirai)", "value": "0e46c6e453f46d7bc09293dc52542963", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766683, "uuid": "b6b83675-25ff-4005-86b3-c0217dda650d", "comment": "Malware payload (Mirai)", "value": "602168fc747715effac0ef226819c97311b2404cc3dd83b510fda0d4db12f1cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766683, "uuid": "a0a5e6cd-860e-4f68-bac0-88f55f288143", "comment": "Malware payload (Mirai)", "value": "af0e3d6a10dc63facde83a9030ebf2f264341d40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766683, "uuid": "f8f378c9-4575-4c8c-9d46-1d514bee62f8", "comment": "Malware payload (Mirai)", "value": "0352c328c794d63fbfbc7d80c8d3d573618aef4085f9d1d5fd22c3279fe88e77726b8fc5cfe1bc1789e308d79b1ec746", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766683, "uuid": "8e3df66e-b8d2-406a-baf0-f7a58b41f63c", "value": "T1C9C33A45FA43CAF7D40719F021F7AA3A9A30FD3A48B6D485EB507EE1C6569C76206338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766683, "uuid": "4dedd7da-c748-48be-8e75-ca9184fc32c9", "value": "1536:VkOGCswLV/jqRLoHFO/YqTmVzWwQnQiWe0ibhp9w3lpAwLg9Bdgy:VhptXGYO9ZNWe0UhpapAwcDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780766683, "uuid": "bb093df0-8f06-4748-93d6-16fa630d8a5d", "value": 129764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780766683, "uuid": "d29f4355-2a1b-4846-a643-775088bba60d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766683, "uuid": "3f7bb1da-a85c-47ac-8015-9b77b08e41a0", "value": "nova.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59336d2f-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765713, "uuid": "348dc0c3-da56-4a53-a154-d0ae7c242fe4", "comment": "Malware payload (Mirai)", "value": "ca4a2beb7e688afe066706c3c234c29c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765713, "uuid": "8adf2c0b-d277-4e9e-a960-8d4d604ff6ea", "comment": "Malware payload (Mirai)", "value": "603b6edb14da45403a10552f23f254dcb9e4665e151a0d82d4b3dbc0b4c0d494", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765713, "uuid": "935ff8d1-fc0b-4535-88ac-5e3e7ae6510d", "comment": "Malware payload (Mirai)", "value": "fc508c16a5db0fac6af002e7d9f8d64cb2380a8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765713, "uuid": "8b155447-fadd-414e-b3db-daa1e2f141c0", "comment": "Malware payload (Mirai)", "value": "21cda0929946ffcf815aee5ad2a5907ffafbeffbdfafc222dca4e39f8ad8fd2fa547c2aa3e640003f6b404350cf00a6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765713, "uuid": "b1619ab3-b144-4c35-99b5-647803bb6142", "value": "T17DB33B46EA418B03C0D5177ABAEF42453323E754A3DB73068A186FB43F86B9F0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765713, "uuid": "857349b8-9bc4-46da-8cb5-ca1125b8baf6", "value": "3072:cFmowWuMetnN0oihFJXSaOVHIjaM/9K0r:fowWuMetN0oihFxSpHIeM/93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765713, "uuid": "b925edbe-78f9-475b-aa4c-092d3a249ca5", "value": 115367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765713, "uuid": "eb20eb69-53dc-4475-9eb4-80153db1ed29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765713, "uuid": "b5f1780e-0b57-49d4-bd0d-4243ac858740", "value": "1bedf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767a1391-61c7-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780764473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764473, "uuid": "416ad29d-ef4b-4e38-bf48-adf5197dab6b", "comment": "Malware payload (Stealc)", "value": "89db7f30b990df6be281ef43c6baeb31", "object_relation": "md5", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764473, "uuid": "98362699-b8c2-40a7-b9f4-e1ae49e83d83", "comment": "Malware payload (Stealc)", "value": "60c814c50e67dc7f3955480940eefcca439218e841ab28dce2348e5791709ca0", "object_relation": "sha256", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764473, "uuid": "9637f075-6a71-473c-b149-1162616c3cd5", "comment": "Malware payload (Stealc)", "value": "20144fd3597f80235d1ede9f6e5a84e7cc290c26", "object_relation": "sha1", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764473, "uuid": "59ab82c6-adff-48ff-a0ed-99a41c8979ed", "comment": "Malware payload (Stealc)", "value": "0d79ab93184134280f62ff29f28641e207bef22285ac5ffac8671f618ac847e6b98637c8f7be87e254f3691185ca9a2b", "object_relation": "sha3-384", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764473, "uuid": "b0513e5d-8543-43da-8bc4-e3c02e9b8470", "value": "T1D7147C4763EA21E9E7739138CAA54A13F770B42213149BEF07E0865A5F233D1AD39F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764473, "uuid": "5f8ff2f0-af5b-4dc2-aab0-1ca33d4665b2", "value": "0be878847a955d68de7730bad92f9303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764473, "uuid": "1d9b9753-a5d2-420a-aad4-cc3a1c60f44c", "value": "3072:3gWb82gcMbPdG2kHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:3gv8wqyrWpAKhhvORHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780764473, "uuid": "371a66d2-3bfc-423e-b99e-c6104594713d", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780764473, "uuid": "162f90ba-9d6c-44c5-82bf-0e41f3434b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764473, "uuid": "b5f9bcad-fbc1-4774-868d-56594c90fe27", "value": "16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a61ad8-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780771317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771317, "uuid": "ff2513b9-ac6f-4fb1-ba7c-ad0abd9bb726", "comment": "Malware payload (GuLoader)", "value": "b46a47c9c2c0657323d9385e3cb53e0c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771317, "uuid": "0674959a-bbd5-4959-be4a-cc8a6afe7f70", "comment": "Malware payload (GuLoader)", "value": "61bbc3575916717e15d80de6bb0f702c2dc93dc89c6682f358eb73fcde5dfdc9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771317, "uuid": "62b28e2b-2144-4be5-b968-5a093abba356", "comment": "Malware payload (GuLoader)", "value": "170410c78d5bb446527fa42fc9a6246772f21807", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771317, "uuid": "8b34384e-0b79-4534-9f8f-c0a2cd5a864c", "comment": "Malware payload (GuLoader)", "value": "40c915017a696bb09a2f368651465fc1dbb493424a89f722277db08ab1163132ea80a8fe22127b91741c758b11bf2e6f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771317, "uuid": "ce910811-fdfa-40bd-b0a1-b385c625b3cf", "value": "T1052413C7D0C9D0EB9A13F2B96EF4B86107ABB5AF69558192D01CD10BF2169EC2D363C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771317, "uuid": "d7147afc-798b-42b7-9a1e-3b94f241e8e2", "value": "6144:u03968vuRMSK4YUzk+YPrjdirB+gHXEh62PQPtVDx:uW+A6zpkhirAGXEfPQPDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771317, "uuid": "258e5d89-f892-436a-904d-23712a5f3aef", "value": 212009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771317, "uuid": "8beecf7f-7cab-4720-a417-5daf35a922a4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771317, "uuid": "02602a54-096d-45bd-b8cd-3985b8506756", "value": "New_order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20107a58-61f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780784085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780784085, "uuid": "fcb83716-0542-4d03-829a-6f497c3f51d0", "comment": "Malware payload", "value": "ecbc94732380bce604572eb328280bf5", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780784085, "uuid": "0b40dc00-80f1-43c8-bf39-f418b6298b87", "comment": "Malware payload", "value": "6266afe2c3346f13d28091c7cacfa31ec104babb432c5334d308dd277a917863", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780784085, "uuid": "d0aecdd1-41fd-418c-b136-91138059d96f", "comment": "Malware payload", "value": "2b8427baf77d0896b11cf77bdd3b00d6d4e86e4f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780784085, "uuid": "4f284a8d-04aa-4489-b617-a43365a7d403", "comment": "Malware payload", "value": "d998cfb168fd470332c4860e45aff6d65e9d879a0be901a997e965cb5cdc773e26bcbd84e9aca25dcc123e62e89bb532", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780784085, "uuid": "3a64b02c-66ff-4a73-8f7e-1c2ecc6f5fa6", "value": "T1FBD5AE0378806278D9D9F13286A26152BB3078441B3523C72BA5E7B91F3B7E45F7B7A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780784085, "uuid": "b890fb7f-9774-4fd1-8f4f-876602d9556e", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780784085, "uuid": "b8505881-d673-4bb0-bb40-ee47d0b37a1c", "value": "49152:C9KMHTBxxUlrb/TjvO90d7HjmAFd4A64nsfJR3wn3FTL074gQ1ggzPoKHkneUSgE:QxxUo3wV3sZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780784085, "uuid": "d726d2cf-6590-416d-bb1c-5decddd3cc2e", "value": 2858120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780784085, "uuid": "e1faa99e-49ce-4400-b1af-a82171df9df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780784085, "uuid": "0c9e8e9f-e2aa-4b5c-a44f-09190c0d8f6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6fcdda-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747280, "uuid": "7a4a3e24-09f0-46b9-a799-cf0b3f10b95d", "comment": "Malware payload (Snojan)", "value": "b97e2d643f324d4de384a73e48429e41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747280, "uuid": "a8a00ad3-7b04-46b2-abe7-0a6de1856dfd", "comment": "Malware payload (Snojan)", "value": "63d04df769f4cc657cac601e106e19e2a334251f35a7b33bb216116b6bebbb17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747280, "uuid": "dbe12234-cf7f-4365-b7a7-f72561dc1fa5", "comment": "Malware payload (Snojan)", "value": "6b2dddc71c409e9b1920a69e1d2d54dca03ba5ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747280, "uuid": "8f5bc1de-a7f6-4c31-a635-f6209a077e5b", "comment": "Malware payload (Snojan)", "value": "e83026dd3118690dd7ffc4c8c934474750c16a5d8eaf31e342c3589a6d7300a41d0cc3627a55cf7cf0256fb970bbacb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747280, "uuid": "691360c4-a72c-4607-8ccd-766b65c9f457", "value": "T13BF3021646DB58F7E49B12BD469DD063B2FBA06F4BCE3EDBE1FC224DC6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747280, "uuid": "da585d40-2790-418f-9492-94e2aba712a3", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747280, "uuid": "f84331ae-87fc-4418-9d7c-524f377f56e4", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+QK:QJ0TAz6Mte4A+aaZx8EnCGVuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747280, "uuid": "3b9b8173-7630-4a9e-8baf-4048949ed60f", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747280, "uuid": "5dc8418c-3b74-480f-9c73-c58cc92ff7cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747280, "uuid": "258a55bf-82b3-4f0a-bde5-1e3ce02492ab", "value": "cdH66MY66BE2KjqE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44237113-6175-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780729170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729170, "uuid": "c29be276-8358-4b34-a509-61e66045c180", "comment": "Malware payload", "value": "80e91be7486037f17721cc2c69c0c99d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729170, "uuid": "0f8ecb80-724e-41c2-94d8-7a9e6f0743fa", "comment": "Malware payload", "value": "6419e9b6dbebdee43f6b18029fe6498e62770d1fb6a5fc6ae4e859b9faa937c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729170, "uuid": "a0fa1d3a-97cb-4118-9bc5-dab5d30eb1cc", "comment": "Malware payload", "value": "80f7ad5c8b6ac7e19cb27ec2a1959903cbd1c4b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729170, "uuid": "1903b6f5-c560-4429-b4ec-8bbd6a49bf1b", "comment": "Malware payload", "value": "6592d558dff85433e24143b9749af639f71f442a62593d2274bfaa91c8b2a48e4b34550c66c97da07c695eb78dae9e43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729170, "uuid": "1fb98820-1d8d-4c7e-9d2d-6b5d138095b4", "value": "T1D703F14A081D7DCCEB25593BCBE46F600DB6DF76E9A24C0B501190DA9DC24B63DB23B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729170, "uuid": "6e18fd46-c660-4d7b-9248-12d1d9cee031", "value": "768:dkfOyexjr7yXXx3Bxa657Xg+ftnELa7hX94Uh/4L9LO1LJ5SIDVDJgGlzDpxYsi/:6f4ZyXXxza65jg+fNE+7zHm9LO1F8yV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729170, "uuid": "074263a1-137b-464e-8a14-98598fc586c8", "value": 41000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729170, "uuid": "5cafe6c6-7141-4107-98bc-11415ff047a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729170, "uuid": "db9f762a-1565-400a-b6d1-97d2343188bc", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4f29e3-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747308, "uuid": "609bf0ed-41c8-465f-aaaf-2ec447cdc1a7", "comment": "Malware payload (Snojan)", "value": "c1fea25a01ffca3b682f0d2c3101b188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747308, "uuid": "82b3deec-6944-4058-91f0-3ff092f3fa6b", "comment": "Malware payload (Snojan)", "value": "647e4c1d6321175c6f298b1d3815b84eabc684a27e38aed6c3952c0544604e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747308, "uuid": "bd1d9017-c2a2-4541-9fca-ea4e8256cc7d", "comment": "Malware payload (Snojan)", "value": "934a3225d5ffd06964491e1dff136b860c87f963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747308, "uuid": "d9c37f88-4f4b-4c3b-9a4f-89a1cba69a3c", "comment": "Malware payload (Snojan)", "value": "2b391daadede502ac0f7033120042166cae10382d70df7d334e78348f5e7344a92bbddaf86c0a8a88c2fd00cd25be108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747308, "uuid": "14e5683f-3847-49f3-83ed-4dc4cc8382c4", "value": "T1F3F3021646DB58F7E49B12BD469D9063B2FBE06F4BCE3EDBE1FC224DC6062B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747308, "uuid": "08f0194f-8949-47e4-b0ac-934db76ae9a1", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747308, "uuid": "bf3c5c76-179d-4110-8334-cb2bef7435e6", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+UK:QJ0TAz6Mte4A+aaZx8EnCGVuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747308, "uuid": "68a6c4a7-dc56-471d-a8b9-c582a6a5d960", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747308, "uuid": "8d752d04-a1b7-4afb-8e7b-4d5d5413fe90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747308, "uuid": "dd193db6-2156-42ef-ac94-264d00d2bcf9", "value": "gvwKxOwUCB5BEK0y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa8adce-61db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780773124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773124, "uuid": "47992a1c-80c3-4c64-ba71-4f837da476b7", "comment": "Malware payload", "value": "e3cbf8cf75c8ce29f8f0d816d712f5f6", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773124, "uuid": "a3621f5a-1112-405a-bf4a-e061dbc1d885", "comment": "Malware payload", "value": "649f7fadef7147e01e9ca6532af9b5edc5bcbe483b181010f2fff89b80bd6c74", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773124, "uuid": "6a144c37-28ec-47da-9e13-fe644c1e3ad1", "comment": "Malware payload", "value": "787e05553bdca36a71a3599031e3080139dc9a32", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773124, "uuid": "5b8a58df-260b-488d-ab2e-975f4e3a49d4", "comment": "Malware payload", "value": "0b522867d0b685b9e6a09e9dc320e7cb47c33a622f2e5595475389e6cc74c4bb4ef509ec23820adc642b55984a1a5e24", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773124, "uuid": "fe952702-4a73-46e3-be99-41ed0c3549f7", "value": "T1630833849990E16AF6BDD4B603C0EC6583C04B9B683C420D26ADB5EF75C66CB31AD71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773124, "uuid": "d2ee75d9-5d66-4869-98a4-9b0c51045e70", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773124, "uuid": "1858686f-4a6e-46d4-9fa6-e2f963656875", "value": "1572864:5t9IKPyALYb8jzkJ3dZ42717mNOsu0tK6FTEckk7:5UKKA68j03dXFRD0K6FTGk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780773124, "uuid": "39a60401-13d6-45e4-b84a-f8547b5b78db", "value": 78010654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780773124, "uuid": "eabbec3e-442e-4379-9dd9-854bc5b5975c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773124, "uuid": "5140b83d-5b59-43dc-94f2-7c7eaa939d6e", "value": "GitSoftware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23895d96-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746725, "uuid": "1f502006-7a7b-4d3c-94f3-f678dc2a54ee", "comment": "Malware payload (Snojan)", "value": "8dc9afc9e13aa778eaee1d9d9abd1d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746725, "uuid": "0f5c2f36-3489-45c8-9182-2e1a013e1ffa", "comment": "Malware payload (Snojan)", "value": "64e962315d289baf3a345663dc55ba6502a88c02b89508a88b5a57eb6f3edfb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746725, "uuid": "403b5d65-d06c-4860-9b40-3d49e303c836", "comment": "Malware payload (Snojan)", "value": "690b53e1379673348c8e18de68dd7a2490dcea8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746725, "uuid": "a367ee54-cf6d-420a-af37-4d8a0367ba87", "comment": "Malware payload (Snojan)", "value": "692e68e362ad08ce04b70e9a4b86e0e41607586f80cd274a4766add4ece2c5c8a3b63cc27717bcb0c5ba3797b1058d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746725, "uuid": "be3326fa-c893-4034-95b7-25130a390b75", "value": "T15E15222471C0C4B7D46B413544C9CA72AA76707247BE99DBBBED63B9AF203E163342C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746725, "uuid": "d293e775-b257-408c-9cfc-95657ab27e4a", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746725, "uuid": "93e83b9e-af27-47cb-b56e-7ea9c233ed0d", "value": "24576:/Y+Lk70Trc18BSnLW2CRBKViu99LK1Rad6yZcTx:5kQTAKYS/v6h3+1uhZcTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746725, "uuid": "28aa8e4c-c8fc-4910-b5fb-7b344a9caf83", "value": 923104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746725, "uuid": "e73edbba-dd31-4107-968d-28258366f9ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746725, "uuid": "19c5655a-02f5-4637-b6b3-fe2e0e17276e", "value": "GOUktxSA0fHlcdqm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb49c4c4-614f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780713157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713157, "uuid": "a44e12e8-93b2-476e-9016-036ce6b95e96", "comment": "Malware payload (Mirai)", "value": "4ff8b65b2423dfa9fcd88f56cb532371", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713157, "uuid": "b0adf0ee-0266-4885-9168-a198b0995b1c", "comment": "Malware payload (Mirai)", "value": "657a2f9ef037bdb4f45878e8e163bc3a35735cefc058450b422b2c8d693da768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713157, "uuid": "b1da033f-7147-4fca-8919-c66a7e3d61ef", "comment": "Malware payload (Mirai)", "value": "8d4c7bef7ef2dde09f88fc43a3496745d694b3b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713157, "uuid": "84202222-274c-40fb-8c65-fa6a13789143", "comment": "Malware payload (Mirai)", "value": "4d120d52b1c673b828e58360fcf645b34b639b543b51dd62480832836b6a3bfd27b1f93576bd7f0afe59ead0a0071098", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713157, "uuid": "3f53ffae-a4c3-46ae-beb7-cdc8eba33a0b", "value": "T12AE33B07B4C180FDC4DAC1744F9EB53BED72B1AD5238B26B27D4AB222E49E305E1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713157, "uuid": "05751177-a2a9-432d-9a1f-63e8ec580aac", "value": "3072:oweEIxdWhccYtIPJHX1VWReCcvQJuyoXQIdS94LLLLLLLLLLLLLLLqL2LLLLLLL4:oweEIxdWhWyHbLoJwe4LLLLLLLLLLLLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780713157, "uuid": "beef129c-9a05-467f-aa60-137dbf98c813", "value": 147464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780713157, "uuid": "f49959fd-1590-4a38-91bd-81d019dc3061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713157, "uuid": "f703a6b4-ea83-4c5d-a666-4d5e0de5caa0", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10eaabce-617a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780731232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731232, "uuid": "8d6dea25-a5eb-4f25-b153-27617e086e00", "comment": "Malware payload", "value": "bcc49abe439c9e191deb578062dd79ef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731232, "uuid": "6b32ff25-3dfb-4e1b-9260-d1260192f989", "comment": "Malware payload", "value": "67395d0328d8ddc7c50b6b00ad179b57f1579925955dde596b90752f7a351cab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731232, "uuid": "1e3e1ec7-07ee-4eed-8115-c8db0fd49329", "comment": "Malware payload", "value": "2a878e081cb22f797dc697fb5f3ba63c277ab2a4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731232, "uuid": "a4ee9159-b741-4db9-9ae2-450e134fd9df", "comment": "Malware payload", "value": "30b243b305e883fe2a21f93c6f13a87ff75a447d0a99d12b6a0d0000e548bef8069f1e6669acdc610769158aa653c9e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731232, "uuid": "7b94dce6-7d70-4661-819b-ff9e89fb4bad", "value": "T173137D6566853C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731232, "uuid": "8d62fe41-fdd5-4b04-918a-92043b3c2912", "value": "768:LXRWNGxV19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:Flx4co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780731232, "uuid": "430af0db-b52b-49f8-8037-0ae15bc0b31f", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780731232, "uuid": "0c2b384d-42df-442e-b23c-e610aacfb9f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731232, "uuid": "6d43ea7b-d046-4eeb-abfd-b9af9249f00b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb012c2f-61de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774547, "uuid": "5e586431-fa1b-4370-82f9-126cad5fafa6", "comment": "Malware payload (Mirai)", "value": "8519b1374ea6e908230988e9f9714473", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774547, "uuid": "e4668c51-0866-42cb-bdf5-9f0a67d03e7f", "comment": "Malware payload (Mirai)", "value": "67e04af41ef1f65247e4ce913fcf72fd3b08965197c25d3eb553b08a02bab0d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774547, "uuid": "d77fb696-e836-48af-93f7-3cf82a7cb3c2", "comment": "Malware payload (Mirai)", "value": "ac9255cd9e869e25fdadc9b34e3e28cdff1b29ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774547, "uuid": "55c86d57-9bff-4c54-b441-9ccfcb984eee", "comment": "Malware payload (Mirai)", "value": "6c993a0232319a6114fdd3206d482ae31f40725581ee9ea63bbe3d18838971fc31e5d6d0817aec87ae4afda0e748eef2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774547, "uuid": "b2e1383d-d1bb-4dd8-8cb5-9b411be861b6", "value": "T193E32A81BC805E17C6D512BBFB9E42CD372A17A9D2EF72038D116F21379695B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774547, "uuid": "ce904c94-732f-4168-afdf-17f143f57731", "value": "1536:4EgfbqED28Ill32uAogxwrXEuSO9sEstOLJ0rdAy5dE2JS2d4VqgZ97cGw6OXlVs:4EgDjPY0ZA+dEw4UC9w6qKKzcbjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774547, "uuid": "6341c989-a505-4d15-908b-b65ffd522fdb", "value": 145772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774547, "uuid": "e8c8c5f7-cb72-4667-907f-4694e81952a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774547, "uuid": "c7f09e45-5b52-490c-91e6-12a1b53ddea1", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a33f176-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709424, "uuid": "7e32921d-c45a-413e-b80c-1cf9b1364f4e", "comment": "Malware payload (Mirai)", "value": "1553724687aa85fea0e471393bfe78ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709424, "uuid": "e4415f4e-6119-4159-9d00-1fec1cc0eda6", "comment": "Malware payload (Mirai)", "value": "685b6fdcd7840f602771f33cd1759020326dd2b85eb49aa95e33606eb53a4e0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709424, "uuid": "e739cf1e-1547-4dca-8be2-2197afa338dd", "comment": "Malware payload (Mirai)", "value": "97da63af9ac146e27d2bf2c4ff9aec8bbab4d7a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709424, "uuid": "055d1372-020c-4505-a837-537cb9419700", "comment": "Malware payload (Mirai)", "value": "d15f9f34c26bca778d6fd4797aba72c8cfe70b43eb61942ee30e256976cc54ddc20c8f0293f34d74dc0a7b4286a22388", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709424, "uuid": "f81ba36b-9710-4f9a-bce4-8d2478277b66", "value": "T1F623F2B3F751BAF6C133FE76B7669008F6566A0935078F2E0AC267F14D2124C8E61391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709424, "uuid": "ab541151-9536-47f1-837e-70f8df5490fd", "value": "768:MNQw7ToLEP51zmDHZMU6cg5911nkJNtKUwwgDc4hIkQhb8RaHBLD3WL/:MR7sYzmVrgvMNtKxwg44hIk4GWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709424, "uuid": "ca923d0e-7834-4138-b4fd-2ad907e5171b", "value": 48188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709424, "uuid": "fd7688a9-7e41-427e-8905-62c29803a84c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709424, "uuid": "e1f294c4-57d6-4410-b106-d8c44769de6b", "value": ".Sassy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a04134c-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777418, "uuid": "8d4bc564-3481-4906-9226-d8c4868698e3", "comment": "Malware payload (Mirai)", "value": "17b728de2db93cc6126a9739bae72603", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777418, "uuid": "01e3bafb-9149-4c05-aed9-ffcf838ec206", "comment": "Malware payload (Mirai)", "value": "687ee239a367abbfc5c79d4bbb298e2ec3fd29fd5e064386df5721f5c9d18010", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777418, "uuid": "92dace21-9383-473a-810c-6ae7a5302cfc", "comment": "Malware payload (Mirai)", "value": "16bbd6917391f47988f60708a027e6857f3a3e54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777418, "uuid": "bb87cc52-17c8-48cd-af13-033795aeb510", "comment": "Malware payload (Mirai)", "value": "228596f68876984c6f740e49d448c1d8831fb8161742d6e0c626599279ee029445eefbf58b08b4ba78fcd4a4cdcdef8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777418, "uuid": "de4d3484-8f59-4d2d-af60-f72b368e5333", "value": "T19F5301B907851AA1CD317633A07EC54243949F99E9E1FA7A3EDE85E49DC131132BC723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777418, "uuid": "eec967c5-951c-4cb3-8fe7-884742685e08", "value": "1536:8vRnZ1ufHaJf0ixEdh0gURrpT6CUVGxBrdu7:2nZ12oRtTjU2Brdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777418, "uuid": "004854e4-670e-44b8-b01b-6b0c22741de0", "value": 65628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777418, "uuid": "c5a156ed-b462-47fd-9c0d-680dd05b5fec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777418, "uuid": "9be13e86-fb01-46e9-a230-2c77f7284ffc", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b6e330-61a5-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780749730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780749730, "uuid": "f20e943a-5261-4b35-b0d9-53879d77404d", "comment": "Malware payload (SalatStealer)", "value": "2d2de4ede472ac8b162af015100468ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780749730, "uuid": "80cfb099-0ca5-4aa9-82ba-e669af702e7f", "comment": "Malware payload (SalatStealer)", "value": "68a513f77505f5c8b308552f29ca4f8f9ea5f982fe3ca00605d85dbc0e318132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780749730, "uuid": "eaff02a2-9ef2-4811-9080-c50cc9b159b0", "comment": "Malware payload (SalatStealer)", "value": "7ad948bc6a469abd2666f032969c225840f2519c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780749730, "uuid": "41f5c197-d04f-4b3e-92c2-9bb913123bc6", "comment": "Malware payload (SalatStealer)", "value": "79baf88c26b145b79552ae94ee962ec857d209f45b245ff56fd339f2e031591fe7f8cdc87882b29075202b398fefd605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780749730, "uuid": "3d4fb0ef-3525-4741-be78-7a2876a55363", "value": "T17437331897D010ECF073A6BB4E069B06D7727CDC0361C7AF13646A5B6F631699A3A336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780749730, "uuid": "fa5a61f8-9c5b-4e53-9810-c2e424eda874", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780749730, "uuid": "88582c1f-6b7b-408c-9807-17e11e04ad06", "value": "393216:J6c8vfH/ZsVJfZBjlPRLHjb2qIJJ0YJl7trRvjdf1ey3HXH4gP8FYGSTo:ZsfH/qrlPRLHjb2qIJJFJpjbeI3yFYGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780749730, "uuid": "85783ff0-a99a-48a7-b7da-09ac0c7a17bc", "value": 22464182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780749730, "uuid": "91d0042c-9659-42ba-ae4b-55a8f27d8bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780749730, "uuid": "77a71f3f-614c-4740-8020-930ef3ef6843", "value": "Roblox Fix 2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec4b145-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748381, "uuid": "74b5b215-61f6-4e12-8c23-abe247a08b3a", "comment": "Malware payload (Snojan)", "value": "2d29d77de568288c809dc62b62e93018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748381, "uuid": "5ac0933a-f5e1-4fc2-be82-268e764063dd", "comment": "Malware payload (Snojan)", "value": "68f0892b2536105db3be103d5961eb73908bad1ee6e66a72a76c8928296275f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748381, "uuid": "9d564335-4a2e-4986-98f2-3469ff8eedf0", "comment": "Malware payload (Snojan)", "value": "618b95f3809e8ba6f69f74a2fcfa6195bfbe5e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748381, "uuid": "54576021-967f-4bca-82a0-55bf5d6055f4", "comment": "Malware payload (Snojan)", "value": "bb1bf025ec2e796aa84975f83e8801182bc29d5cbb9c3af3411522e42bf0c8c461a7f16a58b23f8cce27e5085aa5094f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748381, "uuid": "0b4c768a-035f-4213-955b-ce3b12c05a89", "value": "T16E84F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748381, "uuid": "a1783fd9-65b0-4cdc-a1b9-3e0a535ca103", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748381, "uuid": "0d19aa50-b83c-4854-94c6-2a497b392e17", "value": "6144:NrFZaaZmEJuHDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+ujh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748381, "uuid": "68cdffa6-30e2-4371-92ca-54bde37ed482", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748381, "uuid": "480a0399-0588-4adb-9448-bc3d9b79686d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748381, "uuid": "212ea8f5-4a12-4e26-a001-56d1834ddb1f", "value": "o2NAvJePV69QpAl9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e638de5d-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777546, "uuid": "3d7f2383-8012-46b2-a9a2-c5f1566f78eb", "comment": "Malware payload (Mirai)", "value": "b7dc251f29a2189ac48e1159624465a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777546, "uuid": "72fe0d11-b98d-447c-b767-ddd2b024110f", "comment": "Malware payload (Mirai)", "value": "68fe09bef300e01ff5bc07f0e67b3ab0c7f77cf02578061928db55f2e292c8be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777546, "uuid": "7441c6bb-eee2-481e-90d2-8bd698e6ac39", "comment": "Malware payload (Mirai)", "value": "aa8556a31f2fe986db12ba33c1e2aa9323be502c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777546, "uuid": "968efdb0-e5d6-4201-9c3e-0d05f5c529e6", "comment": "Malware payload (Mirai)", "value": "dbda52e46b9312a2220240b8c45ff44e58a399a912d48906d856800569f6a5f14963ccf7a6899a715730525dae986d2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777546, "uuid": "1ff5babe-bb94-4e26-881a-87059dd0defb", "value": "T154F33AC7F800DEFDF41BE73A48630805B530B7A150925B376257BD6BEC3A1990967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777546, "uuid": "389894ac-0b8d-4fde-9cd0-eaa9e33bb9ed", "value": "3072:S6GO/GFBzJ0tm1U+mM02lkV8jbiuLiFOSEL1SYnP9rqvyQ4TV:YOqBd1U202l7LibgloyQKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777546, "uuid": "1665dafd-fd0a-4252-841b-09be4a2463c8", "value": 161676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777546, "uuid": "589bb5f1-effa-434e-aa40-199210efad24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777546, "uuid": "9c5f74a6-7260-4787-9e92-622de2a013d8", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcf7302-6149-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780710315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710315, "uuid": "619749f9-ddc3-4741-b4d0-86f9668736d9", "comment": "Malware payload (Mirai)", "value": "d3e81cb6c6dc58084ff69e55f4b0a840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710315, "uuid": "1c0814c4-c128-4381-ad34-70d67f479769", "comment": "Malware payload (Mirai)", "value": "69a046abcb8af17a471063439673389eaa34be1b3a90bda3e4a151d79fd513e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710315, "uuid": "7cf4148c-16ed-4211-b236-717ec17c269c", "comment": "Malware payload (Mirai)", "value": "12cccc7848b3ca8b199078d6fba944826c4b2850", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710315, "uuid": "374befec-3aa0-4a57-a013-a34e88ca94a9", "comment": "Malware payload (Mirai)", "value": "5765fc8ea817056536192f67ce9174f88935fbea1d554327b80f31e486bc3136ca8a4783991b512f539924900a8700bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780710315, "uuid": "03332482-6847-487b-999b-b22d71b13a40", "value": "T1BDB3FA427D419F13C5C322F6BBAE42993B126B7CD7EA3142ED247FA0278B4DA0E36551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780710315, "uuid": "2fe2ebda-8f38-4342-b23a-cfc15e201724", "value": "3072:6YgQ3s2NZNDKXjvoTNa0o9JP4dbpa8qnnjUq6:HZNDKXEha0sP4dbcpjUq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780710315, "uuid": "e6c96d53-d276-4d6a-9924-1b49561ffabc", "value": 114024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780710315, "uuid": "d99eb448-7c06-40a4-b765-27ddbdfbe0d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780710315, "uuid": "1060a4d4-2a95-4c5b-9db7-094a22315ee5", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48307ccc-617a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780731325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731325, "uuid": "1dcb4956-3dc1-458b-95c5-448dc7e9e3d1", "comment": "Malware payload", "value": "59f04eacd7f9d9fe24f8983a31c855be", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731325, "uuid": "a6e666b9-4aeb-4453-9360-08d77375457a", "comment": "Malware payload", "value": "6a0c482fe7c68ac5906e8fd46c1a24a372739ad9a8bf5c890d1ef9ffb5e774aa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731325, "uuid": "a46ac1b6-5018-42b1-82e9-40c91a52637b", "comment": "Malware payload", "value": "a7d12f09100cc00c74c1512ff49bd74dca6cf19d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731325, "uuid": "012f2377-cf1f-4afb-8038-905d9db3b52c", "comment": "Malware payload", "value": "76df7737c34b4aa0daa699203070019f4a2ffcdd987300c8f6b666e94de805bce591923086307fb8c2e282247b914edb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731325, "uuid": "56616435-0cf8-424b-b604-46c292fb5082", "value": "T1940148DEC101A76081CAE85E329751D07814C38B15864FB87FDC443DDBADA587029F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731325, "uuid": "7191bd01-58bb-4546-9552-29becc5ceff7", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka91IphbuFIaOGhTIbbiSIP+I3NauD:kXCKysE2hi0ziQvZoha91PFpj2xJe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780731325, "uuid": "7f755040-7ef6-466c-a893-f99e61a769ce", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780731325, "uuid": "7c2d41fa-8a4d-4640-801c-10425b718237", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731325, "uuid": "ec7fdd94-56ce-433b-89e8-473abd7a0188", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59238739-614c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780711596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711596, "uuid": "b58f97c6-ce6a-49d4-8e8d-4c6188c28349", "comment": "Malware payload (Mirai)", "value": "c84b91539cf9b43d56c2bd017d100a66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711596, "uuid": "77c1fe4e-b17c-40f6-ab49-caece934ae30", "comment": "Malware payload (Mirai)", "value": "6aeec024183eac8dc45b840528ade7b250da0e773106bfae869b4d6d20e8a283", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711596, "uuid": "85bd19c7-f429-4756-b14d-da947a85df2a", "comment": "Malware payload (Mirai)", "value": "9da243d14b8c8291a2872a20017b4f61890448ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711596, "uuid": "61d54a36-944c-4a4c-a18e-e95f28aecb61", "comment": "Malware payload (Mirai)", "value": "7eba137be1345f4d3eaf4feb2e7af7cf1672237fb2b565b5cd9d26c9788a5bac2b79cf89b83ff1bebb9d58d97ed47c3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711596, "uuid": "861a3d35-45a2-4cf9-8b01-61fc8f1c7bef", "value": "T11AE47D9DFE4E3D42E2C7E2789E4987E1721B71E4D32391A37982030CD5DADD9CBA1A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711596, "uuid": "3658214c-bd11-43b5-a9d1-2ab623ce8493", "value": "12288:dC22/IuTFvFNBMwO7GjTovVe+amsMYcEh0QWtQfWqQbaw5X4tCH:dn2/IgvFNO2oNe+amss5TXww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780711596, "uuid": "149382e1-ae84-48d0-881e-bcc93d032d90", "value": 697040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780711596, "uuid": "30b488e1-0f2c-4dde-bdd7-55d5d086938a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711596, "uuid": "4130163e-745d-4617-8fa1-47979bc12a7a", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986c1c70-61bc-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780759806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759806, "uuid": "a5eca3bc-11f9-4131-b6db-f8d8cb8b9e72", "comment": "Malware payload (NanoCore)", "value": "9f2ebc9b2bd9d49632f5b9bcdc40737f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759806, "uuid": "d5f20fd0-4de0-4a36-899d-113ed7167c78", "comment": "Malware payload (NanoCore)", "value": "6cdaf0cfee0bf72f00f05474e5c2f5e250271def85cfdb9645252634da62ea6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759806, "uuid": "c6255291-1146-45f0-a5aa-c106c5ff8aba", "comment": "Malware payload (NanoCore)", "value": "7a121dbe9b239b53aa01bffd474b26251aa132a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759806, "uuid": "58dcafa2-f3ad-4834-9cec-08d97c55153f", "comment": "Malware payload (NanoCore)", "value": "22372f9b351b44348f678fe84824b2f03a6bf6f10b528be896ed28edb447465a77aae3ca32d922b01ec9b82541e26604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759806, "uuid": "6b23e062-bacd-4bfb-b114-7a2492d3e21b", "value": "T15914CF163BA84A2FE2CE8679711251138379C2E3A8C3F3DE68D455B75F667E40A071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759806, "uuid": "899ebecf-bc25-4b26-81ed-ad0af932bf0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759806, "uuid": "ef0750a3-aaca-4d40-8d35-343aab826983", "value": "6144:ULV6Bta6dtJmakIM5FGWNFBbXKKT1p1Aw60X9:ULV6BtpmkAGwBWW1pW90N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759806, "uuid": "f3cf3d28-f4fc-4ea5-9bf3-475d91b09f90", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759806, "uuid": "b388d2d1-64f0-443d-b816-1b4acca163b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759806, "uuid": "49dffa36-c427-4e4c-9280-b132fca5f933", "value": "u88team3.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6b347b-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746688, "uuid": "e0d99b59-2905-474b-97a6-3d1d745ed186", "comment": "Malware payload (Snojan)", "value": "92d1538ede25b0e930e4b78894acaf31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746688, "uuid": "cfdc2a84-7c79-41de-a892-3086ea2e90d6", "comment": "Malware payload (Snojan)", "value": "6cdff8ec098ac337af89ff71e1de02e82e92133adfb628bea6bc5be1ecb66f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746688, "uuid": "63b2d074-d5b5-42d8-9a5c-52d965046d0e", "comment": "Malware payload (Snojan)", "value": "fde44230e0c58caae41aad24fddcb2542cfb902a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746688, "uuid": "1b897c51-cbaa-4a6b-aaf0-782265f9cc26", "comment": "Malware payload (Snojan)", "value": "ac4698cfd48324a4b8455cf078a2a0b60479951eb85660c1b985736c60696b5223cdf9b0b3945dc3a54b9018fe39b248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746688, "uuid": "d7219c25-99f7-49e2-8025-2b87173e0c2e", "value": "T188345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746688, "uuid": "e46284e6-bab2-4f9a-9a99-aa3cdcbdc483", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746688, "uuid": "4f9b39c6-1adc-415a-b9f0-cb3b684f20d8", "value": "3072:FJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/y/FnncroP9:PwDeM7iNEkgiOb31k1EC0J/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746688, "uuid": "0401e445-f5e3-4658-b256-e3ef474579ba", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746688, "uuid": "7ad9a0d4-253c-4825-89c6-1013e003a032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746688, "uuid": "d1bf56b4-ca33-45c5-b2cc-c1d54f467a94", "value": "1Tve2H16gMinCYPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d709dfb-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780748084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748084, "uuid": "3f39ebcc-7be1-471f-85e2-9064dcd2054f", "comment": "Malware payload (Mirai)", "value": "a8f5d7bbec09c99edbaea134dcbc2c3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748084, "uuid": "29fc974c-1852-49e1-8522-97cb38a39563", "comment": "Malware payload (Mirai)", "value": "6d8437efb223bb2de1150513677c16e5a773799edd049f848b95ea74b577cbc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748084, "uuid": "ce9ae2b6-4212-4219-97c2-ac87f871b6ed", "comment": "Malware payload (Mirai)", "value": "3c82c653c7a26c3cf15c4c4a215386ccbe55f155", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748084, "uuid": "519084aa-47a9-45c9-8076-a4bff9c9edb2", "comment": "Malware payload (Mirai)", "value": "3c4bd8e94e048eb0f985882ed8f898824e45deac69c3b3063b57364cbed4caf0e2d66fedab5180ac79026dabf0b8ce94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748084, "uuid": "8c2965a9-db30-43f5-8a30-d026c0b222a2", "value": "T142456D5AF2B370BCD067C030439BDB62A839F47511226E7B65C4DA352D62EB01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748084, "uuid": "4e5bd75f-6aa4-455a-8f2c-2f1e3731605b", "value": "24576:HOZWbCwyHW+BVzgCwlgFwqFPNi5pB+/Np:2cCwyHW+BVzRwlWwqFk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748084, "uuid": "08869788-a728-487f-9c7b-f4c28e7dcdec", "value": 1205768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748084, "uuid": "f03f4024-ca59-4429-bdae-63a54ec777f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748084, "uuid": "2ce4a870-2de5-4b6c-96b7-aff0c534fb8d", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632b9ace-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771313, "uuid": "c5c91299-3dbc-4300-8d0f-89396a718b1e", "comment": "Malware payload", "value": "18bd72d38377bbc8e119e16470abbdbf", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771313, "uuid": "58ceac63-2c3d-4204-a334-fa6ca4e769ee", "comment": "Malware payload", "value": "6d9f49f65be67fcceaf354adf06f3d2b5851e96bbac6f2f334aaeec6851e23a2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771313, "uuid": "5402f63a-f150-4f1e-847e-cf61813efec9", "comment": "Malware payload", "value": "ae89bdfa85d7934ae481f7434bb92661f8e7c718", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771313, "uuid": "2ebb2847-a196-4be5-b43b-5ef279d83451", "comment": "Malware payload", "value": "ac96798d207e463b3f31118b9c30b8828437742f915677a7bfc4163b0dd433705c37313dd844d748c49315cc8b9074eb", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771313, "uuid": "6d610e5a-ce3f-471d-abe2-881638827373", "value": "T17242BF6E2982CC014CA3ADF92D36EF03142E3631275C57F6489F81EA7D55B6F78C1A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771313, "uuid": "2cf66ab8-1a35-4e46-905d-7ecc8eec837c", "value": "192:iEedyRjiErb3AwHebyK3gxFbe0Ikz6wqrGsjp5pXOQyJqokrJ49PDhzWRrk46JIg:iE0yRjiErbwwot0Ikz6xysjsQzob9r0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771313, "uuid": "776ff907-df28-4ede-b534-10b577aa67ff", "value": 12109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771313, "uuid": "990a1d2f-2c8c-404b-9180-5ba956173316", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771313, "uuid": "60f3da49-8005-4a54-93dc-0310ebc52288", "value": "New_Contract_Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7ad98a-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765715, "uuid": "8c99e1f6-3164-411c-b6e4-73d898d7294d", "comment": "Malware payload (Mirai)", "value": "62f261f1dcf63ca4a98ef25f01de7fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765715, "uuid": "a8fc26eb-331f-4be5-9afc-7e018b17c141", "comment": "Malware payload (Mirai)", "value": "6e7bd8c8d18f8b22e8606be23e7f73f3fb53fdaf5294e20a79b5290c94294075", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765715, "uuid": "360a0c2b-1c74-4685-a8e9-04cfd200f8cd", "comment": "Malware payload (Mirai)", "value": "092f07da2d2ba2d01f9e12c8676905f537dd3470", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765715, "uuid": "354e6e64-4e0c-4948-acd5-17036d4e64fd", "comment": "Malware payload (Mirai)", "value": "bd89123b40cae23885294c107e14bc582921d25d0d037fe5d11e199a25e8cfe25882f43e97e7f956699f36ec146e7267", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765715, "uuid": "4aefcee6-9278-406d-ad94-0de6573be1aa", "value": "T1F21319DBB4099D7CF81FEB7E94124909B271774551830B3627BBFDA36C321A49D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765715, "uuid": "f91c67f0-cd79-404a-894c-041585ce0afa", "value": "768:fYemKcB66rTyEyZbIXTh/CTgCbcLfM2UkEB73V8ozAx8TTa:QaCbrTFXAUCbcTMQEB73OozI8TO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765715, "uuid": "afd03393-ebc7-483e-a908-9f018c6ea032", "value": 43540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765715, "uuid": "40c2f828-4f56-4701-ac08-83936d8af7ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765715, "uuid": "3cb0eb45-e440-480f-906e-83c06d7277c8", "value": "1fbb47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c972df-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746730, "uuid": "a3d525f5-8026-4ac9-965a-f60b60caf58d", "comment": "Malware payload (Snojan)", "value": "577d447064eb9a35be90c91d42b0d208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746730, "uuid": "9c3c10ed-9ade-429a-9822-7f80fa71872a", "comment": "Malware payload (Snojan)", "value": "6e8ce30382497d9aeae3d5f5f985745aae8d818451058cded532d8553cbeb800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746730, "uuid": "a2ee25d2-d571-4303-bf5e-1a899c2fcfe0", "comment": "Malware payload (Snojan)", "value": "85ccc12561db0610ad9b2ff13032b6d4c63fcaed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746730, "uuid": "ce375951-024c-478b-bbe7-46657dcbfcca", "comment": "Malware payload (Snojan)", "value": "498e6a6322d4aa09a85c7959d6d8fb1f9607231a014f520d1bd2545289ff1e767d38c7cb7c43f306e501722e1daf62ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746730, "uuid": "9fb0c38c-a3d2-4ef6-be27-d58c9f877d21", "value": "T17C345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746730, "uuid": "f84308f0-60fd-407f-8b15-529e6f14525b", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746730, "uuid": "d08013fe-61ce-41cb-84e9-0090b9ae9622", "value": "3072:FJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/x/FnncroP9:PwDeM7iNEkgiOb31k1ECdJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746730, "uuid": "782f2a73-77b7-469a-a105-fb2352729a85", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746730, "uuid": "f8ad4af8-17ce-4da3-8089-e4d132badd4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746730, "uuid": "cab24a1c-5939-4659-a01d-638250a60c74", "value": "JT0ulTLWMmbYp7xb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8692a9-613a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780704059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704059, "uuid": "37e622c4-f8a6-4e41-a3e1-ef9eb19c5819", "comment": "Malware payload (Vidar)", "value": "99fa9d65c82cf9781403de59182e7bff", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704059, "uuid": "ed2de58e-2d07-4c89-a37e-8611dc427b91", "comment": "Malware payload (Vidar)", "value": "6f3ce7b09df5bfd88bf99834acb96d8f55bcfd1626e4bed9134fb421d0e529ab", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704059, "uuid": "db9eb508-d52f-4052-a14e-af29e2b954bb", "comment": "Malware payload (Vidar)", "value": "4687a60ec32c8ae29979908db53436578544aa99", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704059, "uuid": "bae3a8a1-010d-49c7-a11b-b46683471ac1", "comment": "Malware payload (Vidar)", "value": "7af9a7738e918a9fb0a6e40904c597634317fe227b3312ac2fa459462cc62a090a7933ac7a1c94b5cfed4307abfd3480", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704059, "uuid": "3237cabd-5363-45cd-8b02-ab6743d5f9b6", "value": "T18FC5AD427C9051BAC1DEB17184B6A640B67078585F3427CB3F93B6B62E337E85D3A368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704059, "uuid": "cf46d134-76c7-4cd6-9fc4-e72d00deccfc", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704059, "uuid": "69cf2b32-0b7c-4cdf-afa7-ede2ee1d4b08", "value": "49152:GyO3krb/TPvO90dL3BmAFd4A64nsfJiCRAU2vbze6pA9OQCjfLJ4aUzSgLDaCBr5:u3aTi6pA91CjfLJOzBxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780704059, "uuid": "24fa2294-25b6-413e-bdc4-4998c0654f80", "value": 2732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780704059, "uuid": "4c72ec3c-0d39-42d9-ba8a-35048b2e3476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704059, "uuid": "772bafba-3017-45d4-91f9-7e5407edff45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e81417-61e8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780778616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778616, "uuid": "6decaded-7359-4b8e-9c0a-3696b51e8e9a", "comment": "Malware payload (Mirai)", "value": "de0fb6124abb9472d97e80b66ec9e4da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778616, "uuid": "1f78052d-2fdc-4dda-a0b3-2a4026efbd14", "comment": "Malware payload (Mirai)", "value": "6f75157c44636e6cfca97e84e9cb1d5853c8dfeacfe4b00392bd8dd488a63a29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778616, "uuid": "ee2947fd-4643-4f6b-9e32-e2177cc9951f", "comment": "Malware payload (Mirai)", "value": "21cfd80a2aebb5ac5e05e455c693da3edee56bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778616, "uuid": "04d831cb-a670-4fa5-a18c-cca4ee69166b", "comment": "Malware payload (Mirai)", "value": "a89b77d95d068f1dd5047fd081bc923aba0e7e4cb9f7400c176ecd1187d3af49ec5b1ff48c4963defb562e7a06d98b1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778616, "uuid": "d84d1ee7-1f58-488b-9b0f-5d48b082d78b", "value": "T1AEA30BD6BC818B11C5D166BAFE0E518D33134BB8E3FE72138E145B2E674A86B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778616, "uuid": "cb0bc42b-fe51-45a0-acd5-b51734e1fa53", "value": "3072:DRGRAdtrTe6JQGESIU8RB+rqfaXV7oF9MOv07j+X:BhQEgRBXiXVk9Mo0fK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780778616, "uuid": "9df0dbd7-c393-4ca5-bde1-eb47f9608f9e", "value": 99964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780778616, "uuid": "848cb51f-85bb-4cb1-b998-1c21463c1737", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778616, "uuid": "2f17ba39-bda8-44e7-8f3a-01c753582e6e", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46350a0b-6176-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729603, "uuid": "edad9d18-6766-4e40-8863-b208b323dc1e", "comment": "Malware payload (Mirai)", "value": "992b6480871882e85580cfc0f2d31faf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729603, "uuid": "3ee7c059-8ea5-4d85-a7c5-1222d380c7f3", "comment": "Malware payload (Mirai)", "value": "7033f525a928e74a2e4f56b6e4bd39ce2884660c2088b306a72462cafff81d7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729603, "uuid": "c8f79990-dbc1-4b91-8059-a3e018718d5c", "comment": "Malware payload (Mirai)", "value": "25cfadb4400cfcbed29e842f379d1620050f9344", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729603, "uuid": "673697e8-b0de-4da8-a116-1a3c7001a9e6", "comment": "Malware payload (Mirai)", "value": "42b7734bfb5811514700eba5977e8de3267ea12a0e921e906ee9f61b70f4b5dc56bd3071b8ae434fe4900227ea81bad9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729603, "uuid": "71a7628b-c266-4829-abe1-46db369009a7", "value": "T14F262847F89191E9C1AED1308666D293BA707C881B3023D36B51FBB92F36BD46E79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729603, "uuid": "124b6e3d-aff0-412a-a474-8fa2f6a538ff", "value": "49152:YxpwZmrb/TnvO90dL3BmAFd4A64nsfJafvAz2JIZrbwrT1KlHquLbLE9/55EruxR:i5nlV1sHfLYExZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729603, "uuid": "69ccb89a-c1f6-45b3-9971-117f9d65ca79", "value": 4653056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729603, "uuid": "b0a64335-514b-4ade-908e-8eec9b6b3d4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729603, "uuid": "7ae1f4d6-c33c-4b2c-9c6a-885499adaab6", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f81bdf-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771479, "uuid": "672e7221-c930-4e2d-a9b9-cb57bba96fcb", "comment": "Malware payload", "value": "6f34b95ae9edd8426e55701198735b29", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771479, "uuid": "f665013f-58ff-4b77-9a42-01552977538d", "comment": "Malware payload", "value": "70a4c279feff40e4f794af977d06fb66f2eb9a7feadc6912e5c3a6fcb1303dcc", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771479, "uuid": "2e4e52e0-bbad-4458-81ab-02b3b8760831", "comment": "Malware payload", "value": "a63a1d909863d3699b57677b16116ebcd5cf7e36", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771479, "uuid": "2f5c862b-fdf8-4b56-ba5f-99c42a98d366", "comment": "Malware payload", "value": "2e852a4dadfb6667e3e17e40c9d977ad9345b7c3ddecc9ed3024e10016b6a718c7b538e1bc6c0845ee090c002ea138b5", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771479, "uuid": "54a05079-caa2-46b5-a757-deb8859778d4", "value": "T178D41246F5C1F52BDDA18C7C9A4589D7BF257C436A80CF6BAB40330E2137278AC6B949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771479, "uuid": "e2f9d1f3-df3f-4d13-928d-6691834125eb", "value": "12288:MjHLLLLLLLLLLLLLLLLLLLLEi+a8ycnjSv8qZ0PZXDovUn369x01A2v4ODpaPxEI:mHLLLLLLLLLLLLLLLLLLLLyabcjSv8qV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771479, "uuid": "f5fde124-12e9-4031-b117-a0f3c45108d1", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771479, "uuid": "2fa55bcb-e888-4646-816a-3c41057b5f06", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771479, "uuid": "51aaccd6-3395-46d1-a4b6-b70ebfe3932f", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0d4026-61df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780775010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775010, "uuid": "6ad5b466-a46a-408b-ae79-372a73c9a567", "comment": "Malware payload (Mirai)", "value": "4dbb84fc90cfeff0d74a6ec192673f6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775010, "uuid": "788848c3-aad6-4a6c-afba-669114e47cce", "comment": "Malware payload (Mirai)", "value": "716da52c6272417f73b51c569011da071d0d34f42fe6c4c342af4357090fddb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775010, "uuid": "903ff84d-8e27-490e-8183-d0b26760bd09", "comment": "Malware payload (Mirai)", "value": "6aff73f62e95116788983df7f2fcd17eb0cd6d7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775010, "uuid": "68c9489d-f06c-493b-854d-4ccaf238c426", "comment": "Malware payload (Mirai)", "value": "f6f03b64fe10391cde3ce696e6ef2bb4b2db50885ae0f8ee8871900cbd617a014e54b2ec4f23bf1fcd50901a18c0a654", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775010, "uuid": "773939e6-32c8-4ac1-a3c9-505800629920", "value": "T1B1B3090ABF711EFBD8AFDD3305A94749289D660621A43B793674D81CF64B68F09E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775010, "uuid": "d535ee19-900f-4ffb-8317-2c478535ec0d", "value": "1536:8x4K8YIBpxA19709asd8VPB0xttQ+BoLcdPb8Tws5fMoO95aqyhAexq6dt36f//4:8iDdd8VPBQLKmf/AvRMU9aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780775010, "uuid": "163bef25-d0ee-489e-866f-65295e171e64", "value": 118152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780775010, "uuid": "187f5392-190e-4022-8427-3802611b2315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775010, "uuid": "4a798b50-e446-4e19-a85a-7905dc2aae20", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c41ea0-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780748173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748173, "uuid": "0723ef40-4332-4467-9b14-0e1d03f8dce9", "comment": "Malware payload", "value": "9ee812ee6dbed67527a1ccb19f357275", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748173, "uuid": "f94ed2ef-e01e-453d-8271-2f48519a0a66", "comment": "Malware payload", "value": "720a0fde5d39c9895ca0123fd8f60be516e96bd04cbd5e2376eaff1acbcc5a48", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748173, "uuid": "befb8672-97a5-48b3-8692-2e594290f886", "comment": "Malware payload", "value": "3799311fed06dc7bdaf33c21e1315561a9a1a627", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748173, "uuid": "8d3e5efc-6ae0-4b3c-9d61-079ea160bb3b", "comment": "Malware payload", "value": "20cf47990abcf14e5fb0e0eac481fe15ea274dbf87143f379ed176ac8fc938e616330c09d7525c4844e4cc95f614af7b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748173, "uuid": "0663bbb1-5fed-40fc-8243-40656295cfbe", "value": "T1F156123FB28B753EE06E5A367A76E210553B7661A8124C56DAE4C48CCF250B02D3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748173, "uuid": "01c61f5b-f401-47c7-836d-6d9b18cdb6da", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748173, "uuid": "35d66615-f4dd-46f6-b281-9ace34863348", "value": "98304:h5Oz2+5yzTq4AlaEZVvhQecC5dTNgG5mmhuCMW59KwxRa7Pr/TTg64opZSIyf9:bm2+yiRfBQe1AjmheW5xq7Heop49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748173, "uuid": "a904d677-c46a-4c79-86f1-b3eb60da3289", "value": 6470392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748173, "uuid": "b5b25aa0-685f-441b-a6b9-6715ba7f4d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748173, "uuid": "9e944393-5fa7-4836-92f9-2afdf462a676", "value": "RuDNS_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ee7ff9-61bf-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780761005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761005, "uuid": "f43c7670-c86c-47e9-a385-57f89bd0eada", "comment": "Malware payload (NanoCore)", "value": "efa893ad298966dfc2db7d26b20f99df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761005, "uuid": "59cd926d-a06d-4d6c-8992-7e0f4584c3b2", "comment": "Malware payload (NanoCore)", "value": "72aeeb237a3aeda60fb11d323f35e4fc3364681a2ddbcf707db18dc2226d79cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761005, "uuid": "c2b7d916-73c6-4eb3-a541-9ed49df1487f", "comment": "Malware payload (NanoCore)", "value": "f0502088765dd9d6350423b2b3808b3f98a6e7b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761005, "uuid": "811767e3-70c3-4016-976e-99ad2c2e3ce0", "comment": "Malware payload (NanoCore)", "value": "528ecc59d4a2aadc85d5876e4aa63b4f205e1eb92a1a0b28d2daf4f38ec9850341defda5feaf5872e736b4e4b7953d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761005, "uuid": "69482bd3-11b0-4eb8-a8c2-57247da3bb7a", "value": "T10814BF1A3BA94A2FE2CF8679612202538378C2E3A8D3F3DF68D455B75B167E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761005, "uuid": "f0a27bed-ce24-47e2-8dc6-304b46953fbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761005, "uuid": "a4624fb7-6c5b-4d98-abfc-39c2030daa9d", "value": "3072:UzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIgEYAY7lBjIay/cdbouE69CMWl:ULV6Bta6dtJmakIM5qYAkly0VPdEKQDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780761005, "uuid": "cb0955c3-d632-405d-b979-e0004347bc1a", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780761005, "uuid": "f9a5e93c-1183-47f9-8a11-aded0f938c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761005, "uuid": "d00d5a56-e6a7-4c92-9f88-a91de6050e72", "value": "xn--efax-3k9f8980a.jp.netxnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e49413-61e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780779099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780779099, "uuid": "b1732ee6-f70e-4e6e-8b92-0f97210bf0a7", "comment": "Malware payload (Mirai)", "value": "ad00f6c1d3bfdc518ac1faffcc3cad8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780779099, "uuid": "7cd46a3a-4db5-410a-95ed-16788085e59b", "comment": "Malware payload (Mirai)", "value": "72b3e7932f17b14728d199ee073b4ce04259fbc6ce085d7e61489da8c594f885", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780779099, "uuid": "f9818a4f-b373-4140-8811-2fad7e406db9", "comment": "Malware payload (Mirai)", "value": "297a79144e6c08a9446000a62bdd8f36dd57c737", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780779099, "uuid": "460d07fd-daf8-497f-9c3d-deb3276f5fd0", "comment": "Malware payload (Mirai)", "value": "bceb9ec17a1c7f05abe864d78acfdd160f85316e32c8bfaed3428a0c3a234346b403e753b274a525c762cad38f3c1c5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780779099, "uuid": "e47e3a55-91d5-4e9b-81a5-9a75201f3991", "value": "T159934A4173694407F3A70EB12C3F6BF1D3DFD5A521A0A185A94AAB4F8135E322586FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780779099, "uuid": "acc28708-f1ab-453f-9c48-e2ecfe3d4d39", "value": "1536:D0LTSR/BcxY4tkrLYIHiv2dFR/9iFQffTF24CV3qs3E9u9zxpF/hvqQ:wLO/qUFJs6I4AFE9Uj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780779099, "uuid": "8c3c36ca-e9d8-46b4-b4b4-4c718848a720", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780779099, "uuid": "f829d8d3-1ec5-4e72-aae7-dd640e52e745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780779099, "uuid": "67d9e85e-53ce-4c02-9279-62b26b49fbaa", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137cbff9-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746698, "uuid": "bde49e87-5027-4a71-a326-efa873b55722", "comment": "Malware payload (Snojan)", "value": "bf810c50a1418016a041fde6cd2a2fc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746698, "uuid": "0d4e5965-25b2-4152-ae11-862804842b26", "comment": "Malware payload (Snojan)", "value": "72cbd060adfa93f1c780144795bdcc40ea4c02cf4d9c59b2acd6ed6cdc015801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746698, "uuid": "548177dd-c047-4a17-b265-d9155caa2c4f", "comment": "Malware payload (Snojan)", "value": "e90fcb5c30ab06eaf459e66e8a734a1c9537481b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746698, "uuid": "dec29574-e6ca-452f-af8f-fd84dde54ae9", "comment": "Malware payload (Snojan)", "value": "3971067f136c9bdb8ebd70f21929b3288c750c68de7ae8c0b43609cee1781e554262dc8295de4832a400550d5f7c5b32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746698, "uuid": "c06f343f-9345-42f5-9404-f0cef4f790dc", "value": "T103345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746698, "uuid": "e34fdcfe-3c7d-4a3b-a922-a3381d5b5820", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746698, "uuid": "ad4a7c7e-bc71-4b07-ab34-3c0b92d915b7", "value": "3072:FJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/E/FnncroP9:PwDeM7iNEkgiOb31k1ECiJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746698, "uuid": "6b654673-ef00-46fa-b8d2-9bda6c530a18", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746698, "uuid": "6a7f5ed1-373e-4c95-8ee7-d23b75184302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746698, "uuid": "b1f7edb3-ceaa-4c60-b3c8-e8e911547554", "value": "2UR4VzquIpbhaAJb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0ba9fd-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746709, "uuid": "631a84b6-5172-40c3-9a0a-430c0bd0bfda", "comment": "Malware payload (Snojan)", "value": "d5351d1638716ac7c42147102f642d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746709, "uuid": "2e8e7468-2c38-4775-9038-60035abf0b28", "comment": "Malware payload (Snojan)", "value": "7341668593d6414f8bb0d02286bc1656e7862baaa3d64da4b691bdd1cfc4ecd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746709, "uuid": "1629035b-b2ae-4413-9ca7-ffc16176085a", "comment": "Malware payload (Snojan)", "value": "05e4f1086218e443f5235375f79e49152f933418", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746709, "uuid": "9b0cd1b5-a19c-4e72-8d04-f24d9ba5314e", "comment": "Malware payload (Snojan)", "value": "7c9d5aadf55f8475c82835e32bcb7ff6e0c363db1a46be6a47da9342dcdc1bee03bfd7d9b21ae4c851434e934da779ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746709, "uuid": "a8c03403-e826-4e42-b462-5ba32f827e54", "value": "T18EF3021646DB58F7E49B12BD469DD063B2FBA06F4BCE3EDBE1FC224DD6062B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746709, "uuid": "2673fc4e-1301-405e-b2a4-fd5c34478497", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746709, "uuid": "47a6d725-418c-4f76-9cec-b30b380768cf", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+FK:QJ0TAz6Mte4A+aaZx8EnCGVuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746709, "uuid": "fc1b4fc3-fdb8-4a98-bc5a-f3919c577ad8", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746709, "uuid": "980fdd7b-d28e-4f78-8f8f-9e57f4bc4333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746709, "uuid": "0798f581-5d4e-4574-a658-d83615ae4ff9", "value": "8ZZn8P2UPgZMVQUk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abbce94-61c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780763863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763863, "uuid": "69550730-26ef-4d65-9c50-a2fd88c54441", "comment": "Malware payload", "value": "3f97945c7b77695e7ff0a58287795522", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "Overlay", "colour": "#F9DA28", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763863, "uuid": "19e022c5-315f-4b58-a951-4f8e017d7855", "comment": "Malware payload", "value": "7365190230042fa2f8aba13d39cfecaa52b029750331760bcd114bafb01cb6db", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "Overlay", "colour": "#F9DA28", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763863, "uuid": "e87235ec-28cb-4feb-8142-277cfd459b63", "comment": "Malware payload", "value": "3f4576a5d604a5e13149a1ab513500a7c0cdca35", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "Overlay", "colour": "#F9DA28", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763863, "uuid": "3e6eeae0-b560-41e9-bb88-b458dd33979f", "comment": "Malware payload", "value": "ac3f1b1d6b39661defc4d9239b1c2b1489b9711dff97ea653168d162b26b2cdd084e209a0d2d801bcd6fbc2cf593c4e4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "Overlay", "colour": "#F9DA28", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763863, "uuid": "c008a6a6-b59e-485e-a58b-118617029ed9", "value": "T1F83701783390D407E77924B652A2ADD063456E18DF41D0AC3FABB8653DD3E3A73A08B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763863, "uuid": "92fc2751-fd64-43d9-8e9b-a18351ca6aa4", "value": "393216:1RumVOVGEAqTOkZXu9CX34RTD2r7tbDWE51IncBU18:n2V2nKbWDWZbagQcyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780763863, "uuid": "9e93d2ac-6f07-4d2d-8dee-aa85dac29237", "value": 22455996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780763863, "uuid": "4db14b16-df88-4a5b-872d-5e3091e1447d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763863, "uuid": "d2ccfc58-7233-4f32-b12f-07ea2cfe44fa", "value": "new_chrome_v1.73.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82572354-61e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780776949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776949, "uuid": "04512e03-77a6-40f8-8da5-1b6768cd4a2e", "comment": "Malware payload", "value": "52665222f0f18c44be1ceb381989a122", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776949, "uuid": "2d06f38d-037a-4be2-adf1-c63eff71e6e4", "comment": "Malware payload", "value": "75aecbc2beda558dc7c21c26fe1a5becd9a8e2a610197cb1a1b163e0ce24ad6b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776949, "uuid": "d61c99fb-20e5-4a44-b9f3-0c9b3374cf8d", "comment": "Malware payload", "value": "faeb9f794074ffcdb6a17dc376b4f026c5b44ceb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776949, "uuid": "14849bde-7d6d-4d3d-83c4-e768064160c1", "comment": "Malware payload", "value": "08019815f05fd4b04e5e1eabe37aceb11f65e1931ff36392f50a3002db97df6d2761e303c5cab8b77e899f242aaffb05", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776949, "uuid": "cac22c05-47f3-45d8-bb24-9e4ca4f0a87b", "value": "T1EC21C630B21DA663CBAD04F451EB04D47150CE3AF03C195D448C8BD16B9981EABFE92E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776949, "uuid": "3247cc11-afcc-46bf-a92e-ba53c814ab24", "value": "24:90+X4ShKbHqESG3U4EqGllJBH3hVzb5QFW0fEkYdt4RX4WTqWvp5S7n:9PsbHhb3RebJZ3hVpQRckit4RX4W7vW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780776949, "uuid": "9eb8b349-b1f6-48a9-81e4-d6bbb19d3ad6", "value": 1178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780776949, "uuid": "ed58f421-0f77-423b-87d9-e5e8085b7b03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776949, "uuid": "eaa4d8fb-d131-4ae6-a2fd-928ff449c166", "value": "SSA-Statement-225254.docx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3fd93c-61ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780753236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753236, "uuid": "b8331e28-1c53-428c-b07a-f6332c7ea9e3", "comment": "Malware payload (Mirai)", "value": "356ca4f34d6ed6155fd6eecdc6784432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753236, "uuid": "245771db-0d58-4699-88e7-3b79ae8c0326", "comment": "Malware payload (Mirai)", "value": "75b1972066cbfccc5f9c89a43eb0a80f99ecb063a5d816eadf70dc34ecf71f8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753236, "uuid": "fcb6f358-07f2-4604-b585-11147d8d4c26", "comment": "Malware payload (Mirai)", "value": "6b802f0c6f5dd73a3e8706964accfbbeee492056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753236, "uuid": "675c924e-830e-421c-9688-66043087d62d", "comment": "Malware payload (Mirai)", "value": "ca178805cdc78227f99281b36ba376b0c317ff7a1eb7e7bea68cd4cbeaba2d10c275a5898755fa90c6b25ba5046a6eec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753236, "uuid": "4a63283c-fc7e-43f5-993a-b5b79c290a2c", "value": "T120838D12CC645DA8F02A2E7420F58AFA4727A444991B6DF7394786724407ECCF5EBBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753236, "uuid": "66293e94-c447-4173-b5df-84b1299a66ef", "value": "1536:nMKpSmYiCaBzTBciRisfMKNAZYWlata+PvHE7EylCzJkwe:nMKpSmYiCa5+iRisJNROaxPcIylG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780753236, "uuid": "adf48df6-d6d8-4ce4-92fb-d8d8214611c0", "value": 87680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780753236, "uuid": "eb87b1d8-a9ab-46b8-ae78-82c127f8a474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753236, "uuid": "7476902d-9fb9-4161-8080-a4cacd3adbde", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a52e9b0-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747354, "uuid": "58483099-0e87-4add-8404-0e390307732f", "comment": "Malware payload (Snojan)", "value": "d12b8f7a3f5f30942d78029749b32954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747354, "uuid": "d04f0bf6-73b1-43a9-a89d-9cf0a882d5f7", "comment": "Malware payload (Snojan)", "value": "75b59697fe74b793ca1dc76eefc4f30016a1c08ad5282592ea2f70a46ca0e061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747354, "uuid": "1813f027-223a-4949-ba6f-f7158d8dc1f4", "comment": "Malware payload (Snojan)", "value": "e64d1adc62beea0373d737ef24fc8e377c929587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747354, "uuid": "1382533e-1a05-4f20-8c3e-fc48a17eabba", "comment": "Malware payload (Snojan)", "value": "3d3bd80c8d276ee036f6d2b9931cf255c1e9b14e25af76df9f88617441478d128c7a65dfafae570a3bf4084195cfd337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747354, "uuid": "a9ab2b50-e6e6-464e-884c-b73fc57817ac", "value": "T1F9F3021646DB58F7E49B127D469D9063B1FBA06F4BCE3EDBE1FC124DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747354, "uuid": "00905bb7-96e8-4992-b8d2-8116d44c7951", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747354, "uuid": "058e72ca-97be-44fc-9c00-21c83443ebd0", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+bK:QJ0TAz6Mte4A+aaZx8EnCGVub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747354, "uuid": "1dd7b923-6d2b-4986-ad86-88fb64390f43", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747354, "uuid": "45cd4e6b-2ddc-4b59-a898-8201f8e3adaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747354, "uuid": "e3ff053b-475d-4465-855e-d6a9c10e0ac5", "value": "prXfv3GiEXZTWw8n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091068ca-614e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780712321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712321, "uuid": "fad0995e-4507-4e67-93a8-8f40846adf5f", "comment": "Malware payload (Mirai)", "value": "5565cabb35ec2fa14835c603867bd6bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712321, "uuid": "198da0ed-85a4-4959-9196-b5442a78a710", "comment": "Malware payload (Mirai)", "value": "76c08f25f968f57c7d08d211a9559d84eb388636f08662295e95f156c899c8c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712321, "uuid": "189fdfec-f5fe-40db-a154-f69a42a39fa4", "comment": "Malware payload (Mirai)", "value": "be36e6b22e0e99500ac877f666e52bc4f59556c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712321, "uuid": "06395d4f-9787-44ab-b3fd-583db0ccc803", "comment": "Malware payload (Mirai)", "value": "54fedb80b821281db6fe0e5199856b956d4f062572ebff5a477b0a5cc20370c233b93af1e2e447e6367d2635d271bb2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712321, "uuid": "7a8d93ab-e0b7-4155-a80e-276ce56a5432", "value": "T121157D9EE786E0F1F52300F1025EDBF75934A1264013FAF6EF492662B472B616F1631A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712321, "uuid": "61285ede-50d0-4ef6-afeb-97efeeed75c3", "value": "24576:iEHPAGhonh9+4ygTBgi8AZ2t4yap3ZQ0:lhonh9+4Ngi17vO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712321, "uuid": "514cd1ab-09ca-42df-8c41-837914a048f1", "value": 927160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712321, "uuid": "1c753a92-973a-4aea-8547-73ab4a933642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712321, "uuid": "100316a5-a62f-4045-a34f-5a5c35a3f296", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ecc58e-6180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780734159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734159, "uuid": "1736d985-1961-43a6-bbdd-1bdd153c04bc", "comment": "Malware payload", "value": "7713658073600b931a0a14909829fe47", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734159, "uuid": "6f6876e4-c6cd-425d-bdc1-9fd63597c7d1", "comment": "Malware payload", "value": "76ce593dc5376ceeaf0d719f1c839570de00dfd7fd06f203b6062d9dc072ec4f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734159, "uuid": "961ff3b4-db6a-488c-b03e-95afc3d87adc", "comment": "Malware payload", "value": "f19964ef56770fed46c7e48e0c0d60253e676aaf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734159, "uuid": "aafe27f4-2b20-466c-b306-a4950837789a", "comment": "Malware payload", "value": "f77d258c3a933faada43ca272bf4935b8044695f0bec65bf5d602a111fe3d350811fe007aef066b3fe85651cfb030bf3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734159, "uuid": "0137b1c4-71a3-49e6-bbd3-644bb4ce197b", "value": "T1D9D2DF34C4C82FBDEEAA2A1D06FA6620D7D68B1E9498860737437D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734159, "uuid": "ef53636d-849f-4b4d-a194-10a7dc576eec", "value": "768:gumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:gu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780734159, "uuid": "e8f1d325-ee68-4e00-bfa1-34ae9b0a9db4", "value": 28653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780734159, "uuid": "fc9e7af1-f18f-49d8-a37b-c3bfa7f8abf6", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734159, "uuid": "afe651e5-7d32-497d-9599-d27da85fe3ad", "value": "23.94.110.24_1780734101732828_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef40cdc8-61e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780776272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776272, "uuid": "ee46fb90-5150-4781-bc53-35ebe52b6c97", "comment": "Malware payload (Mirai)", "value": "f7f26ae4163f19eef400d19ef66cddd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776272, "uuid": "60e3fdcc-65e3-4678-91aa-bd4a42969ef9", "comment": "Malware payload (Mirai)", "value": "78f9e5c10e8dc0e9c2490bb09dcee6e4b80e5c41cf3cca080e66648d628fc389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776272, "uuid": "d72464b0-8bfa-4268-b05c-7dcb388a1413", "comment": "Malware payload (Mirai)", "value": "36786cd35feb30db009a539678d9912794f4c958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776272, "uuid": "1c86ffec-7b20-49d6-aa1f-004162973313", "comment": "Malware payload (Mirai)", "value": "e724c8196be5b26bf1166a8a121565a11eb825d06e2b29bb381b7bac38b626bbea707d2c254666808c4f365fbe707e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776272, "uuid": "650c5624-833e-4d1b-8948-1efab02fd341", "value": "T186733AA3B400EF7AF40F937A44C34B29B271FA660A53162673177967AE762D43827F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776272, "uuid": "57c9ac7b-a319-4eff-a482-876846dfc981", "value": "1536:wcA1EL1ueyxGPXN80MdB2igl8orfKNSoU5QwagNgqF:xme1ZnPXpMuiqhuU0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780776272, "uuid": "5527cdbc-bd70-4cdf-a589-dc0c93211cbc", "value": 75038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780776272, "uuid": "802c7fe5-f2e6-4784-8326-2f7124a10908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776272, "uuid": "5168951b-2a24-4cfd-ab4b-2659194aef7b", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65012f14-61db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780773034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773034, "uuid": "96f97a28-0f3a-4994-ad88-fc536d8064ff", "comment": "Malware payload", "value": "e1e66d0c12628d3fc82f69ee710e9556", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773034, "uuid": "4a01d00c-797d-46d0-a705-88f4be14fc1a", "comment": "Malware payload", "value": "78fe4120c3c127d36eed177b899a9c4b557f24f723f8903cccd270892d41b48b", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773034, "uuid": "7e0b9e14-c630-457d-bf77-12469868c524", "comment": "Malware payload", "value": "424ce027cae0bd6ed17175276366d546a7cf6466", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780773034, "uuid": "e4e579a8-f3a2-47c5-b36b-42a4e996c31f", "comment": "Malware payload", "value": "aa6d4e08e06ee74f71c5482a85b5d0cd808626a59571f2bfb51a41486e45260dd10a804684d89a87e40c821ffbea6d0d", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773034, "uuid": "77a5dfcc-8d4e-42d2-80f8-a14d3de866ab", "value": "T1DF0833116A65D06BF37D5C7BA6E24E70A0D4928D2E7D78DB3B08D20CB1261C239AD737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773034, "uuid": "25c93552-29eb-46f2-af02-01a1c5c241ca", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773034, "uuid": "cb9b8f9d-b944-4cda-ae9f-7e5292bfdd2a", "value": "1572864:Gt9IKPlQAgRWYVwH0/Qo1r8tgmT0ZPrdE47KKajIqzAIj+TvHczkVMnZNWePSl7:GUKNIRW2bP1YtgmT0xrdE4RasqzAIj+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780773034, "uuid": "2042030d-ef80-402a-974b-57e4638850cd", "value": 78204765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780773034, "uuid": "cfcc4c11-5768-4dc7-9589-98e582386caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780773034, "uuid": "88dd12e5-eec8-4f27-ab5f-cafb0ca99715", "value": "Forza Horizon 6 Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ba6279-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747348, "uuid": "cdd181af-9cfb-4f13-ac27-927322428117", "comment": "Malware payload (Snojan)", "value": "64acef7eb47264b442ff1a1f4e2f5041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747348, "uuid": "d6b864a3-360e-4d88-beb8-f013eb6e109f", "comment": "Malware payload (Snojan)", "value": "799fd76e8cc0221e9fc21d1388c0ac848960f2cea8c61219c7efac34cfa05d0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747348, "uuid": "90cd2978-e983-4b8b-87f9-dea9b2a60a26", "comment": "Malware payload (Snojan)", "value": "c13a9ac93d0f03e85efcdbb43137f7eaa67c859f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747348, "uuid": "0315b7e2-4516-4394-9ddc-390079135ce4", "comment": "Malware payload (Snojan)", "value": "66956c33003e4b03fa8ac90614fb506d7b6eb31aa884f36bf0bd045e707024c01bc39c7a38bbb74b019643cdef03a7c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747348, "uuid": "70cd1346-4853-409a-91e2-5bc0086a5c98", "value": "T1E5F3021646DB58F7E49B127D469D9063B2FBA06F4BCE3EDBE1FC124DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747348, "uuid": "ffe96ebe-6c35-46d4-b9a0-26a9aaabba30", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747348, "uuid": "14351103-0384-41cb-9115-36d638bd5e60", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+nK:QJ0TAz6Mte4A+aaZx8EnCGVun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747348, "uuid": "32cc6399-d78f-42d0-8e7b-3eae82646a98", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747348, "uuid": "0b5cb248-b462-438a-a80f-d57257ba689f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747348, "uuid": "0925fca4-9b9b-4cc0-8fa1-057423be63ce", "value": "NU5hiBn9IlKVF9Lh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dccf51a-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747360, "uuid": "b84fdc4b-9367-401d-a5cd-5ab00084c2d7", "comment": "Malware payload (Snojan)", "value": "6c4acef4b90f1adebf61907a966ab3bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747360, "uuid": "30e1864f-ba26-4b4f-8512-9109663f4a58", "comment": "Malware payload (Snojan)", "value": "79ef269eddd3e99a7fc155fe0561227d3ce9861b34528334c9a0dd18d3377c79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747360, "uuid": "eb97fdee-6bfd-48a0-b20e-05ed9749e8ff", "comment": "Malware payload (Snojan)", "value": "c98c1f75c19882d069b89973fb3397f25d3322f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747360, "uuid": "ffff8a04-c5dc-4257-bb94-39f5e6ddf948", "comment": "Malware payload (Snojan)", "value": "ceefee33b4971136f8c3667955cb93d92a9a4212cd0e9f626f648f637cf9de4bb26e23af3fec7e07784761e81a56bb79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747360, "uuid": "5a22bddf-3149-4af7-8301-714ab508dd19", "value": "T197F3021646DB58F7E49B12BD469D9063B2FBE06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747360, "uuid": "3c14d97a-4979-45bf-8903-26f06b0d84dd", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747360, "uuid": "a89bc8e4-55e9-4e0b-beb3-cc78907d1181", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+fK:QJ0TAz6Mte4A+aaZx8EnCGVuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747360, "uuid": "77ce48cf-9c0c-4a2e-873e-3302bd76ae50", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747360, "uuid": "1e54b3d2-94de-4afb-8962-065794e4b747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747360, "uuid": "19487f9c-7384-4c16-b758-8e59e2b1e01d", "value": "qoOoivECBjBCyjUg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab6b1c7-61e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780778976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778976, "uuid": "c4e7debb-e950-4c30-af5a-f59ea2ab2afa", "comment": "Malware payload (Mirai)", "value": "09606d738d2b2a2d61e60f42428a886c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778976, "uuid": "327d674c-19ac-407c-a431-570dc70c81dd", "comment": "Malware payload (Mirai)", "value": "7a18661d41801b61720486a51409747c4bfc2e7b22d07c7037bf6fa1bebeae9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778976, "uuid": "68423a3d-61b5-4682-99f8-15180f459ec4", "comment": "Malware payload (Mirai)", "value": "5ad763202ca0a6ce77e8862868c71cc643d34f35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778976, "uuid": "c27628ae-6a5f-4c93-8082-5e77b081a0b5", "comment": "Malware payload (Mirai)", "value": "9e191f7894e281f8035ee3db007fe6c6d9a13f372287abaaa3ce3fcc281cf4368cdf59efc011cd687015c8ca40df5455", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778976, "uuid": "f0fee3df-f53c-4d2b-a917-0436636f6a92", "value": "T12D933BA6B800DC7EF417EBB7C0470A15B235A3B44F422B177627FC67DAB90641C66D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778976, "uuid": "1ece341e-a961-4e2f-9fff-e8a9d2e1ad7c", "value": "1536:ENOULBevul2ixUJ5xi67MM1m6dIqb8nOcJJz18nEc8rCEyeaZ:EcULBy82imJ9R15dn/cLz18nE1h6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780778976, "uuid": "15bb895a-c7a5-486b-94f6-4635ec50e791", "value": 93400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780778976, "uuid": "b992d112-c7cd-4646-922e-dd99f09d9384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778976, "uuid": "7a2d98c8-64fc-4e77-baf3-b0b830365a53", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc918d31-61d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771946, "uuid": "f9250679-fbf1-418a-9cc8-494f3e9e6487", "comment": "Malware payload", "value": "2bdab824638caeaa13821a2ffc9a724c", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771946, "uuid": "e3e8e376-ea10-4354-9695-601ef350edf1", "comment": "Malware payload", "value": "7ae9c755c34d1a3ca45f2e942d0d3371925d476dbdde550bf5d2476c187435cf", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771946, "uuid": "bf719d23-7430-421e-9f8d-98973e853217", "comment": "Malware payload", "value": "c600cf17b2ca2e82109663ecee70f87d73440485", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771946, "uuid": "3ef98a8c-094a-4cbf-9672-4ae222ad171f", "comment": "Malware payload", "value": "87243c0dacb8c387cd8781649bdd76f6e047774ed387ae618325e1cc4c914418fa3eccc4b8601a5008feefbec79fcf82", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771946, "uuid": "0855741d-b487-4da3-a097-0857852750e8", "value": "T19508335594FA0A01E5A7DCBE57102476A128E3F739B6E07B3B5812F0BEE110636DCB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771946, "uuid": "5c62955b-5b31-416c-bfba-5e296f46aa9f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771946, "uuid": "b962bb21-24e0-42ae-9804-469dd7b7aabb", "value": "1572864:vt9IKPFmi1B3PvsV4Yb+ndng7ZT/d+ChXTToo4Ah7:vUKdmi1B04Nlg7ZjRNoo4Ah7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771946, "uuid": "6902060f-1cae-4f6c-8379-a46232ecd138", "value": 77548543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771946, "uuid": "c4070be3-9fc6-4e62-b067-c1b73c7061af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771946, "uuid": "434b9930-6c0c-41af-8db9-c5f9a3090d9e", "value": "Forza Horizon 6 Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebe36bc-61bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780760863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760863, "uuid": "b7366446-be88-4bdc-bcc0-8b6cc86d59fe", "comment": "Malware payload (Mirai)", "value": "21846f393d51dbc36c9eafe1cba34346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760863, "uuid": "cb945bcc-6339-4935-adeb-57ae5af5a4d9", "comment": "Malware payload (Mirai)", "value": "7b15e02eb1012a75718bdbb7e4eb296337f7ddab152a72caf81f4440abf101b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760863, "uuid": "bf9f5ddd-ff95-4bfd-afe5-3ed7cb3d40c1", "comment": "Malware payload (Mirai)", "value": "02fff65881ef641b174a972bca5e1fe67eb345f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760863, "uuid": "25c3bd91-9a1c-41cb-b1eb-47cdd3c2e26e", "comment": "Malware payload (Mirai)", "value": "15effa2c7178e8a10927ca783dac3d0911640e95a5d781a9b4a36d224637d957364861e50fbe784037f3149eac87b38e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760863, "uuid": "16d17cf6-ac2e-4490-a391-7316298834f8", "value": "T173D33A82E683D1F1E91605702567E33B4632E5351037DB83EBB5DF36AC92A81D61B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760863, "uuid": "acec7123-2c22-4642-92e6-b96a34adc3f0", "value": "3072:81rPohrC/09o8FN5GCIOWgIk5QyAkdWy/h8k:81rghrD9oYNJIAXdDqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780760863, "uuid": "02e224e3-893b-44f3-9797-a1b11f8eb101", "value": 140596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780760863, "uuid": "5da65797-cb57-4c25-b622-d1364295ea36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760863, "uuid": "c4f97dd0-de23-4c81-98e7-093deaef6982", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3594693f-61e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780775102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775102, "uuid": "8a967173-da33-4a6f-96c0-0127e82f460b", "comment": "Malware payload", "value": "f0c348220c2aced0dbc2f589a6887b6d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775102, "uuid": "01d0e9d0-48a6-4809-a6ed-5cb2841c7bc8", "comment": "Malware payload", "value": "7b2654d7699a0575d8f7e9fe10c08418d0d205fcd28efef59f369a06448fd343", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775102, "uuid": "48dda439-3cf4-4d09-9c29-959714a1e433", "comment": "Malware payload", "value": "524b55270c4f0db430e9dd58e296e4d4ba19e683", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775102, "uuid": "e1056984-a4e3-40aa-896a-4ad2e84b5db8", "comment": "Malware payload", "value": "7ec8ca323246fb746575e7e3e16d5dc2418601a87a241ec96d39b980c05deff4e89d50aa4816b7bcd92a99163962bf16", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775102, "uuid": "f676aa7e-18af-4157-a666-7531153fbb63", "value": "T15E018EDEC001DB504186F86E229751D1B431C3CF26564FA87F9C443EDBBA7587029F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775102, "uuid": "5988823c-652f-469e-8ece-bbd66b8c4096", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaLIJIDsn8IYtFDyIrsxK8IO3BuuIGsNL37:kXCKysE2hi0ziQvZohaL5nN7yC8TGNr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780775102, "uuid": "6ef57e95-e578-45e7-b44f-0a22d9e5614e", "value": 822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780775102, "uuid": "2bde3e00-c5c4-43e4-a838-d8a3ab6f2583", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775102, "uuid": "1376114b-9a0b-426f-9f72-babf802105c8", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4df86cd-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747371, "uuid": "6a0dd768-bae1-4df5-a3ce-5c4e5708fd0e", "comment": "Malware payload (Snojan)", "value": "6da3af8209cf10bebad04e58a82948d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747371, "uuid": "770230ca-01f7-41d6-8603-ef6ce85f02b4", "comment": "Malware payload (Snojan)", "value": "7c4d4a7166c6a9be44a50efe7832a9d5b911ed3f9e874a651352d13d360e7775", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747371, "uuid": "8c42919a-e682-4e53-8672-098258e1d4e3", "comment": "Malware payload (Snojan)", "value": "6d0510961dd3a43df5bd31a7284bb1b93dbe381d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747371, "uuid": "cd0e9680-0e92-41cf-a3a2-9af52703b1b1", "comment": "Malware payload (Snojan)", "value": "fa80decdd2ccb4264bd8da1732ec4a98a090e31c08190fdcd43097f779329218ef578db9894d3c0456fae8cd73a33eb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747371, "uuid": "9685f999-baf6-42d7-bf96-2fdcf0dc7e83", "value": "T15EF3021646DB58F7E49B12BD469D9063B2FBA06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747371, "uuid": "6cf2300f-2927-4807-baaa-83fff13b8ec3", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747371, "uuid": "d6492d3a-6893-4494-b66b-f9c9de9ab5e5", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+yK:QJ0TAz6Mte4A+aaZx8EnCGVuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747371, "uuid": "0503a414-c4e1-4403-964f-4e1696a493da", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747371, "uuid": "3e952021-9231-4af5-a82d-4ffff2e06207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747371, "uuid": "493edeef-ee61-440e-88bd-7cd7ce6abc3a", "value": "vWvLkM4v6wXT19ml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb47d79-61da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780772725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772725, "uuid": "a0b5086d-6d38-47ec-82b4-00a12c59b1c2", "comment": "Malware payload", "value": "5548455747e02a09965f9b224463f5c2", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772725, "uuid": "1e5dd264-fb24-4560-a62f-8b3ad2cf9dc6", "comment": "Malware payload", "value": "7d0e6cd597d538a28d67731fa9244d436a62c7c524b9d288188e3e94d51b2fd2", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772725, "uuid": "0bf474fd-faee-4ff2-b2e2-b7259b827acb", "comment": "Malware payload", "value": "2d759296eea10b17501329e311f1653eb0178ce5", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780772725, "uuid": "0c686e03-0bd4-4e42-9a02-96f35b0e1a07", "comment": "Malware payload", "value": "bbb7c6652a17ae602a02c9d74f9859977c40e58ba0c1515c71dc50099b7c9147b254f34bc7f3ae4f1521a266ad7977c0", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772725, "uuid": "d37bbbf1-5d4c-4416-acdc-8babfc617c0a", "value": "T17808334560BAE176C1B8A5F2B223543A82C97A133D3478DE978E37507DE21CE0CA576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772725, "uuid": "466cb5ad-ae97-4597-84b9-5531b57d3ed1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772725, "uuid": "c1180460-4e29-48d5-a6e3-cf8a18843bb4", "value": "1572864:et9IKP8th/poRWYoRfi0gOg1PrjzahEMeOb7gKSLIjHRS7:eUKUDpoRWjRfGnq9eOvgzLIjHRS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780772725, "uuid": "40460c72-bff9-4d4c-a4ec-ee5869ab1718", "value": 78013566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780772725, "uuid": "b8e7f733-cd13-4371-961c-a2748dade166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780772725, "uuid": "3103f671-30ac-43c3-9862-fe850662fed1", "value": "Setup-er.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647e2e08-619a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780745116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745116, "uuid": "37601bae-eb13-4ad0-a592-fc3ff0ea5905", "comment": "Malware payload", "value": "999f77604af284b9b9f48bafc594d242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745116, "uuid": "8e152707-8007-4d90-aa2e-238ed7b31eee", "comment": "Malware payload", "value": "7d9eecfd59ed832823168e26b60dab4c96974afb57711b4762ddf662454ed963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745116, "uuid": "3d1efb69-ef19-4fdf-b425-55c237d1b67a", "comment": "Malware payload", "value": "51d46c6187623fc4bb3c8e5eb0922c50a932a6b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745116, "uuid": "525725cb-b402-4944-b614-efbdca2967e1", "comment": "Malware payload", "value": "ffcf075d0605fa3e5d2ef6977a0fd3f4dead0ac7e359e173cea073261ad39c5e470c7622c6c55525f8e3033ef42bdf86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745116, "uuid": "a97539e2-0654-43d2-8f49-58befb01a2b7", "value": "T13516D0BB7298D12BE21DC23AC5A2AF94A43BB0750733C5EBD9D412699A075C09F7F350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745116, "uuid": "b692a62c-bbac-4011-a454-4cfb0284a8f8", "value": "1c8abb0d55065ed8370628959ce78804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745116, "uuid": "f610ebe4-dc24-4401-8900-98697135ea52", "value": "49152:SvtyeIW1Nq9Y26UQdd3pMMTN8FkCw2OR9rAjz0nJz+1zzMb2yUFkvJEQxe0pF/R:Slr12m66N8FjjzaJEMDvuSe0/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780745116, "uuid": "605daf29-7172-4de5-ab64-c6e87373927a", "value": 4134294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780745116, "uuid": "4208fec3-80c0-4a57-8c39-e3dde00e2d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745116, "uuid": "7fd0039b-3be5-4a31-a078-960af7e7aade", "value": "DeepLSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4297a82-61ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780753061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753061, "uuid": "80b749c3-1ef2-4c08-8412-82dfbf7af591", "comment": "Malware payload (Mirai)", "value": "53d73a8747b46b36a935ae0e701359a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753061, "uuid": "276b1956-9ae8-426c-9aad-af7a260ecde8", "comment": "Malware payload (Mirai)", "value": "7de89f08dec0e5acf632b279a045b7b24a0d114890ced25c4bcf9104925e0837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753061, "uuid": "03e1749f-1400-4f59-a726-e25e26872292", "comment": "Malware payload (Mirai)", "value": "ce5e7e8f826efa4e6e350f58e935bc5d98ae72dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753061, "uuid": "7bd7b08b-0538-4e46-bf7b-1b25bda9f664", "comment": "Malware payload (Mirai)", "value": "bb23b44472cdd9765fab6be2d3da85446ca7dcbfa5f7f67e498c25c4301df4f1f0bc4cae00c054778731eed9f3932a18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753061, "uuid": "90c664c5-1a9c-41ec-bef5-5982aa3649c2", "value": "T1E7B31B8ABC818B10D5D625BAFE0E518D33134BB8E3FA7113CE145B2A678AC6B0F77515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753061, "uuid": "f819caf5-96c8-4d3b-881b-4ddcb5d03b5b", "value": "3072:PpYRA6L8Hp/HvbEPHxprg3eX+LEshfIoJPfvHqQUzVl+DS1bpw:FRvSRprgsmEshfHfvHqQUhl+DIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780753061, "uuid": "74312c4e-f5d7-4345-a011-772c7abd78d9", "value": 112448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780753061, "uuid": "6e0f0582-a597-4b5d-a913-48a8e787aba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753061, "uuid": "012e8ee9-1b72-41d8-af39-a6e16545a66a", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec913ed-61df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774768, "uuid": "afb58ff3-662d-4204-95e7-4707dfc19c2a", "comment": "Malware payload (Mirai)", "value": "531f30b02dd7089707d4f1646b44391b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774768, "uuid": "7ca2214a-f863-418c-a7e9-9ab9d37ad164", "comment": "Malware payload (Mirai)", "value": "7e082e5b74d70e8235d0e5778c75b65bb06bfc77de3ebcec3dba9eb7e0ac89b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774768, "uuid": "981c3df4-5f86-49bd-95bb-cec28f3c3830", "comment": "Malware payload (Mirai)", "value": "001c67800931f66c2ce8373cfea5781a13950f1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774768, "uuid": "2998859d-b7b8-46c2-aff2-524b980063d8", "comment": "Malware payload (Mirai)", "value": "05be2b22652f621b9bff31d125fe3162f36869a9bfd8300367d1b2353bb72ea64beda48e95bad3f60e7236a6c0a61494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774768, "uuid": "7d18ac4c-dfb2-4410-bd1c-17bfd80d30a5", "value": "T1BBE32941BC805E13CAD512BBFB9E42CD372917A9E2EF72039C116F25379695B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774768, "uuid": "f007fd9b-3b09-49be-a7e1-f17339e025f6", "value": "3072:AEL30CT0yguhhQ4/e+atqShnkGVhb8uW:AEL3p0DuzQ4/xaQShkirW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774768, "uuid": "a7f20b91-a697-45ca-8cff-8325dd935a35", "value": 145772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774768, "uuid": "c6ffc126-3364-44b3-866b-2180577ee369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774768, "uuid": "eb2fdccb-b40d-4647-bd91-62b7e8a0abd7", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339943eb-616a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780724418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724418, "uuid": "71952c64-41ff-45ba-be1b-912d9123a7e8", "comment": "Malware payload", "value": "f4790057f5bd7410900f0b5897a180bb", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724418, "uuid": "ca711da2-d2f5-43bb-834e-5d0fa962226b", "comment": "Malware payload", "value": "7eb2ece5354e50ebcd954ff6a76dd74504bea6769ed6e0ecd9deb53f46211cfa", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724418, "uuid": "27eff736-46cd-434b-a4dc-2a197c72cc02", "comment": "Malware payload", "value": "f3c456da49c9fcecd6aef2f6d2af4ff0d50a5d82", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724418, "uuid": "40ddd69a-a358-4990-a5cc-5947b9001ed3", "comment": "Malware payload", "value": "a3f93bcc5a9ad1f5108b011624e075e64a2d03d44bb5b521698ed5f5592047cd4d57462c2a9839ada40a534c4b6d0b52", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724418, "uuid": "906f3ebf-243f-4086-a5ef-76d7bf676d13", "value": "T183E66A22A18691E9E2F5F1B68EA7B723F171FD550331B0D702D0B9890F772A1867B721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724418, "uuid": "010d9415-1c9a-4ba0-ada9-2b4f538c2f6c", "value": "bd57794921b5cb2b15a5876f9255e918", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724418, "uuid": "c0def045-bd1c-495e-9922-290bc7330eaa", "value": "196608:8XZB32WLOk4eyDDH0lg+04367Td4JYO0zc/x7:8H32hDUlcTd4JY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780724418, "uuid": "34004c9b-9f9d-4915-8399-d3bc8a8e93a5", "value": 14730240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780724418, "uuid": "b6c7ac84-4b92-4be8-a454-9e4eb4047271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724418, "uuid": "db03d9b2-f2a3-4d72-b979-b07d986fd114", "value": "python37.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3464f9c6-61af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780754055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754055, "uuid": "d86a4eb6-6b3d-443f-af24-dcd9b714ef3c", "comment": "Malware payload (Mirai)", "value": "7dd74ac91d8f6d516d0da49b51785a5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754055, "uuid": "82ca9a0b-30c6-4f78-a65a-98cf902f2ea3", "comment": "Malware payload (Mirai)", "value": "80bbf7b98473ffa46c7727856daf21f2179444734a840b2e160600bdf2394a74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754055, "uuid": "46d33f21-5c43-4bd9-bd0f-781ea7879a46", "comment": "Malware payload (Mirai)", "value": "f13e87cb983d67e5229f53a3a152b7f155709419", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754055, "uuid": "4e144802-fe27-4faf-b561-e2362b9dc132", "comment": "Malware payload (Mirai)", "value": "889f63c17cb9fc18f371ada127559b567c42f2b22664386869bcaeb067f2f2c6605a3586941dbfb8e4fa11a307a7467a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754055, "uuid": "786163b0-90fc-4a42-a1d4-4debd2bf688f", "value": "T1A6A33A15ED79183BC5C0713B51E34631F5B603A919BC8A1E7EA31D5CEF18660323FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754055, "uuid": "16bec83c-5a45-466c-9a61-5c4866b4ced7", "value": "1536:vbRstJvrdM64xaRhrh5Jhykd3qdN7KzIdoMN79gNWZITCom0s09:jREO6y8JhianNW9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780754055, "uuid": "4c96b1e5-24fe-4b9b-aa73-bcbb7f601bcf", "value": 99988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780754055, "uuid": "fa6c5313-2056-4bf1-9a94-96aa687f355b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754055, "uuid": "a52e6c52-b0e4-41ab-b9b4-18f6da2a2320", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d60ebe-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709421, "uuid": "8a0a9739-600c-4b64-af08-219ca525f7d3", "comment": "Malware payload (Mirai)", "value": "f43a313e571127f0cee1aee29e0fa2fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709421, "uuid": "1ed34674-102b-4515-ab2a-99522a774854", "comment": "Malware payload (Mirai)", "value": "82432135ff2a8bf71a62a8d60b79f67ca40f65574afc005982a22ca9e1d6dbc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709421, "uuid": "fda91d61-22ce-4d47-90c4-3af122a3c686", "comment": "Malware payload (Mirai)", "value": "233b9b296669a1620dcae6057a30234ec3dce3eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709421, "uuid": "7a1c1e8d-e437-45b5-a79a-4565705e32dd", "comment": "Malware payload (Mirai)", "value": "354b9dca420b996dfcb2376091496a14a59c137b6f82fcb593ca5177900ec4a9c7658f4362bde13ab47fda2a5bc5ad1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709421, "uuid": "d33b5799-d30d-4774-8a07-0ad70b1b414b", "value": "T1DEC39DA7B24F1451C82607F41BCB5B9D2A3325019E2B8AE77C6E373E1A365DE5C063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709421, "uuid": "2cd1621b-d4bf-43df-b285-680c84f976cc", "value": "3072:/i7d5eRNU1NTeQ3iD1Knz+qygmbg+CelYeJWAlqc:/ip11NTv34MVy/LCeKe/qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709421, "uuid": "8b5c0fa4-62da-4271-9548-3958f138e7da", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709421, "uuid": "cdca47f9-22b6-45fd-9ea0-0f9e365e5541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709421, "uuid": "04831981-3a41-45d4-9e92-42c5dce00e4c", "value": ".Sassy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772e5706-61c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780764475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764475, "uuid": "6bc99df2-d06e-4ecf-9cd5-b67d175ce486", "comment": "Malware payload", "value": "e83eaabdc927eeafab0e7637e8a256b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764475, "uuid": "0699e1cf-66a0-42bb-98f6-976ef2578553", "comment": "Malware payload", "value": "833e0e1e5d19915ef2f26a51fe20ae300e782911d6b374a0a295b0bf483ed718", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764475, "uuid": "8573323e-4fdd-496c-90f0-5fb50d13e68a", "comment": "Malware payload", "value": "ae35d55a2888b1d186e6457bbc17d073e276f17e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780764475, "uuid": "d90a53f6-3679-4ad8-b25a-e48d8c026e0f", "comment": "Malware payload", "value": "230d731735fda8fbfb8ce90f504e8145f50cb40048d73b365098d7fa65262f0cc1b2870be015572071bfb855f2fd3bbc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764475, "uuid": "7dd79d91-0d68-42d9-86d8-72c777f45b56", "value": "T1D7843910A6C18BE1C456F6B84EE4D630C7296CC81BA096FE9E7CFF558630DA1DE3059E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764475, "uuid": "de1cbb5f-515f-4046-9c19-d6d3790eebee", "value": "59f37c13d2cae7cc547b602d07aa7033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764475, "uuid": "4c051c9a-a075-4e98-8297-a819612f8b0e", "value": "3072:zXiZYkCItXCGpSFRSJyE18jSaCTBIJCfCr8OIRachyk2Wh/RgaaOnUxtVmj3qh8l:zHkCItizSJJwYmUU3yacEk7nUD0Fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780764475, "uuid": "8f74922d-bd2e-4ea4-ac63-77a0fe84d193", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780764475, "uuid": "b275aed5-ed88-4d25-bb95-e124c0ba3b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780764475, "uuid": "97a54c83-5782-4075-b5f7-3cf5c3de8da8", "value": "Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e92a8c8-614f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780712974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712974, "uuid": "e95b8f1c-81ef-45a9-b590-b8250efdb2ca", "comment": "Malware payload (Mirai)", "value": "af7b7d82a5209774227b25332f607ef4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712974, "uuid": "e09dbd50-0dfd-4a2d-9008-b6b80a897973", "comment": "Malware payload (Mirai)", "value": "83fa5d0cdb81da30f2e81b06e0900fce8f8f2a6ccb6811a46f381c93c923767b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712974, "uuid": "8be8095d-34b4-42a1-8687-76c06c55dc0c", "comment": "Malware payload (Mirai)", "value": "ecf206a36de13b9cc5c272c26a46aaff6d53a8bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712974, "uuid": "0c1dc52c-52ef-4ac6-9f63-ce348be8d02f", "comment": "Malware payload (Mirai)", "value": "2a5ce9c2071f740e4c034a5c88a0975c0d9621c61fe746487c95de1c3bcbf5c01e454ee3e73ec36b75cca4e79d5829c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712974, "uuid": "582edff7-96bf-4a89-a28b-b60965b2adc5", "value": "T112D31945F8414B27C6D112BBFB5E428D3B2A27E8D2DE72079D255F20378B96B0D3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712974, "uuid": "462d6cba-56c3-48c9-b6a1-0580c296212e", "value": "1536:NIHl3V37DbZueM2hirxXqJZtdcCM2V1c4VOW86TPccbO6aSySl10wlBfwywMuVBx:4l3VyqVOCMh4F5jcRSyaJXrkIU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712974, "uuid": "f59bb105-4dc9-4fe4-b394-e12be5159200", "value": 141952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712974, "uuid": "4412c8d7-bf42-4c6c-890c-b20514eff427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712974, "uuid": "58abead2-a634-45c8-823e-bdbd832e4084", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e42f500-6140-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780706504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780706504, "uuid": "1473c82d-f164-42e1-bd34-91cefa5a4e0a", "comment": "Malware payload", "value": "0470682cb6d2e673e702aad4ad4a925e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780706504, "uuid": "02c12175-b764-4cc9-801e-4a4c2abc332b", "comment": "Malware payload", "value": "849f9fd8c346457646af8b561a4eabbbcc656bfc11d3f3eaf86a281d9b21f1b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780706504, "uuid": "689459b8-331c-474e-800a-ed270798df77", "comment": "Malware payload", "value": "c1ffa39c4189a240a67efd7d0d2c5cd5e55b306f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780706504, "uuid": "1edaae62-c868-4321-97b4-50e8751469b7", "comment": "Malware payload", "value": "81bab1af5d1fae0bcdd5b5c180b8abf06c5aefa0b34683d1a5ad960f0a8a2c31d127b70c0995246bea67c50ea1a24294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780706504, "uuid": "0ea75d08-b190-4f75-8bdf-ace788320660", "value": "T120F7332C8AF5A1AFDF2E5CF811B0DF72EA5924156E2C789A9FEC34517133409013EAD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780706504, "uuid": "acfbf92b-5ec2-45e9-b644-23bd16349229", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780706504, "uuid": "47bb174d-b4ce-4d4d-a06d-8571687f2f6a", "value": "1572864:7t9IKPD1qIYLeTqowzKYypCPRfYLgRLlPBnU6InslAtBFAe7:7UK71qIYpoyKYyuB/5PU6Ins6FAe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780706504, "uuid": "0655439b-b7fd-4d5f-adf4-ab99d03e0f6f", "value": 77070342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780706504, "uuid": "ac02daf9-9b93-4197-b34a-66fc67b0ff9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780706504, "uuid": "768d05fa-e87f-44ab-9766-70e98f74c826", "value": "Setup_3_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87ac1c3-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729392, "uuid": "df7b49bb-84f0-4bf8-8c42-352184c770d8", "comment": "Malware payload (Mirai)", "value": "f14f2b278accc61a1d8d37eb7cd2602b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729392, "uuid": "155edb7b-1b1b-43b5-a981-15eea63ba6fc", "comment": "Malware payload (Mirai)", "value": "8633cbd75328a0c325c9982b59ec33dc460986b5ba6549696963faeb5ad799c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729392, "uuid": "07353264-c460-4f1d-865b-6ee4349b2d26", "comment": "Malware payload (Mirai)", "value": "3f8ce11c1f5dec8f349a24caf8a1e9fdf5d6c874", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729392, "uuid": "3b7ad1f3-985f-458a-83f9-c6a1108db149", "comment": "Malware payload (Mirai)", "value": "4c35ba2795e8fc8067f93010666b0c05444fdaef2f8f92296012ff5b66af74296e917b7044859bc103bd28c89b318eb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729392, "uuid": "ebe1e35e-4302-4117-84a6-04442309cd84", "value": "T1E1F46B42FF1C4962C9431DF0193E43E9F3217A5241F9C229371E9B572632E76AAC778A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729392, "uuid": "994622a4-9ffd-4ba6-bf4c-d2e15a84ce83", "value": "12288:VyeJbUMDDP6IrcL14Ml4iJh2N6HsJa4T2oiYl+LPhsnepkeRBjfy:V9DDP6IrcJH2uMd2D3LPxb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729392, "uuid": "7a5c605a-6119-4beb-b28e-51ffd3936503", "value": 726708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729392, "uuid": "a94807cc-aca3-4c78-b54c-ca774e271d61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729392, "uuid": "2ff9655b-b25b-45a1-99f7-bae69955e354", "value": "kaizen.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdb7349-614e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780712708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712708, "uuid": "10b6bda6-662d-4d3b-813d-e15c6e4988c9", "comment": "Malware payload", "value": "a13fc8b07113d21f09ffbd5f8bf8748e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712708, "uuid": "c747fa4e-8318-4c40-9110-de804953f098", "comment": "Malware payload", "value": "87e24149ee46d625025237edd7cc734adfe243425301d80beba0f3094429336f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712708, "uuid": "afe35b53-8eab-49f0-bc4b-1e7658923bfa", "comment": "Malware payload", "value": "fa7a699d31d49f48b92a3127f4b9ebc40a306de2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712708, "uuid": "b75f4a6c-4d9e-40bc-ada1-037d09d2f6fc", "comment": "Malware payload", "value": "e937923e87bcc7f90b2032561e654e03c1dbb41ed529cbb20b75412efd9a07d984a8357fc4e3bf2a00eaa89777c4e9a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712708, "uuid": "e75990c6-cb1c-4d2d-be70-2cab97af1c92", "value": "T13275339DE01539B790A6043AC883BB48DA3C950B57674B6687793F3E46938C29B4DFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712708, "uuid": "8ac86a6f-0c59-49c7-9afa-7078d7329c53", "value": "24576:SvxhvpL5jFhpBG7WIGuwIx9+ABkaWlZ7SZcO0BqNPkA3TAnr8GBPZaEuV7:avhLDBGCIGuP9+QkaIucOKNA3ErJBPi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712708, "uuid": "628a7a1f-7bb1-4492-82c5-2d375f8ba4ba", "value": 1697872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712708, "uuid": "3508e223-260d-4e63-9cde-7e0e915645e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712708, "uuid": "b3445785-9f18-4771-a27c-995c9320fe88", "value": "SecuriteInfo.com.ELF.DDOSAgent-FN.41222393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9f9dba-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709426, "uuid": "5dee52aa-ff57-46fa-acaa-4c3651a95eca", "comment": "Malware payload (Mirai)", "value": "ce734f6f12e5da333130a36f5f064894", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709426, "uuid": "891385d2-2539-4f83-8917-6a275cdbf5f2", "comment": "Malware payload (Mirai)", "value": "882590a4d9445d71838c389fe9dbdbcb2ee9942ae6cc2671aa07ebeb61ce0333", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709426, "uuid": "941c0fef-525f-4594-a2cf-e4a0f7404805", "comment": "Malware payload (Mirai)", "value": "aa16c7656231879967ef6aceef365e261745176d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709426, "uuid": "8704ca56-0a2c-43a0-ace6-6bf687c17173", "comment": "Malware payload (Mirai)", "value": "97bab9c5b893d0f301c0423c9125a3b7b8a31c0140e45c4fa452495cac5a29e3489416575b101ce526ccc676e6e27e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709426, "uuid": "05556347-c890-4f3f-a57f-2eaabc378ebf", "value": "T136F33969BA0F6D41F2C2C3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709426, "uuid": "f4309027-c3aa-4801-9c9b-b00d5edbc0c9", "value": "1536:FDUsk73Gd7zHFf+cCokA1IWXk4b1r7hjZG3ea2yIA17MEMEn5p5M/LW:PHCokUXXV79ZGua2y917MEMxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709426, "uuid": "0e3fed47-82ce-4d6d-93a9-3cd77d693aa9", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709426, "uuid": "067e2c5d-6b75-4409-888e-497b58ea3335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709426, "uuid": "1667eacc-25bd-4b97-bd46-1b0beefa190d", "value": ".Sassy.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2c8071-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780746904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746904, "uuid": "606d2eae-639d-4d2c-a70d-100a8fe3238c", "comment": "Malware payload (NanoCore)", "value": "efaa91aef997965c90c2d1f9f8a22266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746904, "uuid": "4b8eca2a-d837-45e2-bf89-702ddf47d068", "comment": "Malware payload (NanoCore)", "value": "88939ef17d58c79d48d8ee9304d1e911dc13ed4c5647646811e80018f6b84a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746904, "uuid": "196b043c-79ab-4436-903c-56688811c014", "comment": "Malware payload (NanoCore)", "value": "f5bf86151827a583c00f59b8f5700ad2c15f0cae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746904, "uuid": "7a9b2c12-1f58-4b20-84e2-cad60a59bc70", "comment": "Malware payload (NanoCore)", "value": "224fa906970d5b8bfc88b9e17c3d01d2b11fa1b27c5e9a32231a48f64932e39887906e6d0c88072a463b3e43b59e537c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746904, "uuid": "c340a2b2-9991-4b91-a7a1-4735eeabd2f5", "value": "T16114CF2537E84A2FE2DF86B9611201569379C2E398C3F3DE28D455B79F667E006071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746904, "uuid": "71c91ec8-0f89-46c3-b18b-f20d691061fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746904, "uuid": "7a6ab118-df20-484e-b339-7d7a89743210", "value": "6144:MLV6Bta6dtJmakIM5tcGLYiO5C3e6s7338vSms:MLV6BtpmkUYiOS1k3T7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746904, "uuid": "5d8056f4-8c31-46d6-b2a1-cec393e3e81c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746904, "uuid": "49ce5204-58c2-49e4-8c22-677c9749f743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746904, "uuid": "d374afd8-2bb1-485a-8856-2276a75766b4", "value": "proyectoeleuteria.com.co.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7288113d-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729248, "uuid": "d776bfdd-6366-467e-b1da-8a8f56962194", "comment": "Malware payload (Mirai)", "value": "b62cd61f5ab296814356799c902263f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729248, "uuid": "d7d72cd1-faa9-438a-bb01-f4c2f0d57e2a", "comment": "Malware payload (Mirai)", "value": "89920939a594cc449c1a16fd098996b77923b083909c6abceafa4ffb6b3e5559", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729248, "uuid": "03342f6c-2832-416e-9069-1235bdc8d9a5", "comment": "Malware payload (Mirai)", "value": "91fbdea2ac552839b8bb19d53a60c13b05168d12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729248, "uuid": "112afb3a-d90a-445c-a066-9389f701c9cb", "comment": "Malware payload (Mirai)", "value": "e20077a9b8a17cdc2867fb718c36f703a41ee59e42d0f6716b662f6adabd07ea756a72b094ad307a2ae185dcc34c4365", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729248, "uuid": "229564f0-e39c-4660-82a0-6f831af7e5b5", "value": "T11844230D2ADE5C8C57D8183BFC60FAB53E3C639C5A0A1D62E6E430BD1DEA535486DB12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729248, "uuid": "91608f14-4f1e-4a0f-830c-1ab80fff122b", "value": "6144:WQ2qOAtzTxwzD7c+BJ3fpOdhn7QP3ch9sq:WsOwzGz3c+Hfqitq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729248, "uuid": "1552ed0d-7897-47ab-8fd8-0d367fcd26cb", "value": 265584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729248, "uuid": "ee60d972-c3a0-420c-ac66-08660ebf18d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729248, "uuid": "b11d4ebf-401e-4512-a5cc-457bc73917ff", "value": "kaizen.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e28888-61a4-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780749604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780749604, "uuid": "98651595-f824-429f-bc6c-ca27a263109c", "comment": "Malware payload (NanoCore)", "value": "fe40735c851bfcc7fff8b85315de1f57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780749604, "uuid": "9591e7da-e04d-458d-b5f3-f32f4b07d7ec", "comment": "Malware payload (NanoCore)", "value": "8a8b3c255a7ca0f6ef1a6b3756b1f65c8f30225bca8d8d8addc0f581cfc39139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780749604, "uuid": "fc821c75-1d3c-4988-85a2-5f2e24927cb8", "comment": "Malware payload (NanoCore)", "value": "c46e607f7d7d01e2f4b3f721e976075b80d7f79b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780749604, "uuid": "2c4f4016-7570-40e5-9138-debc8f686f0a", "comment": "Malware payload (NanoCore)", "value": "ef55e6c9c56be7322283f1a1b6baf6e146dc581fbbb68bf7c0fdc1b1d75e7bc3f49567c7b829d0a3c0b38dce60cc940e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780749604, "uuid": "fef174c4-4c15-4dce-bf6c-f4635d76b553", "value": "T14214CF6677A8492FE2DE867D601212529379C2E39CC3F3EE68D855B38F127E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780749604, "uuid": "59173a07-65cc-4c8d-925d-5469bbc27cc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780749604, "uuid": "ad3b6b83-3bea-48b6-a26a-390be86668c0", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIYlwKNdlIhtRSE8KaDtyvLGVQJ:MLV6Bta6dtJmakIM5JTw37ax4L2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780749604, "uuid": "7ef6c557-3d97-4e7b-9a22-2631047647f8", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780749604, "uuid": "12efc652-839a-413c-bd59-3bcd8a14d2b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780749604, "uuid": "0a9f9d93-1bf7-4fd0-8691-272b6155e81c", "value": "vivanuncios.com.co.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69afab58-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780729233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729233, "uuid": "61e6d0f5-7c9f-4eac-833a-c66e9b965808", "comment": "Malware payload (PureLogsStealer)", "value": "45ba849db33a977b59cfb071c149ee3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729233, "uuid": "bd5a1814-2d75-48af-8ec2-fdb6868ab642", "comment": "Malware payload (PureLogsStealer)", "value": "8ad8bc3ab40d137a1213b5c6e65d0e1c060b8583ec91520c4b2a8bee96f5b485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729233, "uuid": "81c619d0-3803-4c97-b1be-51ceaef94df2", "comment": "Malware payload (PureLogsStealer)", "value": "c4212a0ae90e7234381468979e8d7e810c43777b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729233, "uuid": "5fb40d0c-6c50-438e-b8dd-723a5dbbbc6f", "comment": "Malware payload (PureLogsStealer)", "value": "77a0a9d998d51e84401873ede8f9fdd52197acab66f18dda20955c683468611ebd03442687a0687629ae27e2dc1e5925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729233, "uuid": "f56e645a-9266-40ee-8b6b-2f8b58d1614c", "value": "T144C4124BBA954B61C2549A75C4E7A92403F2F6C37EB3E3093B0163AB1D113F1CE66786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729233, "uuid": "8d89c2fb-b310-4424-b687-1513ee3ecf66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729233, "uuid": "93d4415c-6d7c-4689-98ab-3b4a0eede60f", "value": "6144:M2QNhjA+CTjoabTJKmY4H+Giv5fPes986x8S6OrII4UGh7PSSYD5u0rSDMBzf7Fq:mjAJTjcPem+OcfHhm35BbzzFBJg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729233, "uuid": "d224cf1f-40b4-4de2-993f-11a1884c9c6c", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729233, "uuid": "51928faa-e818-4e92-935e-d517e07fa9b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729233, "uuid": "f0ed3913-54b4-4bb3-97c2-f738c06c00bb", "value": "Omada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa766257-614d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780712162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712162, "uuid": "56fc822c-907f-47d3-85fa-59f1ffbaffcf", "comment": "Malware payload", "value": "c72ffad0092e089855b29ce192b67b39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712162, "uuid": "a2554488-e98d-4c30-9fd1-30d9b9c7e064", "comment": "Malware payload", "value": "8c3607868ce80d9e1c6da43a5ce3ab0a9fb570a1e868e16f27a3d8f31004af69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712162, "uuid": "a07b6d33-6c96-4bc9-87bd-8639c87c8408", "comment": "Malware payload", "value": "f605f5072f5e23c5f80234661b2c4c787861416d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712162, "uuid": "e1263437-5611-47b0-b2d2-3074e1d9b670", "comment": "Malware payload", "value": "e234ea69828f0126cce441495cdc3131ea5355905601df4d81ca9fcb23d5d41738eda88ff12e1cbb58184962cc5e4fd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712162, "uuid": "3a3ac81c-3809-4af2-bb8c-ebf2213cba79", "value": "T147565B55BC5D74B2DAC976342F7252943238BC489F82C7233A14BB7CAAF27588F13661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712162, "uuid": "ed9d84a7-17b1-4275-ad8f-a4154b574924", "value": "49152:UZx1midgJXUzhD+nI1V5Tte76thZzqP5xiiqYY6xz0E35Ef:UL1mid6Ezl+nIP5TtE6tjXMxEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712162, "uuid": "69a6ab4b-fe07-4745-8888-f5340210205e", "value": 5898424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712162, "uuid": "d50819d6-1130-4dba-9749-de7aec47c195", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712162, "uuid": "58fdfaa3-ea5b-40fd-8717-4006338110a3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53b1ef3-61d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780768552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780768552, "uuid": "d0f09b53-1284-474b-b8b2-039821ae4033", "comment": "Malware payload (Mirai)", "value": "f7b5db8f1b7efb4cd6ba517321a9b562", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780768552, "uuid": "41c0702d-1ab6-47ca-8e19-1aeb8e865fdf", "comment": "Malware payload (Mirai)", "value": "8e6c0aed57f3f93ee08edb0d2d0c5037412650765f6da4909b6084da752cface", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780768552, "uuid": "bba0ab12-e908-40a5-9e05-758e9f499e31", "comment": "Malware payload (Mirai)", "value": "3d242e6b2697cf113e0b9076e9ec2054a258da64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780768552, "uuid": "6bf82d38-9d6a-4d18-ae52-0d2b82fca9fc", "comment": "Malware payload (Mirai)", "value": "6b0ec50c9c6aa3fd5344eb844e3a4a1c82ee2a122dcdd99ac6e8f853452a3d36134e180a3ef320627d809f180fcd5ffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780768552, "uuid": "6c206bbe-a7fc-4590-bae9-e121e6231959", "value": "T17FB3E195B110EA45C016B2FCB1470940F3B6AE7A1B6A260A5863F5B42DFCCD47F0BBD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780768552, "uuid": "95ec24aa-48bf-460c-9062-a2348bb86db1", "value": "1536:7p47b563OdeyMpjyjg77O5z58VvLO1nN/375EepmYZOQr5SVEbSRppzp5wgFz60G:yx63NpjBO5zJ1nh375P5wk5SOezbwuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780768552, "uuid": "4b55a173-9577-4d8a-bf8e-ec6c56fc691c", "value": 112016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780768552, "uuid": "dca254f2-9ae6-477b-9329-95907cbdf463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780768552, "uuid": "7f56cb08-0ed2-4797-875a-11d1e085433e", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571d5ad3-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765709, "uuid": "7ae88708-b1e2-427a-8dbf-8a99bc3e1725", "comment": "Malware payload (Mirai)", "value": "38b8db62ccfad75e86cb2aed65eb7a64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765709, "uuid": "3a64288e-d4f9-487a-ae09-dfb05f14042b", "comment": "Malware payload (Mirai)", "value": "8f3ac0def67df4e389797b5dc092ccbadab2ee5f00f347ca544180174f8fbd90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765709, "uuid": "013f5b74-34ee-4506-9729-58a37b8c3f24", "comment": "Malware payload (Mirai)", "value": "05b53661f1fda0a428a57e6cb9972503c4a62145", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765709, "uuid": "d91a30ee-16fd-46b1-a338-7454292bd0ab", "comment": "Malware payload (Mirai)", "value": "74d6c38f1fecac642d4f9112ca520ec645c0c4349393208c23ec0ea4c46d698b9c88c0e325811dad5f804287a9539a35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765709, "uuid": "3282539b-9c91-40ce-86d2-18bc764b390c", "value": "T127132B42322C0E5BC5A65AF4293F17E083FFA99020F4F688655F9B568675F371086F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765709, "uuid": "0bd86927-920f-459a-a47d-a9d3c5d32626", "value": "768:YMwKM7EU1yNPBFhFfR6SqbGuJSJjYIBK0kEdNoCOCA:/+EU1yNJ7tOSRdeGNrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765709, "uuid": "2e4dadaf-55ef-4ff0-a7cf-1b6c2347709f", "value": 41892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765709, "uuid": "5b635ca6-9575-490c-9293-b8f5dafde2b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765709, "uuid": "c423b6af-9078-4c81-9af2-7071092a631a", "value": "f79a43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddbd048-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780747279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747279, "uuid": "d2396e24-a1ee-4b93-aa36-cb8527876ab8", "comment": "Malware payload (SalatStealer)", "value": "8d82914ce8013d5fbc6b8d33d5b6f2b3", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747279, "uuid": "7e37c383-e301-4105-a845-e8febef09473", "comment": "Malware payload (SalatStealer)", "value": "8f7195963c7e228a39682131feee6223b997385881f67db608c51863fd319cd9", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747279, "uuid": "17dd9777-bdc4-4cf3-948d-176735bfd541", "comment": "Malware payload (SalatStealer)", "value": "ebe366c7926e0ff306000881f266de1346e2e128", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747279, "uuid": "86b09382-49cc-4d61-ba1c-5566d8eb3cc2", "comment": "Malware payload (SalatStealer)", "value": "8c0293c3363a318ad80b9038832006cc172785a4d47d17d41091dc3cd868fdd805e0b3993cbab52ef66394d64ac0f5fa", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747279, "uuid": "b9e67a48-9f5f-4795-9804-400334324de6", "value": "T13A547E1AF76554F9ED67863CCC424906E772BC5647A0E6CF03910A9B2F272E05E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747279, "uuid": "d76efe20-21fe-47a6-92cf-e91a6453ad2b", "value": "b400bba2fa478b1b6e64f988728df3c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747279, "uuid": "4380c253-155a-4269-bcd7-ac3e8c0ae0e8", "value": "3072:Oxa5jRQnJ9YoYLbUErsUtUS0M9SeARUvVEkQbJO6vuPmeYoZSG7qHL8PeLvAQcZf:Oxa5jmn2f08pC8VEkQ9OkYm92/Ap4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747279, "uuid": "d9c182de-3072-41a7-8843-26dd5ff4d51b", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747279, "uuid": "aa492fe8-e551-4942-b01a-e13ac04aa4ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747279, "uuid": "885cc9bf-11e7-4599-9e0b-2f08349e3ba4", "value": "ZapretDPI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77d8731-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780771481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771481, "uuid": "d057e9da-ff81-417e-a6a2-8f4c540bd90f", "comment": "Malware payload (MassLogger)", "value": "685a4b0176a568b27185d423993f8f0d", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771481, "uuid": "7bee889a-e0b7-4787-b0a5-5d7aa5aa81ea", "comment": "Malware payload (MassLogger)", "value": "8f78015541ecf212d303aa3662a37658e622d52b0264eafad73dc09c4dd8940d", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771481, "uuid": "cedc319f-6a62-486f-8b3f-4bc5ab00bc38", "comment": "Malware payload (MassLogger)", "value": "cbcc566dc265ae4b59e34530c13b91b996455425", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771481, "uuid": "278a6d79-e551-4e1e-945c-5bfe86fa7834", "comment": "Malware payload (MassLogger)", "value": "19d3b108c049aae2581d2e6b0f4b9ad708322cb18cd6e3d5b61461a4b48f8688e9ae3c31ec0d01ae588d12e816fcd3f4", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771481, "uuid": "b25d9699-9319-4f03-9ce0-86bd6c04c2b8", "value": "T1915533F7A90389D906516128152ED0B3DEBCCC59C9A76EB8FFC1872ED9148E15381E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771481, "uuid": "f4dc9e39-53e7-4e27-ad2a-376dc597114c", "value": "24576:Z3OHUSMpHhQOnQtGtmuq04VoXLi6/PDaXk0gsvz/+gzY+Q:F2US4QOQE8uq0G4i6Tek0gk7bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771481, "uuid": "5dfdf8e9-04fe-46d9-9b88-b0a2a384c3d5", "value": 1346773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771481, "uuid": "a03db659-e491-420b-b923-a1ef49d39851", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771481, "uuid": "25540b2f-8df3-4506-9c9d-fbcd51781836", "value": "RFQ#XQUOTATIONX-XPO-048166XXE2SXA105N-BHG.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b19a15-616a-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780724398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724398, "uuid": "e0f75953-5137-4390-9e15-42fca395cf79", "comment": "Malware payload (ACRStealer)", "value": "a1d064d4635562de7496c1c1f65c7773", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724398, "uuid": "f0841a5d-8564-4a67-acd8-c5e342c430db", "comment": "Malware payload (ACRStealer)", "value": "90f83e56db76b9a30f617ec9766bdf5c6a3242af1b2a458213816df6cdddda12", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724398, "uuid": "59ddc548-3169-44ae-b807-5d0aedcbca72", "comment": "Malware payload (ACRStealer)", "value": "6123a39ddc8b435a455b35a6e8785974d11bcbab", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780724398, "uuid": "70b06319-845e-4c29-a255-343d28a41d81", "comment": "Malware payload (ACRStealer)", "value": "63ac3bb9348eaf9f6248557f0ecab1f0adf9325e71120178fccf995af9b978d9a90e8182db186a0cb9d1a22e2dea596f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724398, "uuid": "2a4645e6-5747-46bb-a429-0360c347b683", "value": "T17BB5020A3AC95662D42EA37070A2037F1333FD3916A65F9B6197FA98DE333C2351265D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724398, "uuid": "9dfcb3ea-63dd-4cb2-b1fb-7ea15fd9a046", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724398, "uuid": "fc84c819-e78e-4e9c-9999-ab0f1110215c", "value": "49152:8j5X6kX6rcn7F+TYcJIyfK5f3uGJp2WX9evPSJlPUOYwUaEd:EqkqYn8ccJXef3ump9XAvPSPUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780724398, "uuid": "b3747ca4-70cf-4c73-821b-a2e97ad546fb", "value": 2465792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780724398, "uuid": "53d5c3ea-8daa-4276-9bd6-0a98b021310e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780724398, "uuid": "aa783b21-09ac-4432-9f36-eccfef32976d", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c431dee-6170-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780727144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780727144, "uuid": "8c7eb0be-0f7d-447c-9788-0fe4cae782f7", "comment": "Malware payload (Mirai)", "value": "6e6f40dfe9e4f1e53d23ca0c142d4c0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780727144, "uuid": "e779c135-41ef-4230-a957-590006755992", "comment": "Malware payload (Mirai)", "value": "9374148a86e5a043af8f156b60edc051d09f8490b28bd7805868714043f155d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780727144, "uuid": "ecc6e812-7856-42fb-860f-c23f6d97abb7", "comment": "Malware payload (Mirai)", "value": "7ad784dec205cffb9c19ab8fe31e73b79585e97f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780727144, "uuid": "10ebc9f3-b4d4-4437-ad4e-f095da0e0967", "comment": "Malware payload (Mirai)", "value": "19575614a2d5b7a21f1cff49981f1cc030e4dd51904ec66a6a1cf702317615618a8157153f5ca5326257a387dd259c86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780727144, "uuid": "4487b127-c650-4342-bc02-2766ee74ee5d", "value": "T1E48533CADC1E1685BEB7534520CC3BE26FEEEFC4AA0890B981603774DF78452A74D252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780727144, "uuid": "297c7b84-5367-4d6d-8b40-0c766f28cb57", "value": "49152:oUHxWjobOZndeBl4AnE+J/gQkmQwRGBFRDjlRAH5q2:b6igdef4zGgQkmzo7OH42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780727144, "uuid": "e746e7de-ce3a-4bb4-afcc-f11558cd14af", "value": 1840288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780727144, "uuid": "380b4ec3-dfe1-4b75-9926-724d09cbd5c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780727144, "uuid": "2325ae26-fece-4b61-a5e2-0c5674285bd2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4f465a-61bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780760190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760190, "uuid": "0303c39f-38b1-4252-b495-5d9a931f0fc2", "comment": "Malware payload", "value": "21fd703130b766f2a22e0ae7d629910a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760190, "uuid": "0a577c68-041a-4407-b187-4ebfebbb884d", "comment": "Malware payload", "value": "94487883cda70cd0ca10a7e9bc8b42298041f2a120fb5d48ce7fb6b9e912e5ad", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760190, "uuid": "5ad61327-922f-4a5b-8a8e-c6b9fa72195e", "comment": "Malware payload", "value": "1a561553352edf495d781e15134bbbe5cb35ec6a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760190, "uuid": "7678472e-5a06-4d70-96fa-8c4aa29f03ab", "comment": "Malware payload", "value": "bf50fc62b920c06d9bdc81cbd0f32c669316bb78c0e4344e798fc6dec46554e89ff34727ff27c6ed7cbce85959fe9245", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760190, "uuid": "a8fc6ff1-e7e0-470f-bd34-a6d30c693166", "value": "T1E9D5E08076F95304F176FE369E3AAB81047BB9D1EE31C76C8A50CC1C29A5A10DE75F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760190, "uuid": "60760590-a43d-4c29-8676-eda85aabe50d", "value": "96:Q0elcnzR72elQnqEQDeldnv8TAtWwiCN7elin+5vld:Q0e+zR72eCqEQDevv86wq7eg+5vld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780760190, "uuid": "8491c7aa-ced1-4a65-bf76-1602c6e58869", "value": 2784839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780760190, "uuid": "af09fa29-1751-420c-8d0d-c2bda0951587", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760190, "uuid": "f18218da-7f6a-4be4-bb98-013d85d40158", "value": "spisokszch.xlsx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c29fe8-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747266, "uuid": "123c56c6-7247-41fd-8aa9-54e9c40392e8", "comment": "Malware payload (Snojan)", "value": "77bfa86f383989876cbfdae84fe12b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747266, "uuid": "d7accb3a-ef43-4478-90f4-22937e7e198c", "comment": "Malware payload (Snojan)", "value": "9492ff4faacdd55be82da916199d63076f4fba059a2eaf197ecca66f6958c954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747266, "uuid": "6880f1ea-fe38-48ed-a883-825c2913f9d7", "comment": "Malware payload (Snojan)", "value": "eca3672994e6da437dd09461f2067b169f1262e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747266, "uuid": "525a3c7d-64a5-45a8-88d2-04e99b2cf61c", "comment": "Malware payload (Snojan)", "value": "376606d200dba037f895acd975e47816877d4a91f19360d7e55cd6aa47ff6cbc2cf9624bdd9d6b0df77f413dd4275672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747266, "uuid": "2cb9f0e8-8b87-42ca-80d2-e54b2acaf36b", "value": "T177F3021646DB58F7E49B12BD469D9063B2FBA06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747266, "uuid": "76b020cd-63a1-4941-b005-d4e1f0c05cc7", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747266, "uuid": "5a2e94f5-22f8-474b-8c7e-1d38bb65b7b0", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+BK:QJ0TAz6Mte4A+aaZx8EnCGVuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747266, "uuid": "c4388e57-6dd1-49d4-88d0-43052c0e61ee", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747266, "uuid": "ba9cecd5-08f2-4411-bb16-c53702ef7126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747266, "uuid": "9ae772ba-034f-4ad7-82ed-fc90222cb60c", "value": "4R7VXcWwS6V3XlyE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e5c6c1-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780771484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771484, "uuid": "933646fa-6c13-4aa6-a9be-45a8dabd15aa", "comment": "Malware payload (MassLogger)", "value": "62cad2fcfae61d5f2009c8e4af4ce5e4", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771484, "uuid": "d55db926-b022-4d47-bf54-e37b4f8581c1", "comment": "Malware payload (MassLogger)", "value": "94e6a9e6919ac83305e4610850a5da15d1417c9cbfc58a280ba3f86a5f3d31b7", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771484, "uuid": "50dcc625-44d3-447c-8ccb-13844f20d5c1", "comment": "Malware payload (MassLogger)", "value": "ba73c7b2282322beb5bd1b7ee207971922f6bcec", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771484, "uuid": "fbf3e16a-abff-4067-bfb6-4e073044cced", "comment": "Malware payload (MassLogger)", "value": "141efe287eae7a4ed090bafb206b08a9d3dcb8a67f43e73f0ea30f690f9983a3dc3b8ab77ccf0b85c1ca1215284b9c53", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771484, "uuid": "3cf1203b-0089-4203-a114-635c78ed5ae5", "value": "T1875533F7A90389D906516128152ED0B3DEBCCC59C9A76EB8FFC1872ED9148E15381E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771484, "uuid": "66bcaa39-cccd-421e-b87b-7a3f4b4d50cf", "value": "24576:j3OHUSMpHhQOnQtGtmuq04VoXLi6/PDaXk0gsvz/+gzY+v:r2US4QOQE8uq0G4i6Tek0gk7bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771484, "uuid": "d0aacdf3-ec89-4242-93b0-b9fce52f4b1f", "value": 1346741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771484, "uuid": "68af711e-2379-4230-8048-45ec06e00e78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771484, "uuid": "a3d34891-57a4-476e-b1c2-e5028a0af6d6", "value": "ScanXCopy_784898937637B23.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e865c0dc-6180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780734170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734170, "uuid": "a01cc104-ab82-48bd-a78d-7a33bdc5b5e1", "comment": "Malware payload", "value": "8f9a89a6380cea093b9fc5bb30057dda", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734170, "uuid": "30d546c9-017b-4b72-bb49-c89895a9631e", "comment": "Malware payload", "value": "9523f78157aca97b7d61e2da5ae81aff78d7274f20e8259a947ebfaa22fbe0fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734170, "uuid": "2b3632ea-e9f9-4d69-ae60-15406e9075a0", "comment": "Malware payload", "value": "48845f628c8683d0a408f536b0cf0eb7745f4759", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734170, "uuid": "78cc5678-bffd-4f5a-ba36-d29044fdc79d", "comment": "Malware payload", "value": "825866099416f7cf2a8282206c4c377f2caf8d12824c2cc278385f91ee0252315538a9dd998368bc6308058b7158b0bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734170, "uuid": "6d1f948c-0216-4348-b9bd-a499ee22b75e", "value": "T103D2DF34C4D83FBDEEAA2A1C06FA6A20D7D68B1E9498860637077D9B4F37C80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734170, "uuid": "3d889d66-ba1b-40ba-92ef-c9449306c74a", "value": "768:dumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:du+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780734170, "uuid": "1dfdbf7b-82e1-4e6f-a896-046bfdd90050", "value": 28668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780734170, "uuid": "c7817f66-f7b1-4b0c-ac37-16590f253385", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734170, "uuid": "5d3a7403-d221-4592-a86b-efd5cd9d382b", "value": "23.94.110.24_1780734104576869_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273952aa-613c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780704640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704640, "uuid": "31521fa4-1b8f-4832-9629-2045239cf6f5", "comment": "Malware payload", "value": "008db830a5c1b7274b54d6431148a8f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704640, "uuid": "97b9ac00-fc3b-424a-b215-c92aae670f74", "comment": "Malware payload", "value": "95b5d01f0303f10302634f220eb20e3fff6d7d958dbf9a557dd6b70921deb402", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704640, "uuid": "44fa442f-846f-47aa-bec5-86f4591de769", "comment": "Malware payload", "value": "bf2d938539b3077dfbb0db907ee8fe795388b9fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704640, "uuid": "26d1ee00-22e6-4958-8813-d914e8e6f406", "comment": "Malware payload", "value": "fcc33b9cb0eed8f5f87027c8e523f70fe200d902490fe89d6e3827f7362bb51b7905b0cfc802b19413563bdd03a356c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704640, "uuid": "b2255bb6-abe4-4b36-b74f-b0d9615cb226", "value": "T10166E719ACC43BA6C06C4B7554EAC96522B05D044AF14B3A66A0FFEDBC762787F07C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704640, "uuid": "7f97ba12-ab0b-48f7-885b-477ad8f8f907", "value": "49152:2Cz25mg3FB1oNNlRgg0Wb/oj+znKNiGJ004S3F93xi9IhS5Ef7:UFwdbgj+OH7doET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780704640, "uuid": "fb6205bc-7375-4be5-b874-9c6369202906", "value": 6553815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780704640, "uuid": "499e6a37-df4e-48f1-93cc-e5ff3d143a71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704640, "uuid": "96f93a86-5a19-4b11-b852-4aeb357e3011", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9667f3-61bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780760860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760860, "uuid": "dce5ccdf-e6f6-4932-acba-08feb26627b1", "comment": "Malware payload (Mirai)", "value": "df69a69412572bd265bf82db4df5ec86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760860, "uuid": "05554a66-985a-470b-9a0b-52722964ae7f", "comment": "Malware payload (Mirai)", "value": "97ccd285196504320eeb5d398667c459fc9422567e9b68725490a21bf9234f51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760860, "uuid": "8909b2b8-a3f7-417f-a3a1-a1462883678f", "comment": "Malware payload (Mirai)", "value": "29225e92ed8cb3fb1bda4140d2ec9c80980aee83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760860, "uuid": "78119a7f-7790-4ae8-9a1e-4a363187de8e", "comment": "Malware payload (Mirai)", "value": "a9d5125c2432fa2797d077c617fa39be6c3936a665ad1f3612187100a27d1438839de7f1c699ba28ce0a34cae7abe944", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760860, "uuid": "4c519926-8029-49f1-be9f-856b5d5bed28", "value": "T149E32945BD928E22C6D726BBFB5E428C332723A8D3EA3203DD255F11778652B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760860, "uuid": "e1c46937-86e1-4c71-ba3b-4c17572084bf", "value": "3072:ZzwAwgyh0bkaBFFlpLbznmnmVpZ5ytBXRLt74mEK+obSnV:ZkLjOJLbzmnmVpZotBXRLt74jtobSnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780760860, "uuid": "67fbcb7e-9a0e-4d11-8442-f25d8b0a8017", "value": 149520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780760860, "uuid": "d970aece-0692-4fb6-8a97-958b13c573cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760860, "uuid": "c4db7345-71c4-44da-9aa5-4883332f7301", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e8901e-61df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774799, "uuid": "75ea3c1b-109f-4463-9d64-7e0a5938bcea", "comment": "Malware payload (Mirai)", "value": "62fe5c5649d3eea397fcce63dcff9be3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774799, "uuid": "ed6b8498-6a5f-4d8b-a3a1-bc0f0402ef41", "comment": "Malware payload (Mirai)", "value": "97f27a78b0dbb1a4437eff3888bb9f089d624fb08ca86c20299f0d55e546f3c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774799, "uuid": "3ea4638a-f70f-4926-82b0-defe5f4e4623", "comment": "Malware payload (Mirai)", "value": "1003f09d135b1493251803af849173ac7c4f8b57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774799, "uuid": "9733a094-18b0-4b66-947f-13eddcb221e4", "comment": "Malware payload (Mirai)", "value": "88c8a7280bb3380ec8eb261500436be11f3973410a96e5cd737a47a468b572b00c690367c05b9ff88cf1818acbd9e5bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774799, "uuid": "7788ed5a-b15c-49b6-9b54-a1e6ef24a2ec", "value": "T1D7533A027781E573E18316B22AA7DB914133F63A1A169F12F30DBCF4AE256C4362779D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774799, "uuid": "4e92ed45-e9d6-4e41-b148-6604224528d1", "value": "768:tpqIARV+3gxIoPTX7EHLgD5lxrq0I59SsDq1/NXtyA830/2aIkaJ41YpB9gi:jqIARV+QxI6ULMP8z59x+/yX0/HoSU9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774799, "uuid": "0dcc4520-aae7-4ec8-bbe1-24f95037cd93", "value": 64593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774799, "uuid": "49fdc323-7a01-4bd7-b6f8-7e28c01e0857", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774799, "uuid": "1f7c9672-4cb2-46bc-8368-b9e7e38d7bb8", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8b0ffc-61b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780754716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754716, "uuid": "d5f55831-272e-4e36-bc44-f65ceb994e2a", "comment": "Malware payload (Mirai)", "value": "caf93c459985e89a7ee94ab9a9162690", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754716, "uuid": "486d357b-dc5d-4e7d-ba02-cdb425945408", "comment": "Malware payload (Mirai)", "value": "98f298eefccedc341d42cede8c2e483b13bf7fe1a625193a3741ece39672494a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754716, "uuid": "a5c118b7-4eb0-4e4c-a893-4f19f0827b3b", "comment": "Malware payload (Mirai)", "value": "a73f00b44846260a3a6b5c00e7d832cd592def5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754716, "uuid": "2170faed-bab3-439f-a828-2abd89589a7a", "comment": "Malware payload (Mirai)", "value": "673666f6635980c9ceb8c685cef81d3ae7fbbcd36f5b317ba564212a3dc0b7c4e83814c0885fda1b5f1548277ab5ce20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754716, "uuid": "1a1754df-d2ec-45e3-a42b-f8c0605ffce6", "value": "T16C935B417369440BE3A74DF12D3F6BF193DFD5A122A0A185695E9B0F8231E322586FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754716, "uuid": "0cecd99a-d3b1-4546-ae59-59960dee9c7c", "value": "1536:ar/D4tFbbtPwtkrLYIHiv2qEA2KFfOCw06c2bbyyGGdlqyW9ubX0ZC1zk+R:+D2bWTEsFmGsbbyqG9ctH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780754716, "uuid": "4ec8dc97-f537-4cad-a922-e134207eb923", "value": 93856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780754716, "uuid": "bfb67424-5f93-42a4-800a-66a47d102c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754716, "uuid": "ea152faf-a072-494a-bd94-a1530e7bf1f5", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763f3698-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729254, "uuid": "3af278bb-6c62-43ba-90ee-e31879b14469", "comment": "Malware payload (Mirai)", "value": "671e829904df853cc40eb71e5ccb4c0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729254, "uuid": "31bd7b94-a184-4e13-8f94-c5494b640632", "comment": "Malware payload (Mirai)", "value": "9981ef9d9f8632d30be0362877ceec3cf89d89425cea116fa25964a8224a9c07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729254, "uuid": "5f0b4ebe-70cf-41e2-ac1b-c00d57b1d9aa", "comment": "Malware payload (Mirai)", "value": "e388326eb83d6fe7a60c8c750631b88ae11cfb2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729254, "uuid": "c2db3796-9d2a-4b37-bbbf-b861b31a4c77", "comment": "Malware payload (Mirai)", "value": "83b7aed4f5e178cd5a7a0823bb82b525e977837f8479e59f086070b54325e60f35fef391dea49a37fb4b8d1dac090d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729254, "uuid": "aa02cc83-c6ff-4efe-83ae-d414f7d9fab5", "value": "T10C6423785930AB1C84B9B5386B484B3DA9CF634BA6DD5F0453B9E0E12F0ED290707B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729254, "uuid": "63a2c1c2-e43b-46aa-b23e-04a229819910", "value": "6144:KywW3dWxUX8sv5tu7hlmZoAIRIkOcpC/lfewug5a90ux2DzUf9Ml1sk:ZwD2vDu7vfEIC/lf3pdzUf9Ml5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729254, "uuid": "dca057a8-c5cb-429d-a855-05009988608f", "value": 310884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729254, "uuid": "e347628e-8639-4019-991f-0479d47d0770", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729254, "uuid": "38deddc2-0bec-47e9-8612-de0b0fb8223d", "value": "kaizen.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cf9257-614e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780712686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712686, "uuid": "3bc37279-342b-49fa-b68f-507f5fa91747", "comment": "Malware payload (Mirai)", "value": "8cd07fe808c24ab9b8688a245f124c7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712686, "uuid": "c0c69e8e-7613-4780-a15f-e6722778566e", "comment": "Malware payload (Mirai)", "value": "9a6fd15ef798e77c8e2266e32e3926f23faaf5f247bcfd081040c9e8b8fe702b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712686, "uuid": "95152f82-fbdc-4de1-9fc0-e2127164637b", "comment": "Malware payload (Mirai)", "value": "96a7b23e468439dd3eb567cb39a23a8252333d2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712686, "uuid": "cc063b96-1fc2-4aa7-8dce-b76d04f9ee15", "comment": "Malware payload (Mirai)", "value": "60fe82dd5c21082dcb41ace43f432d06bccd749e30ceb318fecfea966d06504ee9451f10c723a2fd8543cd507fea28c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712686, "uuid": "0a8050af-2854-47d6-9164-13b4bc77a122", "value": "T195C38C76D82A6F58C556C1B4B0B48F792F53A58082871FBE29B3C2749043D9CFA05BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712686, "uuid": "e2417190-b9df-43da-8c10-0cf8d6d1748f", "value": "1536:2aaSS5jHQmf4ELykvYizKCl3kExKRq1cyuPCW/qLkuFsWjnU:2atS5jv4ELykv/WWkEYRXPCWCIijnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712686, "uuid": "5a27f5fd-9219-4c72-a94c-fb842a74c805", "value": 125636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712686, "uuid": "c6b3e338-2847-4858-832a-be3a50211eac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712686, "uuid": "a0fc1c04-3f61-476c-8b1f-a75a55704fb6", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d0ceee-614b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780711341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711341, "uuid": "78f18567-2087-491a-9081-08b272c526e5", "comment": "Malware payload", "value": "522d9925c70c29aa9c06465261c1715b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711341, "uuid": "f1455ebb-19d5-46c4-b919-1b7e5f6b2203", "comment": "Malware payload", "value": "9b917cd0e6a4dc36c4b053c3d63b1049071b76ada6d2237810f6308a5212d440", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711341, "uuid": "05a2c9a7-a28a-45a6-a660-f39cc4a2781e", "comment": "Malware payload", "value": "5bf465ca1a9cf347d3cacc15c6fbdf0ecffd624f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711341, "uuid": "b42fb020-5866-42c5-bce1-fe9c88e7ddaa", "comment": "Malware payload", "value": "05500e029ba24b879b9963289713cf514891e44e134160de9d2ff4790bd8bd7bc59b5bbdbe83f2a804b16d92d17de768", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711341, "uuid": "601e0158-0213-4ec4-8f71-133beb5c38e5", "value": "T18E9533F5953B2467C8A20EBB27BCA0B1C6CED8647DE4F12D01785AF67EFA0206631571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711341, "uuid": "139c8b6c-885b-4da8-9497-390f1c6ff81b", "value": "49152:qMML6LmSlHucs7Nvz8YW10wz+PrhjD1Jq+eH9qzZRzedogYA:lTZw+z+PrhjhJqPsXNzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780711341, "uuid": "3a5bd18c-df92-4138-9ef7-95c5f865b4cb", "value": 1970000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780711341, "uuid": "9fcb9ea8-cb26-4fe5-ba71-5def90605aea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711341, "uuid": "6b01b957-d4f2-4d31-9aca-588a9a72d976", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3963ef2c-616c-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1780725287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725287, "uuid": "d497e37b-3abc-4ad8-839c-dd77c5d93acf", "comment": "Malware payload (Joker)", "value": "14a3592fbb1d6f32f80146efcaf479f7", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725287, "uuid": "7bd8acdf-7cc0-4f0b-8ba8-e898928dd43b", "comment": "Malware payload (Joker)", "value": "9ba6b195a3e61d7b4951181831e19029855ffdccb216b6585674e69f9bee9ebc", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725287, "uuid": "0bd84bb2-e879-4e2a-aa0e-29bd978cb849", "comment": "Malware payload (Joker)", "value": "19952305a6ff667c69bc1682ac1fb6856726f212", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725287, "uuid": "19295d2d-1d06-4d19-b9eb-a986fdebb80a", "comment": "Malware payload (Joker)", "value": "a125a969ef5f5f4464f3c94b6ff40d602aac6f4626d049fd3176294061039e0facbd996ae60b76b22714568793bda3f3", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725287, "uuid": "b44048cd-7c37-4be4-aa59-4665f70579f4", "value": "T1C0872386F72DDE2FCCF7F038D96A1362A1151C989282D3975905E628BED3AD48F05BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725287, "uuid": "a71f91ce-9d46-47a3-bc1a-27a1e9ca9562", "value": "786432:cdK23ST0lZXb9MXvrJDIxYLuKM+lQEq9kBoAux9PvPw:10lZX+XDJDI0uOQ7RAuxto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780725287, "uuid": "f8e7b193-7840-4414-a936-080f1862e481", "value": 39134251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780725287, "uuid": "99a89d29-f5f8-4406-9b03-006a27ee1bbf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725287, "uuid": "96bfe138-c9ac-4a48-8816-332739fdc1b1", "value": "com.poison.worldwide.facewarp_3.0.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dce3bd-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747286, "uuid": "bcd2496a-d8bd-458d-a36d-c1537a7412dc", "comment": "Malware payload (Snojan)", "value": "cdf9e6397e4080cb79ea5d45e3b36735", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747286, "uuid": "97515fa1-d779-4797-91ba-1d92e61e416e", "comment": "Malware payload (Snojan)", "value": "9bab597271bb586e84d65394cc4397eedbc606659637bcdd81699d2967873e16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747286, "uuid": "f605b76a-c056-4da7-a562-570e65045e85", "comment": "Malware payload (Snojan)", "value": "d5200914abbbcd58b2049ed2b0e8a56abe767684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747286, "uuid": "f04f5c6e-7da5-4085-850d-0461cb433fad", "comment": "Malware payload (Snojan)", "value": "e7ffecaac157f012cb9382c4b80bd1801fd28934c85fd63fdf5fe74e790b13b128537e8f7243e8653a6740c92a36e346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747286, "uuid": "d6d8d8d2-d22b-48aa-833f-baf73c1412ea", "value": "T169F3021646DB58F7E49B12BD469D9063B2FBA06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747286, "uuid": "357fa7fa-cff8-4b9f-b336-feeaf61d6b05", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747286, "uuid": "eff8f7e2-fe14-4e37-91fc-76a33df99050", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+XK:QJ0TAz6Mte4A+aaZx8EnCGVuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747286, "uuid": "600855b5-5dde-4ba5-a695-ecd29493704d", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747286, "uuid": "0c685814-9c8f-44ab-802a-5efbc2b05e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747286, "uuid": "de82e17a-bf80-40db-894f-8907af6ac140", "value": "Dsgo7FYZkbNH8drv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ffdc92-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729256, "uuid": "74fb868d-a2d1-4d07-8db0-2fc6e227b269", "comment": "Malware payload (Mirai)", "value": "c972d6307c28dd0cf6d1a140ac0fbff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729256, "uuid": "3b4062da-7919-4d7c-9bca-ad62418cfd86", "comment": "Malware payload (Mirai)", "value": "9bd52805974244639c4b3397b434223d8784cd0ade3cd9c4ee793bc194d8060d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729256, "uuid": "db51fc34-dae9-4000-bcc3-0e9e5879b936", "comment": "Malware payload (Mirai)", "value": "6224e4270370810bc5a9bce61d48afea5572d97c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729256, "uuid": "dc93fcf1-6e48-49c4-9752-fb5523773853", "comment": "Malware payload (Mirai)", "value": "4c113088c53ccc32322bfe52645a37ebecb66918968d8735b4d0f49d941ed71f9d62de6897880a217784e5bca9fe05fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729256, "uuid": "93446840-0429-45af-9633-b0e3316edd49", "value": "T1394423E12953CA6FD4ADA33A4400E4C536B854B95CCF0BBFB16AB5D9C23DB2090DCB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729256, "uuid": "1fed146c-b6a5-4a76-963e-0eb2ec047780", "value": "6144:Q6UfirFzBsPHKhVnVjJmntDgWV5wwMZiyDo0Vpwnq4RBE9Z6IjZQV:XRpqPHKhT4tcWV5wwChDfpkqOEz6IjZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729256, "uuid": "ff0da21a-e330-4286-924c-98e2d7100a35", "value": 272132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729256, "uuid": "54754571-efad-490f-871d-6bda8550d082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729256, "uuid": "563675dc-bd62-4b4d-a844-d60b88d5a5fd", "value": "kaizen.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77348432-616c-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1780725390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725390, "uuid": "bd18c47e-8784-4f5a-9801-87c1b07cb480", "comment": "Malware payload (Joker)", "value": "02c610b5e9ff6d4abca76a4a28323c75", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725390, "uuid": "016fd469-0a29-4d09-83ed-e5dcbc0427bd", "comment": "Malware payload (Joker)", "value": "9c2838760950362b155d0fcfccad2951175c5455e80640e73f0c95b006053ce8", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725390, "uuid": "086e15e6-f418-4bb1-8bc4-f8e908c7dc59", "comment": "Malware payload (Joker)", "value": "3387508ee43fa7849cdd9f5cbef0f0b7704b484b", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725390, "uuid": "72b1c71a-b68c-4762-a038-94f1c94db4ee", "comment": "Malware payload (Joker)", "value": "163a40be3a8be3dce00b360a5988ca207f1f8583d8afe3ad4c20515b47100cd4f10cbf5ac3cc3687a704e60b697a5981", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725390, "uuid": "ec962220-7235-4a48-b21a-cfb3b068b5b9", "value": "T18046BF0AFB06887ACEEE52342CBB0B917732A0CAB64343571424D5B8BE977D95B5D3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725390, "uuid": "62655240-c02d-4d38-bab6-d51b3573947c", "value": "49152:oDvMHVvCrr5s4OmBkXVE/vsYVd8pNKUI13uZrLuenXXO3etaCg+:Lv47C13VLub3etv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780725390, "uuid": "b627032b-6520-433e-af39-300a536d8491", "value": 5372455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780725390, "uuid": "0450e559-634a-4c5f-b553-1ad3af6bc805", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725390, "uuid": "e98203ca-0f3c-4fe1-9586-cbc989ba6c8c", "value": "com.eastscan.fasing.junkcleaner_1.0.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aac4854-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747274, "uuid": "dace8412-27cb-4c23-91d2-86da813c63ed", "comment": "Malware payload (Snojan)", "value": "09ec163f4da89914a00a7c0a53aaa48b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747274, "uuid": "0652063a-7d46-451f-9ff5-400f6477bf14", "comment": "Malware payload (Snojan)", "value": "9deff8c4c78cce6d71b224b04c8e2c7f670104169d42280c474e6604a9bdda25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747274, "uuid": "1dca8cbf-f989-4d02-90f9-ef1f0cab5c53", "comment": "Malware payload (Snojan)", "value": "2c9242572f154ba7ea98ecf2d0229eef7cf57e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747274, "uuid": "c6362d32-a01e-42fe-8360-ba1a387fad74", "comment": "Malware payload (Snojan)", "value": "984e5885b3b973520c7b65b0873f1b07531c974019889958cf151b6f01cd014a2bd5e2c755e5cd36a7a56b4247f7f324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747274, "uuid": "015b1c88-f91e-4794-81ef-4c34c809e068", "value": "T1DBF3021646DB58F7E49B16BD469DD063B2FBA06F4BCE3EDBE1FC224DD6062B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747274, "uuid": "c4ef95cb-b23c-4d92-92c2-dcc0a9ff7001", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747274, "uuid": "41759830-5545-494c-9386-3bd1b6876854", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+iK:QJ0TAz6Mte4A+aaZx8EnCGVui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747274, "uuid": "9b5684dd-88ef-4a80-abdf-df455421e837", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747274, "uuid": "afb910a1-021f-4fcd-8085-782ac71545c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747274, "uuid": "025e416e-a8bf-4219-835f-b70267f67af9", "value": "BSfgeIiKu9newDch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89935827-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747326, "uuid": "f49a56b6-0832-453a-bf2c-ec932d1bc0e4", "comment": "Malware payload (Snojan)", "value": "118600faef8ade5422035324677970ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747326, "uuid": "107593e9-c559-4095-8a0c-8319fea99d0a", "comment": "Malware payload (Snojan)", "value": "9eead450235afa1a28470557ac59177c0511d975c72f777471b5cb39a603147a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747326, "uuid": "33621dc6-9330-47c6-98ed-0342d5e10162", "comment": "Malware payload (Snojan)", "value": "f9b16c3e3ad51d539894efd57170670218e424a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747326, "uuid": "6a52b238-b1a5-4265-b198-199b7b44fd15", "comment": "Malware payload (Snojan)", "value": "382f8e1ff28315f37cd147c8942d45c327b6b0fe4030f84dffe2d2af09305396e7c68df7cfb38429f584b96be9cb7564", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747326, "uuid": "a51ba5c1-2054-4354-8ecb-6abf502bce09", "value": "T1C1F3021646DF58F7E49B12BD469D9063B2FBA06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747326, "uuid": "5265d334-57be-436e-9431-c7c76ec2d7ab", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747326, "uuid": "428a6f25-3b26-4448-90d5-14b67eb8ba9a", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+qK:QJ0TAz6Mte4A+aaZx8EnCGVuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747326, "uuid": "40a27a42-50da-4273-a84b-b52f1cfd409b", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747326, "uuid": "8ab3e0da-fb14-43ef-89e8-ed42e830d5ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747326, "uuid": "64327583-b4bb-4657-8683-90c34663a0d1", "value": "LxZUYFvqnFMuoY3V.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791f5967-61d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780769632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769632, "uuid": "39f03f50-448b-430c-91b6-4a862659ea8e", "comment": "Malware payload", "value": "09f2ae5f1b736a7f7fd5d2a8f392e13d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769632, "uuid": "990e5fdf-a8ae-45e0-b0a3-89596f8cc551", "comment": "Malware payload", "value": "9f1c64524e7139b93dea1fa48edb73098fe84ff1a32d93a548a09042c2a03ac7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769632, "uuid": "504a3247-dbdb-453e-8e22-64bc259eece2", "comment": "Malware payload", "value": "f79f6fd56e47fe57a3c0a5f2b048bfaa35320319", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769632, "uuid": "29adbd0b-9eb7-4202-8edb-8c07416c1140", "comment": "Malware payload", "value": "b2f74a0ab35ddbe2ba143b3c6ee0ff0afa08f35943e841a8465022d77e3728fa4115697a15abb7ff49d3057a681f4a4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769632, "uuid": "0c0eec55-986f-4473-8abe-123b43583d06", "value": "T1B2D68C77914238E9E5A98CB4D11025426DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769632, "uuid": "314a8a59-33c4-43e5-9141-aacb71e30789", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQv:cqYUQuVDt0TZEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780769632, "uuid": "adcfa753-07ec-471e-a957-e447c5217b40", "value": 12910592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780769632, "uuid": "704b904e-c120-4ff2-9081-1eb7104bec85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769632, "uuid": "55fd2c68-6b6d-42ef-a3db-bd92e2a292ff", "value": "9f1c64524e7139b93dea1fa48edb73098fe84ff1a32d93a548a09042c2a03ac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2834187b-61b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780756182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756182, "uuid": "d7899873-294f-45b7-8b70-8fc429fbdde3", "comment": "Malware payload (Mirai)", "value": "912be9fcf720f3395ce8cbed416d9649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756182, "uuid": "85a3309d-8a27-4e19-83af-4b9d3e22e2c6", "comment": "Malware payload (Mirai)", "value": "9f8287ac6848f18b4b1db679dab004d16cacaa2252269b7e8b897cc76993db71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756182, "uuid": "1f9648aa-c000-4253-a16e-8e416c5de87e", "comment": "Malware payload (Mirai)", "value": "e26e4f630c9b801b499c8dca5ccd6f0fc4be9026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756182, "uuid": "7d6fe4c1-6ac5-4e47-9c50-515b0df6f7aa", "comment": "Malware payload (Mirai)", "value": "26bc5b3768463c95d4a6a8add6e6133f118be28d9eeee76479d80f3b815f8ce237e47f6bd272e90e131b6b8e383a8022", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756182, "uuid": "854395c1-dce0-4595-8c04-4e4f8d51d9dd", "value": "T10FB3D70F6E529F6CF36C83344BB78B3A9759279633A0C585D2ACD9005E6034D586FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756182, "uuid": "1968456d-f23f-4bed-9dc8-f34f9d8da863", "value": "1536:yg38oS3o9KeNywJWS9WSE/S9LQa0fNlF4Bh9b4uWPPdXiCKJAl7ATXljFZ:yKgo9UwbQpNlWBh9b4uoQXu7MXJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780756182, "uuid": "be3ea88f-34fb-4605-b3bb-b8ea630d1e5e", "value": 114712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780756182, "uuid": "293fad4a-254a-4842-89e6-5c4fbbbb57e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756182, "uuid": "39d425bf-739a-4b7f-ae4f-6921899a4d93", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88a7591-61de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774543, "uuid": "c369ffb3-f92d-4773-b6f4-7519b4424250", "comment": "Malware payload (Mirai)", "value": "b0035cdd1522a915df60a179c3fb7334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774543, "uuid": "2ab2955e-e784-43a5-8053-8a0360926d08", "comment": "Malware payload (Mirai)", "value": "9f8cb4edef46f106743db0f1ddd464ebc92d028634293234b8fa182760921414", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774543, "uuid": "0948484a-0af0-4e0a-9101-78d80d064688", "comment": "Malware payload (Mirai)", "value": "74f2d4a5b7ddf934acebd60c93a5718decd90e6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774543, "uuid": "0a010f55-2489-46ba-bfd1-d625773ca587", "comment": "Malware payload (Mirai)", "value": "144f8db2a9ef9c156fcca87d2c006eea6e9e666c04ae7b99c8145760cb8086d457af79d88ff6f1af224ef8f78e0fedf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774543, "uuid": "ef9703a7-2142-4f55-9617-e35bc83318f6", "value": "T18C14C60AAF650EFBECAFDD3702E9170529CC541722A93B357674D928F14A60F4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774543, "uuid": "7fb059cb-edf0-41f6-926d-36fc5bec184b", "value": "1536:kf7ubnssuByERaXzXSYD0udyJUqC0rdY4uLp97xR2itzirs8KV5yrlaRC6ZRWJh4:kjSnsiERaLSYXL9tzirgV6lolQ0Bsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774543, "uuid": "ecd1e5e7-4b7b-49bd-a779-21e320c66b67", "value": 193532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774543, "uuid": "306ce22d-d8b7-480c-84a6-9936ed7b2997", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774543, "uuid": "9fc6bc74-5931-40c5-876c-861d60028975", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9897edef-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777416, "uuid": "b597f167-5932-4be5-b056-0a85b15be549", "comment": "Malware payload (Mirai)", "value": "0efaafdca64e6ff5b08a8744cbdba72b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777416, "uuid": "5e85fcb3-fb15-4f15-8085-e74b9c000997", "comment": "Malware payload (Mirai)", "value": "a09036a91473968b68086eb196bcc50aad781b76d227e2f5eb192a421f5a8a71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777416, "uuid": "92eda22e-1e71-4811-8822-6d9f8e8fd259", "comment": "Malware payload (Mirai)", "value": "3849fb75fcc0addd6ebaf974ba5a801d1f0f286d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777416, "uuid": "2390ce88-7f2c-4739-8baa-97cb9fbc9076", "comment": "Malware payload (Mirai)", "value": "be49998a7e038a72b42d216348227de9bb4de4e1dec8d3b3684224435aa8f5bf131117a23477dfddc7fc1710eb57b98e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777416, "uuid": "bf9678ee-f5c4-40ad-8e66-a7535da6dd48", "value": "T10443F187093B2CB7C8220471F5AA5A43BB2E17B5457776B5F92A0E245DF28EF079C0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777416, "uuid": "076851ad-9caa-4fc4-8252-6fa4dd511bd9", "value": "1536:WVXqx0Z0912pAoWDEdrplZ1nelXFmmf5YOP24SVKMiLG:XyZ0P2SoWIdrplKl1mmRXFSVLiLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777416, "uuid": "090996e3-29a4-4a1d-b74f-89bd3d534beb", "value": 55336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777416, "uuid": "e0408c35-2606-4b77-970d-02046368d919", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777416, "uuid": "c15472e9-5290-427c-9089-db0ab0f3651d", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2628a3a3-613c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780704639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704639, "uuid": "9f91e063-9292-4f1d-846f-f065d642bff7", "comment": "Malware payload", "value": "3076844cb467b41b8fd7a5abadcaea5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704639, "uuid": "8a19f865-6acb-431a-b781-ab3bb115a90c", "comment": "Malware payload", "value": "a0e8901e23805bfa687f0cf34ae86b0d2dc0d4f655e039cf645778eba36b13f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704639, "uuid": "8d74581a-6874-46de-92c0-2b19f8830b01", "comment": "Malware payload", "value": "5bb5c2f5f78947085105b743c06bd946f31522f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704639, "uuid": "3ff03b93-31ce-4b84-989d-2358692d406e", "comment": "Malware payload", "value": "1244fabccd69aa201a9d63eb1e96d77e917d7321cd56d489bf7fa3bbd0addb8aadc05a9f1b244c2a83a6be88c3e0e01d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704639, "uuid": "1c4387e0-a731-4034-8793-f7fcf207455e", "value": "T1CB565A43EC9615E5C0AAE1358A629253BB717C492B3163D33F90F3796F76BD06AB9300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704639, "uuid": "2fd74632-23bb-4bdd-8245-f4847f59f1aa", "value": "49152:6Df3bJ6IaD/cOe78rQ3rKt7dCTh5EWr8LITPWr5FT3ebtkDihVz3Kiw0kImPKOKO:6DP9oSYZCTZ4LIK3+NzmIEmE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780704639, "uuid": "432232e7-24a7-4836-a99a-76fe7f97ba56", "value": 6033700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780704639, "uuid": "a0259f38-dee2-4a9f-a037-686b362034a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704639, "uuid": "4a89c793-a530-4145-a468-9713c0d5a1fa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d210da0-61a2-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780748405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748405, "uuid": "40cbe137-93a4-4666-9e3a-8b3013166a76", "comment": "Malware payload (NanoCore)", "value": "5275ff4698676d4154360ac3518a16c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748405, "uuid": "828eafc3-d4c4-4609-bff1-7dbea6484a78", "comment": "Malware payload (NanoCore)", "value": "a33948996e02190a9c902c0547fb9cea700e1dc34061e9ba389323900851857d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748405, "uuid": "6a6b127a-248f-4613-9241-b311545b1b94", "comment": "Malware payload (NanoCore)", "value": "d3fc0a6d4241ad10bb6c4098d23bea2d68b1c284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748405, "uuid": "2c5214a3-b35a-4c81-83d1-543bf776f436", "comment": "Malware payload (NanoCore)", "value": "a28ed295f1d99e4f83ce25a80977e2152070c2dff473041e44d5cc8fd959488c2e78ba2f670c722aa881a9fe3b67a432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748405, "uuid": "a17372de-c675-4c71-9ccb-10a94d2499a2", "value": "T1B114C01677A84A2FE2DE86B9A12212139378C2E7D8C3F3DE18D415B78F267E546071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748405, "uuid": "1ae23059-c041-42a7-8697-bbd43625a9ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748405, "uuid": "6f08b8b7-aa69-4e36-8c43-ac885785fe9d", "value": "6144:MLV6Bta6dtJmakIM5Ic0kTgdXi6Wv7zoE/:MLV6BtpmkLc1cXNYAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748405, "uuid": "12603ed1-52ba-4668-8667-881a2f097837", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748405, "uuid": "23de4775-a2e6-41c8-b233-e6ffabf661ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748405, "uuid": "0b863968-110d-4baa-aafe-b4e90ee3c5b3", "value": "taartendoordetijd.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290bcc3a-619d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780746305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746305, "uuid": "cf76245c-91d3-4bcb-80ac-8c3e69864986", "comment": "Malware payload (SalatStealer)", "value": "45d5a73866bfaa47e80109f5fdad67ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746305, "uuid": "0db94a79-ef4c-4e95-96e0-eb269efefc47", "comment": "Malware payload (SalatStealer)", "value": "a3dc7da7ce78f637667d1f29f27f1489f2ad12ec038f7dec7bed217f5ffac589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746305, "uuid": "faa3d590-02ae-4e86-8658-6b607849d499", "comment": "Malware payload (SalatStealer)", "value": "d31823282240e641d711280ea1516bbb1bd7b073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746305, "uuid": "1bb079e7-0cc2-408e-8346-efba4096a2a0", "comment": "Malware payload (SalatStealer)", "value": "b47681171fa8850b3549a1e81c947f61b8223199d7e3a1d69fb32b5b07ad116fff8180a183c8da52beb927bd05ed3da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746305, "uuid": "c07c6a62-b875-4f0c-8962-d5ce321152f7", "value": "T10016338527A616D7C06E4DB2893749CCA6F9C672C788CE7F344911688AE7FF54A4230F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746305, "uuid": "4404dbd0-4a2d-4916-9457-2519a64db939", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746305, "uuid": "fcd75f59-127f-4e3d-b605-722f2616efe6", "value": "98304:HFACLB4+ZD/Xb5APHV9Zv5OdXQITSysmH5pD/sq4F:lr3/LGrZv5gFSyFZtsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746305, "uuid": "5ac44754-5cba-4c0a-94d8-0e43fe9fb116", "value": 4385893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746305, "uuid": "e548237e-7b63-46f4-b57f-4294927e58ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746305, "uuid": "2dd1444e-3982-4bf3-96c8-db47129a31f0", "value": "RKNBYPASS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f771655a-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748369, "uuid": "48f0b051-f1c9-42ee-a4f3-16c3ad3c96be", "comment": "Malware payload (Snojan)", "value": "137643235c80c270d9f443b20e43a0ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748369, "uuid": "9377435d-e0e8-46c9-8751-97fe63c37b0d", "comment": "Malware payload (Snojan)", "value": "a40ee671804e172b3d3465c0b69c0a578bccde8642bb456d8fd9b41c28d461e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748369, "uuid": "033b9ef5-cbbf-410e-8c14-66c07eda0d3e", "comment": "Malware payload (Snojan)", "value": "6d95815fdd8030d9d000517626d8697f0076ed1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748369, "uuid": "e1051a77-0439-4dab-a7b1-57b12b42b292", "comment": "Malware payload (Snojan)", "value": "d8d8e7564ef95fc4f28b8ab67f70552cbf1a9d299e2d9a561e94e58174f372cf759d2a4099969188e259dd7e8ac0468f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748369, "uuid": "79615422-ea1d-424e-a677-277a6b8a60fa", "value": "T18E84F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748369, "uuid": "710e5b54-43fa-45c8-9225-a13462240069", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748369, "uuid": "2fd140d9-a28c-4533-b3c4-5d0262abefd8", "value": "6144:NrFZaaZmEJuNDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+ulh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748369, "uuid": "55818e08-d0e8-4e0a-a8ac-77b62633cbb7", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748369, "uuid": "1271db78-ed07-48bd-89eb-828af002a337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748369, "uuid": "8bf4e024-fd0e-4032-9a64-0f37eea731b1", "value": "QyIXGWuFZbHUc1hx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbe2dba-61e1-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780775575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775575, "uuid": "61f049df-192a-46e5-a48b-e8b63f32fe42", "comment": "Malware payload (RustyStealer)", "value": "ce23ab79f17889d2bcf2b8e7a1c590ae", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775575, "uuid": "bc7c1b96-3356-4664-918d-23ba3a8164c7", "comment": "Malware payload (RustyStealer)", "value": "a49e44914ab0817e0851039c1b41ab6e7022a26b9b4a083e39f2a789764124f2", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775575, "uuid": "fd222e40-d51c-422d-b761-6d229e6ff691", "comment": "Malware payload (RustyStealer)", "value": "f8b877098e97e998980a86ab288e2b98c7514002", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775575, "uuid": "f5cac622-d2ea-443e-be71-96fcf5e6e595", "comment": "Malware payload (RustyStealer)", "value": "d14bd41b31a4d76b3b4b791c452a0d86125ef723243d3787c6609079bea9d27e8b108a633cb244413e1620e3ab250c12", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775575, "uuid": "4d82719c-8cfa-4973-873e-a40b62f16984", "value": "T143D097F48505C0A3C3E6FD802110FC40241F3986ADF20CC826C8CA4880C8482CB4C6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775575, "uuid": "9f99c08f-3c9c-4588-86b5-799f4c52c2fa", "value": "6:Js1Q/QU9RYFeJ5Zbf5oeTckGhiDvCLUeJMcnXKWz4K4V:zDOFqRzU9XKy4tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780775575, "uuid": "a9f67fab-e7ef-4fbf-b558-359710448ca0", "value": 240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780775575, "uuid": "23c9f24f-e7f6-4818-a765-90f837d089e7", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775575, "uuid": "210cb523-0e7f-44df-bbfc-4d66a988969f", "value": "ReleaseSheet.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4c0fec-6174-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780728994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728994, "uuid": "740c032a-9295-4534-a184-2042e35cfa77", "comment": "Malware payload", "value": "bcd1b4f263679cae0e38f1bec6ede3c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728994, "uuid": "f11b218c-8c59-48ee-a6c2-b52a79be9d26", "comment": "Malware payload", "value": "a50dc535845c62d7db43c2f5823cb789b53fc350287eff51c638f10e8a0cc666", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728994, "uuid": "c60b769e-bb6b-4246-8537-f5d1fb14402d", "comment": "Malware payload", "value": "bf9bfdc9ce0e3cbc2e073978ae86cd940608c804", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728994, "uuid": "98d6d4b9-6f60-4fc3-80b2-b11ea31937b6", "comment": "Malware payload", "value": "82ac06f524028f5b9b5cb68511b22e9269a4db33d00a420c633d37044ba24dd0f68f8263e911bdeb193493504cfb4321", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728994, "uuid": "855fc388-c262-44a2-be3a-724859330e54", "value": "T1043172C621924DB03EE2E56B36A9494235C5F5C791DBEF996CED38E850CED48B804A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728994, "uuid": "7ca0161b-02aa-43b4-9ff0-ac83a3daad49", "value": "48:vtgtRutQtnYtMrt/dratX/st0totcttutctT:vmbuOuyr1laRU6uiuy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728994, "uuid": "db56693a-3dad-4ca9-93d1-c6e2f3691f55", "value": 1671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728994, "uuid": "bcc6a0d7-3d11-490a-b448-10865e6ba072", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728994, "uuid": "75b0e5ed-2d40-4c4b-9a65-b4102f16bc5b", "value": "Ciabins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7e63a2-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759064, "uuid": "b1c56111-917b-44bb-90b7-e90184e9d66e", "comment": "Malware payload (Mirai)", "value": "c526b3460c087358b047119e25b73e11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759064, "uuid": "a4351650-6956-4ad7-a0e1-02f1cac0b6e8", "comment": "Malware payload (Mirai)", "value": "a54dea35ca01c650d35d385bfa81f3761136cf726b15e1bf48ccd00943730742", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759064, "uuid": "3a598019-0cf8-409d-bba2-b239910fd5b5", "comment": "Malware payload (Mirai)", "value": "0c955cda48b1318b5358775e15113fac1c8fe0b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759064, "uuid": "e3d3d62a-bbc8-458e-91ec-2e447323952d", "comment": "Malware payload (Mirai)", "value": "5f2487fb18e3ab2bee485e1d2362a4a0e8e4219181ce583bdc2c0b439b7723f02ee76abb246341a2c5961d3744c6aa0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759064, "uuid": "b2337a67-2316-4946-8ce9-6dba747db2e2", "value": "T16693B81E6E218FBDF769873047B78A21A75833D627E1D685E15CD6002F6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759064, "uuid": "05eb6e6b-48b6-4731-a120-9703a48ea1ae", "value": "1536:ydfbp5v/3TfWrjWnK2oin6hvIa/8Tfejmll8Zs/FX8x:yBp5v/DyjWnIY6ua/mf88Xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759064, "uuid": "42f438e6-3d1b-41ba-9bc2-10e4f95ef163", "value": 97596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759064, "uuid": "ff44843e-5a31-40a2-a077-ea9588bb9d1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759064, "uuid": "defec7df-5665-4470-a15b-586a0d8e0116", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d70de0c-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748137, "uuid": "b9a15731-96a1-4b9c-9903-64c7c5ac1699", "comment": "Malware payload (Snojan)", "value": "9f2cdb02f9ab6628817bc4c0885d4d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748137, "uuid": "326828e9-22a8-4cd3-91cc-5355e31d4192", "comment": "Malware payload (Snojan)", "value": "a65baf6f73ef3df82a3cbff452245b6a4df741cc87d0237545f6e6e4216a1582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748137, "uuid": "0cf66194-2e23-49d5-92e9-a37c15b4307f", "comment": "Malware payload (Snojan)", "value": "3ccfb3c2595f1a4ed2ab25015238e29f55c44773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748137, "uuid": "37cd17c7-2e5c-4f74-bc22-729eacdf9e05", "comment": "Malware payload (Snojan)", "value": "85fa77e1b66c73c0de7b502954b5ab1e4543cd71874215b474996a8d52abf97a650fb2586ea9b6e86c83bddaa131de85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748137, "uuid": "809c18f8-78d9-4495-8579-75001acaac9a", "value": "T13784F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748137, "uuid": "f98e1376-74a8-4bea-a488-96655c9fc75d", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748137, "uuid": "ecbb9370-4695-4b67-95ac-aba79089d731", "value": "6144:NrFZaaZmEJuXDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uTh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748137, "uuid": "ba31cb69-a939-411d-b895-a014583b846a", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748137, "uuid": "f287c689-83ba-4725-85bf-c0f4b7a6a09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748137, "uuid": "c97a0b67-8673-4a9b-a715-1b394cb3cf4c", "value": "LuzDoKxnUZ93WWVN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566a36f5-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765708, "uuid": "5e8cc210-ecdb-4ed8-9e83-d17bf218d0d5", "comment": "Malware payload (Mirai)", "value": "21017a8d6cb36298dcf1eb7b4bfd6490", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765708, "uuid": "124e3d5c-2e52-425a-a1c8-84e9af55f2bd", "comment": "Malware payload (Mirai)", "value": "a6adbd35f72813ee6adb0d725f55c80c6e439ba89fa1527e3a09472b7a2dc538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765708, "uuid": "2d1be0b1-30d2-43b4-afca-d0b710221c33", "comment": "Malware payload (Mirai)", "value": "52e703523f374ecccb8cb879cbab16998dbdfd80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765708, "uuid": "f8945136-3c1a-4a77-8e21-333c6641327d", "comment": "Malware payload (Mirai)", "value": "1affcbb43da13d4eb2ebed58035dab5ff04f9bfeb239664e7b67176544030091d794bfade48d0ddfbc6e80eecb670569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765708, "uuid": "673b7c47-db22-4b8a-8278-4cc454403a46", "value": "T147130981BC929507C6E4137BFA6E418D332667A8E2DF32139D222F1177DA92F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765708, "uuid": "470813a6-2b16-41ce-8327-7313cce51a2d", "value": "768:TJx30eFiu90VS3NKPEl6rKn1Q1oSGilHHl7a32KiY4cSoJpPNuKdnKjHW:r0HU0VaRSGT54cja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765708, "uuid": "ed2d8743-998c-45bd-a578-32ed7cbdbbd5", "value": 44528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765708, "uuid": "7f6197b3-e9fb-4389-8ec2-aa26cb0f951b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765708, "uuid": "13e58df7-eeda-4f70-9669-ef2c996f89f6", "value": "8f4c61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103592cd-617a-11f1-a769-42010a9c0008", "comment": "Malware payload (LiquorBot)", "timestamp": 1780731231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731231, "uuid": "3af53948-17c5-41e5-8708-d88ac82471e4", "comment": "Malware payload (LiquorBot)", "value": "99564b1997e40c87ef1c20067a523a74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731231, "uuid": "1870f7ea-6c79-441e-b44f-094a26fb5c66", "comment": "Malware payload (LiquorBot)", "value": "a9e56c645aa7bb3f88c72e53b69728d15843922b2e7f074e794f5d86694d4832", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731231, "uuid": "27364aad-9f6a-4bd8-9024-9c7099decdda", "comment": "Malware payload (LiquorBot)", "value": "0f2c89cda5d027dec860127d90d82bce024bc93b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731231, "uuid": "7144102d-c02f-4726-b30e-4013f6ab62d3", "comment": "Malware payload (LiquorBot)", "value": "b6c37fdaafb89c06f71c7d6a53ad69c54731d9eb1789720f609449a3b0b4d3a86e6f06f1b21d69c64a7b263fbfe5ccc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731231, "uuid": "5f068702-a108-4f7d-923a-21b4555dc11d", "value": "T14A8533F5299FA608A679F4333C7912BC06A3B4C9CC5955C905D7322E1E9854BAC33DF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731231, "uuid": "70f79021-f753-48a2-a00e-0197eced0e61", "value": "24576:R8+sj8S4pg/asHNyzo302v0Nd3pebnSdOkuu1xWfWwG5aaOONT2ndCG4bfch:EjOg/ttRWNppNdEFHyaeBY0bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780731231, "uuid": "2307fa51-5bfa-4b41-805f-7295842748ae", "value": 1716540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780731231, "uuid": "7466bcc9-a66a-48fc-bfac-31530938e80a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731231, "uuid": "8a78cf04-0256-43f4-8085-6847b58846dc", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440dab89-614c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780711561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711561, "uuid": "fe69fea9-ccec-4954-bd9d-366c9b046467", "comment": "Malware payload (Mirai)", "value": "f4b00e75035a494db814eb1ea90a25fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711561, "uuid": "4c1827be-28c0-46ef-98a9-32483d424356", "comment": "Malware payload (Mirai)", "value": "a9ec45b4eb85233a67e56c3989c7572e4727af16b390a73ae281d3a7febeb2ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711561, "uuid": "2a9c9498-de1f-4b91-9dca-7a29b1146b32", "comment": "Malware payload (Mirai)", "value": "2abcf731a9877a0935dc60adfa56cacabde80ab3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711561, "uuid": "92a160c3-0371-401d-874f-297404e270ec", "comment": "Malware payload (Mirai)", "value": "b6f8f69626c78bdd8b9ce00913b88b40d12d8c2d40694ff8b732603647073fbe4f2e712de679c0337519291dee49c01b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711561, "uuid": "9519a510-102a-4cb2-8311-19788116e862", "value": "T1D204A81E6E228F7DF669873447B78D21975C23DA27E1D645E1ACC2102E6038E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711561, "uuid": "6ad8fe68-282c-4fc9-a400-0daa5e7f1ee2", "value": "1536:bmI1m6RoxeJUJ/qzrZvwzIk5ia1+BvYlaVg+xe3x5EWX1NFJyITmmHe/raVD2ObZ:bmbNYpoxwBvOaV5xe3x5R1sMEaVyObZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780711561, "uuid": "1a257310-91dc-4168-a911-c614ae6413b2", "value": 185644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780711561, "uuid": "d1f917b0-b0e8-441f-a397-3b019a73918f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711561, "uuid": "9f964136-f3c3-4959-89d5-cc2d18300b2b", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdd0a5d-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759067, "uuid": "60f9007b-da8d-4b1a-b9dd-f403cc051c31", "comment": "Malware payload (Mirai)", "value": "739e6d4f28789440c457a903bbae30cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759067, "uuid": "beab5b2d-90f3-4252-aa41-16f8ba8ea825", "comment": "Malware payload (Mirai)", "value": "aae409e4581181da21ff16c3a5d37f3174e452efdc931d24b7c7d6e1c8fa8e8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759067, "uuid": "77ee7289-408e-4eb9-8be8-f6b110fb5d77", "comment": "Malware payload (Mirai)", "value": "89a64a0e2da2ee8ed1a76176b715ea2e25b1d163", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759067, "uuid": "231969b0-13b2-4396-ad1d-71572dda03a3", "comment": "Malware payload (Mirai)", "value": "7a1963989a6ee341ee377d03328ea4cc51e55653e635f43809e93fda39e2c8144ee815ae016996bfb1ede95bced4447f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759067, "uuid": "da515c1f-0a40-402e-ae07-07324366ec2c", "value": "T195535AC5AA43D8FAEE6601741137E7334636F135112DDB8BC7A5ED26BC52A00EA2739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759067, "uuid": "1879ff38-efd5-4cf3-905b-9bacb2d46350", "value": "1536:ytcEzxcHerF8r3Q+w5InyFJ+mx1kHtRHVsovX1UYSgkzSzKSAXbY:ytcWseJ8rdw+yn+dRqo/1p/kJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759067, "uuid": "a92394b8-1b5a-467d-b6cc-71a5caa395e8", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759067, "uuid": "ed3ec150-f0e5-4f67-9029-5785b92b4589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759067, "uuid": "b8b10ab0-7f53-4f55-b60e-93973ba4f60c", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c3f115-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771349, "uuid": "f88f27c5-5e1f-48cb-939e-42ffd62e9302", "comment": "Malware payload", "value": "1b71908034e2fab2ee739b5d5ef1f2a4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771349, "uuid": "3b30c591-1c60-4431-bc55-2343ea9b4ece", "comment": "Malware payload", "value": "aae58fb492353c35720ea76c794965009973188025d539767e7550566eb3f195", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771349, "uuid": "04f1a995-fbb1-49a5-a106-d3c85f224f36", "comment": "Malware payload", "value": "89b299beedee6ab62d969b8a3c45885f4bae57ab", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771349, "uuid": "cec69686-8191-461c-8aef-50ba83160b02", "comment": "Malware payload", "value": "aebbaeb94ecbc4474e0dcaf241803fab30babc9d9212d76be76d89323876a056282f4dbb94b6440af84eeb38a9a4542f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771349, "uuid": "a40a55dc-a357-4009-813f-07eeeebc7218", "value": "T1ABF19E409CDCAE05DA68E86FC0C35DC599027F58C8005E256A2FB0A5ED90ACB6578EEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771349, "uuid": "624f3f71-d2ec-4987-8a40-f16290c905a5", "value": "192:4cpH10vfMkoHr6zo1zQtl9vd31QXYIxnHBr9lX:3YfT0bzQtN31g9lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771349, "uuid": "a3037ad7-f172-458d-a184-66bd172542d2", "value": 7469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771349, "uuid": "d1f7fa83-ab1a-4c45-ba21-97b8820bb0ee", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771349, "uuid": "c95897ca-0df2-4cec-8140-3d5bef08d034", "value": "Swift_00023140k$.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86386281-61f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780785545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780785545, "uuid": "6d2e6c93-01bf-44da-b10d-358d07fd1813", "comment": "Malware payload", "value": "a6fcb2dbb30d73676796307bb1b124cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780785545, "uuid": "4379260a-81e2-410f-bc2e-976027d0bd20", "comment": "Malware payload", "value": "ab2b0b2ec162c2ada4c92db0345fbdf0f2e1df189c299e5b668b0ba850bd68fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780785545, "uuid": "cba7c71a-ee00-4474-89ef-3fbd311da9e6", "comment": "Malware payload", "value": "65900e1dfa54a6d49e5085196845257585cbcc48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780785545, "uuid": "c7b00bc2-4d00-41b4-a932-44d250990baa", "comment": "Malware payload", "value": "8aebd56996a3a749d75782c6950c4f8011cf42f8fb477c87cf30e96bd89c1de320fd1c98db8b0d05165ed35c1c3c9980", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780785545, "uuid": "ac384f90-e408-47bc-9cba-962a35db3a62", "value": "T11247DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780785545, "uuid": "73c6c82f-79c2-4b43-8264-c5a5a29606a3", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ1:cqYUQuVDt0TZEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780785545, "uuid": "a6ef1bab-d375-4fc2-89c6-7a8113224853", "value": 26017792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780785545, "uuid": "3b39400f-d4a1-4782-9f16-b2ba5c20b176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780785545, "uuid": "e835fe13-80ce-4439-8392-b63b93ea173c", "value": "ab2b0b2ec162c2ada4c92db0345fbdf0f2e1df189c299e5b668b0ba850bd68fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54c58a9-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777544, "uuid": "dbec70e5-27ff-46e1-987c-6df0269028d1", "comment": "Malware payload (Mirai)", "value": "d6695b397d77e344c4edea993cbd54c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777544, "uuid": "a1df3901-90f0-43c8-b117-883699536ed7", "comment": "Malware payload (Mirai)", "value": "abebafb19ec80a6001f007f69e99754e6a1e96ded74e8609d0f431e1c4e382a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777544, "uuid": "028a6081-de76-41ee-bd4a-4d2691dd0b22", "comment": "Malware payload (Mirai)", "value": "820fab2f2b8c28436c7339a6e075b223d225552a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777544, "uuid": "fcfde739-ca8f-4c2a-a073-2d72e41cb58e", "comment": "Malware payload (Mirai)", "value": "3a25e4af8aabba3d041df3c62a38882671df0a15e91f4ce3ef3f64c86de0b0b3e02a0bbc69a63e8feb57fe61b91ffe6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777544, "uuid": "655bb620-54c1-47de-9744-81f6f01faf4b", "value": "T144333B12517C2F06D1E0B53B127B875172E52E1E26549B8EBEB70E8FFF31690582B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777544, "uuid": "bcdbacaf-db9b-448e-ab82-efde0d803bd0", "value": "1536:+q+h3yABjIXngWbNjejAXkZR3ckij71rqW:+qS3XJIuz3c97cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777544, "uuid": "1a7803c8-db03-4ae7-a892-566402a5191c", "value": 54888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777544, "uuid": "e333eb86-d3ea-4fe0-9860-b8980c02cbe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777544, "uuid": "dedb4205-b88b-42c8-bf2b-ed9f33b668c7", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a0644e-61df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780774865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774865, "uuid": "91dd39d9-4889-4a6f-8745-1f8d23c31ae3", "comment": "Malware payload", "value": "af6ad00a59545497b8ba0d91ddb0a6af", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774865, "uuid": "a8f37b77-017f-450d-a308-981c8b91d061", "comment": "Malware payload", "value": "ac2248d66cadf6597f428cde47f98c1adbb382da0473cceca632dec08ecf3e06", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774865, "uuid": "3a4d51e2-02a3-405b-9645-44bb61f59e87", "comment": "Malware payload", "value": "7303311489d63ee8f0335077ecd72cfd0e5ce1b0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774865, "uuid": "93f0538a-c52e-41c9-9ea0-5a6967a9f960", "comment": "Malware payload", "value": "7d20f898a0fb9523910952537fffe2d37116f290d39d9da67fdeb4a12f40af67f618784e56215272a0d6e4a126495c54", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774865, "uuid": "9aea59ff-a78c-4362-8e74-4d06b5ba200d", "value": "T1A005D66DCC54012EE136D919C5A6049FF8A3260B233CE91B10CE775BAF63886B79739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774865, "uuid": "0210f699-ce05-4083-a0a2-4e110b35e004", "value": "3072:o/cpbVIXTMKcSgLxlQLXtbsGc/sC02mTbh2H14+HdDJHONW/3zWbpjFPjE8yqXXw:Zum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774865, "uuid": "29762557-6f54-484d-913f-cf0194645c6d", "value": 822448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774865, "uuid": "b893faa8-6929-4208-a4ec-28529e9a308e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774865, "uuid": "89b4b2aa-cee6-4862-a126-31736cb26e14", "value": "Urgent Request for Quote-73654323456787652345678-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4309bc30-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748066, "uuid": "1f601d23-8193-4f2b-a7d9-e19a509e10d5", "comment": "Malware payload (Snojan)", "value": "8d3de4ba277e6e34573bd3ad9736c004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748066, "uuid": "7c5bb465-aa4e-4cad-ab56-ce7c2868cf4a", "comment": "Malware payload (Snojan)", "value": "acd164069396af2fc203b9743c8b88a9a051c145fad34b3b801faa73fa63de7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748066, "uuid": "667b813a-e0b4-4cf4-8bc0-28c41c5a8dcd", "comment": "Malware payload (Snojan)", "value": "cb3e55a0e8cb3dc04ae37dc0fd71e9d5bdadd10b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748066, "uuid": "808d692a-fe4b-4ab5-8cae-5e27f8ba3abb", "comment": "Malware payload (Snojan)", "value": "8aabe89e788dcc21cab45b6f919c768974871f3cb3eadc97479800a9fdc50f905015fb4612f944739c785c25617c1a0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748066, "uuid": "f141ff02-ba9f-46c8-bd2b-fc2e59a83dd0", "value": "T12484F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748066, "uuid": "f35813d1-8e9d-4742-a959-d2ccd269039a", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748066, "uuid": "564c8acc-a283-462b-94a0-128b9d3a35d7", "value": "6144:NrFZaaZmEJujDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+u3h1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748066, "uuid": "49d74f73-f47b-47a4-b59f-efe8cb683852", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748066, "uuid": "725a4232-22b8-428e-b1e9-70ef40d653f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748066, "uuid": "1b7ec8ab-eb15-4f51-86ba-350606d0e0d6", "value": "7liEJeg4lNd4qr0i.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a23422b-6158-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780716698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716698, "uuid": "e0216fb2-1073-482b-917c-79fa37747b1a", "comment": "Malware payload (Mirai)", "value": "7ba56cc8437668cf335af4750138638d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716698, "uuid": "e37df8a6-9ef4-4bf2-a01b-d254892cbbca", "comment": "Malware payload (Mirai)", "value": "ad3e9a2c51942695630bb47fc6fe09beefc74276c2fd24c3d166292916a036ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716698, "uuid": "283a856e-4ef8-4185-9097-5a599f4e33f6", "comment": "Malware payload (Mirai)", "value": "62b3dc69fbccc116e29a140079487cb28da07c8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780716698, "uuid": "b3c1c8d6-3c94-4aa8-87ae-3b4e0c0506ce", "comment": "Malware payload (Mirai)", "value": "a7c95c37b2a224106dc99893be726f2f49b772fdd44e5dde202bdf0da8f68f1c55f624e6007ec357b1189b0148aba44c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780716698, "uuid": "b67b6d93-464d-48b5-b5f0-0e0cfa7b763d", "value": "T1E56618136B59EB0FC62822341DB2DB9467691C5941D7A127B386F31CE9F20AC4DAEDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780716698, "uuid": "62f74749-ea30-49eb-8307-941b8d845cb8", "value": "49152:ObPbAG31/Q3H9axTgVNG+kudnNqRyLHr1e1xTTcbEuitudCf+tRmdlHHEt5Ev:pVW1YEvWRmdlnEjEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780716698, "uuid": "f38a27ee-8752-451b-af3a-c60c5f515fcc", "value": 6881495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780716698, "uuid": "1e14c012-9398-43ec-bde7-7ad400b4d198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780716698, "uuid": "8f77d070-8b01-4ad8-9adf-cb72c747b8e0", "value": "SecuriteInfo.com.ELF.Agent-BQZ.73916246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166f110a-61df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774620, "uuid": "edaff7f8-6d36-45ea-b653-1a1e562b7f79", "comment": "Malware payload (Mirai)", "value": "c0e90dd3d4d0520cfca845008f6b99ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774620, "uuid": "fb44e304-5951-49de-a4ed-cefabdca6e55", "comment": "Malware payload (Mirai)", "value": "ad4b2408d8acec0eaaf256bf05c43e6d50819d507b4a90be0cf98a06ac8a7d3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774620, "uuid": "20be2b1c-bffb-4398-90d4-c4f83d0a6006", "comment": "Malware payload (Mirai)", "value": "f074c938c6f305c681946d2e4ec913fdee535343", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774620, "uuid": "5bf4164d-17a9-4331-a164-f49610e3393f", "comment": "Malware payload (Mirai)", "value": "3bacd7cdff64fd6536c2dc63cc866a366c75f071a4b1394e6c20abf345c4013090b6b048891966c8fabdc5642c744dbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774620, "uuid": "dc01a3be-d919-4469-882b-d215216fcf33", "value": "T136B3198ABC818B11D5D625FAFE0E518D33134BB8E3FA7113CE145B2A678AC5B0E37615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774620, "uuid": "b0f8b0fe-c4db-4eec-b461-cac98fa08db0", "value": "3072:3lRRAH644tHJoSEB44kFzGR0IDx7GVj5Ep6onjNRRDO5zP5:4aoXAFz3k4lEp6onxRRDQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774620, "uuid": "d299854d-701a-4834-9bb0-3ff72ca1271a", "value": 112804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774620, "uuid": "74e0219d-3900-4a1d-940c-0a566ee26d10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774620, "uuid": "7c5f25f2-858b-4c10-8373-9306a0f9d28b", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93824584-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747342, "uuid": "32329379-f450-4705-95bd-3e1dc5d3299d", "comment": "Malware payload (Snojan)", "value": "caed7707fa318902fbe1cf46714671ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747342, "uuid": "f83a6abd-cc4c-47c4-ab0f-1885a59380b4", "comment": "Malware payload (Snojan)", "value": "ad4fc5956fac6cda4f297f4b2c381179862c43d24131edd1736beee9f02a77ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747342, "uuid": "93c5ff80-a921-4388-98bc-ab5c57281a78", "comment": "Malware payload (Snojan)", "value": "dcfc7a0660e127f4f5ba7309d46c971b92a5c1e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747342, "uuid": "36836cc5-2ae2-422f-8b12-6586aedb4ec7", "comment": "Malware payload (Snojan)", "value": "f333610478252da23376f465274118170ecddb06756a40bd5e8b1ab7d5808d34218601d171442cc6bbe25a374f512f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747342, "uuid": "175a1d90-c4d7-48b8-9104-7e5875d27371", "value": "T1E7F3021646DB58F7E49B12BD469DD063B2FBA06F4BCE3EDBE1FC224DD6062B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747342, "uuid": "a4e40b48-7b1f-4cec-aacc-cb4a3845e863", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747342, "uuid": "c4dd27aa-2547-4d5e-bf35-73fdf8d07e97", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+pK:QJ0TAz6Mte4A+aaZx8EnCGVup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747342, "uuid": "e05e6c13-a216-4006-81df-fc43d82d9474", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747342, "uuid": "b7ca34ee-dde0-4840-ad54-9165b8e9bed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747342, "uuid": "5490176b-4eaf-48db-98a5-d1052b5d117f", "value": "MkF2CQLLipTE4T3v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539804ae-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765703, "uuid": "1f681306-7a2e-4aa4-913d-f1b9911e7fc2", "comment": "Malware payload (Mirai)", "value": "1c6dc286f66b5d50576f4091a94b0562", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765703, "uuid": "8e2b3c46-d762-4da2-b247-99e49681039f", "comment": "Malware payload (Mirai)", "value": "ad9f4e2c0ab954083fd8f92ca9b4e819ba2ea6c096fdd47e912ea6066592e724", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765703, "uuid": "ad2fc904-fe53-4cc5-a8b7-d379efce1a72", "comment": "Malware payload (Mirai)", "value": "785e057766e0b7f38478112f9564b62482130197", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765703, "uuid": "aaefa7a8-08dd-4146-90b0-1b42eee5b1e5", "comment": "Malware payload (Mirai)", "value": "8765918aca43556bc63f19edc061f729397f7b5cb9f18b1d9d9d6eadacde0f403e39bb1cacea73d8e7bba1e80f8f4324", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765703, "uuid": "6df3abde-698e-4fc6-869f-92198d7b946b", "value": "T1FD3196AF0B19369C0801ED76B3A12198E4B5DAEE214FD760FF595CBEF1C80483255F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765703, "uuid": "7bf61866-aa57-4b0f-80f1-7c45f7534750", "value": "12:5GxrG2223cGmr1fMWPGTHrPGTtKBlyrV4xr4oY+YYDrHHC3sracinriuyEoHCzoX:0E25ifMR6ZTuiz0ylGPoPVi9tQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765703, "uuid": "62209c60-2947-421f-ac40-49dbe7df6130", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765703, "uuid": "8eff9494-5076-4589-8285-15db0fe12c90", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765703, "uuid": "67d6b18a-0f61-46c6-98cb-2f5f67b42faf", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abd4b31-619a-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1780745153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745153, "uuid": "c56eed06-871f-42d3-8318-1a10aaa9d143", "comment": "Malware payload (Cobalt Strike)", "value": "d27c139836642039a2ce952af89a9439", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745153, "uuid": "92fa82e7-ac74-4a30-ad36-b436b45bc5e5", "comment": "Malware payload (Cobalt Strike)", "value": "aff0b73277e0f8265089b2942a2c6bd20be660165ad374b87d1eefe67e469d88", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745153, "uuid": "e84e3604-b369-40e3-8be3-0114c817a541", "comment": "Malware payload (Cobalt Strike)", "value": "eba9c913125667de61d849d056ae0572597847f4", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780745153, "uuid": "cd20b3fd-60ab-4345-9d27-951aaebbbc58", "comment": "Malware payload (Cobalt Strike)", "value": "8b0fb3c7f70ea8a261f084b42e0fd10b707c372ab0737ec105375e40d3d06bacbcedcb07be69f6fce93be85e4dabf743", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745153, "uuid": "21611b67-f8af-43d4-8842-c8646746e69c", "value": "T1D4D4F119BAA514F5E267863BCC561906E773BC4247A0778F13900BD2DF275E0AD3EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745153, "uuid": "a89269fa-fc53-4b51-aba5-46df3db79f7f", "value": "5d5883350726c4ac1025d4dc0a51a52f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745153, "uuid": "e66c27ee-3e2c-4c2a-a367-ddaa0687b47c", "value": "12288:I02gwFcey6F9Zqt6M4ed1nscXMiOsh8+UNsJaWIKGS2:I0fwaOVrMXlbcijZUCJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780745153, "uuid": "1eddac41-d15f-40dd-b3db-ca0b78473000", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780745153, "uuid": "7fcc0ec0-ebbb-4d41-a36f-6b1798ac01af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780745153, "uuid": "a2a12081-217e-483c-8be5-3df4a6cf9c0a", "value": "McrosoftUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67200eab-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771320, "uuid": "3fd31b93-79e0-4678-92a6-27bde8925ad5", "comment": "Malware payload", "value": "470edcbb833b511e16ff2393732e52a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771320, "uuid": "5d47c47f-b225-4883-9cfb-cad4d74ea62c", "comment": "Malware payload", "value": "b06229a08186c9014147693c0fd4188b82a378c8e3e75b62d25fdb21a037e2af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771320, "uuid": "fa38c44e-8d6a-47bb-b48a-a83a93b813d4", "comment": "Malware payload", "value": "3a1a6bfa5018b5c80dd57ff1f40e43931c0bec59", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771320, "uuid": "e7e074f6-053f-4eaf-b7b4-a67f51b9e3c6", "comment": "Malware payload", "value": "a518d2cb4f6eb9bbccf7f7d61d48fe00d66f09931f2c35b1e67ae21faa8b888189a8493ca5ea9f01057fb8206c31ffb5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771320, "uuid": "062b8bf9-437e-4b0d-a5ea-7d82761579b0", "value": "T1F805D93DD824423EE172C618C599481FF8A1698B522CEE5720C2275F6EA384777D37AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771320, "uuid": "ab1c0738-bb5c-411e-9bd2-cab5066c3673", "value": "3072:ZPSpueK/l8f4x3ykn829DbgtWsD6f2h+RqCKuAL8yAAyQrkqS0cLJYfQnEM+HdLq:Iuh98fEn829X7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771320, "uuid": "fc895a25-2a80-426d-a40d-6c0813189a01", "value": 835482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771320, "uuid": "f4614fc4-5b15-4b7d-9750-8808a38dfce9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771320, "uuid": "35a0cc35-4638-4723-a836-e7ee01f77e95", "value": "Order_03827452.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9462caa-61e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780775430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775430, "uuid": "d7ea16b4-32ed-4e51-90b2-4cbe53d7caf5", "comment": "Malware payload (Mirai)", "value": "68c6b2dc5c808be29de6277dfc5c8a8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775430, "uuid": "814f697b-12af-4d3a-af20-4549837142a8", "comment": "Malware payload (Mirai)", "value": "b08fcd6a81aa18c2616c58c61612d8e82e701df22b379729d5af5a048c7ad133", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775430, "uuid": "6349d713-d66b-49a3-98c9-3a1c1a35e195", "comment": "Malware payload (Mirai)", "value": "3a38f2a3ac6935f4f9a702b6771669b2c56e683c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775430, "uuid": "01876517-8831-48cb-a839-dfae7613b4b2", "comment": "Malware payload (Mirai)", "value": "b2559edea769f4888a3bb032bcb12ee60bfc392b634bbf8a04a06913879bd52b87fe08277937833725aec169353c1b74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775430, "uuid": "bbd187e4-a470-4948-95f7-e18722e567b4", "value": "T1D86302661914379CE9A5B97FCF81FCB74133143F526F850717C4A1ACA6E02A5C25A83F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775430, "uuid": "508dc157-875b-40d0-88f6-81892ece6c63", "value": "1536:6G8PRHM57Ca1oTuRrubHtt56G0JcGB5MDSLB3Kl+ThCJbZh93xVctBMuQrrX:UHM5fWuRiHUbMWYJbpxWAJrrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780775430, "uuid": "7fbdcb2a-7e67-4390-a52b-7e208d893351", "value": 71460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780775430, "uuid": "98ccb461-3042-4035-8ee3-c13468973bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775430, "uuid": "f6506830-2816-4568-a945-9883aae5e476", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c22282-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748076, "uuid": "a28a6f72-c020-4326-9624-18671eed9d77", "comment": "Malware payload (Snojan)", "value": "c708f3b12b9770a8c503ba4ef2f6215e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748076, "uuid": "25e72130-6ede-48a5-b4a2-9b3987e79223", "comment": "Malware payload (Snojan)", "value": "b0ac39fa33187205cca6334c3ee607c776d7527de18f3f1e19b6e77e9038260f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748076, "uuid": "c1db33a3-5b7c-45bb-b407-80806443ba3c", "comment": "Malware payload (Snojan)", "value": "25193faf00237684630b246c73518aca9d48c5de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748076, "uuid": "1afe4b89-4f55-4489-8ba6-cdebbeb15944", "comment": "Malware payload (Snojan)", "value": "3e282832da583b3c3319e103c2d1d5b399365a9267979e2c02c5e01fadf81bcc60aa39130b813db53cf9dc3bb25b8b5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748076, "uuid": "c7cb1f2a-4cd9-4535-80a6-374e2f543fed", "value": "T13384F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748076, "uuid": "55fd3dcf-5141-43ce-9932-0513123bc2f9", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748076, "uuid": "80cdf3c1-c6a3-4aab-8cf4-876e858bc2a6", "value": "6144:NrFZaaZmEJuQDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+u2h1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748076, "uuid": "103d5f1a-ab85-46b1-85a2-301708c04342", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748076, "uuid": "7713c9e9-9d6c-4e10-8890-29ca73ad0155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748076, "uuid": "a4c45117-0590-4e4f-b4b4-44287a5a10bb", "value": "774croz7vhT9yfDa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbc70ab-6175-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780729186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729186, "uuid": "7ba95699-5d71-4a00-a65a-f4727636fd51", "comment": "Malware payload", "value": "d09753f1fa47d14e5a7d7c6f03a91eae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729186, "uuid": "33eb6a0d-4498-452f-881d-e8bfe81717be", "comment": "Malware payload", "value": "b163044e213b9b1a6407023c2eee354f69a3f54f2ceac66891cf5e3f4482497b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729186, "uuid": "d52e6aeb-4421-4bfd-90f9-1c67be7f04be", "comment": "Malware payload", "value": "9be81fdd085cd63f861f74bfb41e8ca783e52c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729186, "uuid": "517b7a18-5fd5-4782-955b-4d6e4c41919d", "comment": "Malware payload", "value": "e3946f05f3522162d27cedffa5d3faffc5ef69fbba64253ac4bcbc7002794c7b12266aeb9a47b5c7a4d215240393bfe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729186, "uuid": "14bd2de7-926f-416a-a1ee-1f6ce24b2711", "value": "T12232F8CAB3A0E0E8D09ECA78E79F5423879634911B156EFF21EA85501FC3A30767C586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729186, "uuid": "9bffb333-9849-423d-a6cd-070024deb802", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729186, "uuid": "82e0871e-adf9-4adb-b3d8-733b7f431fd9", "value": "192:gx74Z+eQlyCqhy1d+rwnT2okFhfJHbTuMAN7YQAopBCwoD/gBxL0G:tZ+lyCqEj+rw3EJHbCM+sQuwunG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729186, "uuid": "bb4b1e0f-7c3f-4a14-8f02-3f4e5c2bedff", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729186, "uuid": "0d784eb5-bbcf-4d5e-8411-6b53129b3896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729186, "uuid": "4b141fa0-db06-487f-98a7-7eae56b845d0", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c6b8a5-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746761, "uuid": "d1680434-20eb-4e36-a1c8-7221deaf6711", "comment": "Malware payload (Snojan)", "value": "e85f29a23afcf448dee7409ecd8f90fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746761, "uuid": "2eb17f33-33ec-49d2-b6df-148ccbbb422b", "comment": "Malware payload (Snojan)", "value": "b180f642f9b2911b84640439941005ba3f052edf956cb880f7265d2e5ef7d4b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746761, "uuid": "ed252de8-f5d8-4286-b8c1-864b44b865a0", "comment": "Malware payload (Snojan)", "value": "a8cb26364f611c30bf6039497c102986a78961fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746761, "uuid": "d57e04a8-d307-421c-a4df-809da7b8dc9a", "comment": "Malware payload (Snojan)", "value": "64699134d96a8f6bb96b99919f27c680ae3f81554db6e3c40494d3f01323311c0387b689ec644631cad79d3a12ebd12f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746761, "uuid": "f8e32023-8355-457e-821e-d84ebac1aeff", "value": "T13915222471C0C4B7D46B413544C9CA72AA76707247BE99DBBBED63B9AF203E163342C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746761, "uuid": "e7589e31-203b-4e09-a210-d63a0bc7a029", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746761, "uuid": "504da6ed-62e8-4d55-95e1-c024c1fec0a7", "value": "24576:/Y+rk70Trc18BSnLW2CRBKViu99LK1Rad6yZcTx:JkQTAKYS/v6h3+1uhZcTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746761, "uuid": "5143a262-ae23-4a1a-af40-e42cb4641f49", "value": 923104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746761, "uuid": "e2792095-cf82-45be-bf80-a9e3691f54f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746761, "uuid": "a5e2e450-ba77-42c8-b8d4-1f604851d85e", "value": "NMl3TmqqQnvnOPct.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20565de4-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746720, "uuid": "d3bfd6f1-3e47-4ee8-b681-f469e0c6a17b", "comment": "Malware payload (Snojan)", "value": "cf63aca7eb3e1d3d0bba3132afac94ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746720, "uuid": "dba04a68-085e-44d1-a31c-e7ad89847d9e", "comment": "Malware payload (Snojan)", "value": "b2180e132b0ea371bcdf89dbaa348ffc2a6e4895df8dbb5cd147828bdec3d034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746720, "uuid": "a5299372-f816-4040-94a6-f37aa9057cef", "comment": "Malware payload (Snojan)", "value": "ec608b7342234fffae837f1aaeb93498cd64a53c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746720, "uuid": "3b84cc78-e88e-4c71-b7b2-398263a68f16", "comment": "Malware payload (Snojan)", "value": "5ecfcaaa4f76eb3e52989f6aa8fcc016431a2d78988f4151c8649491b9bc8ff5e8802972985ef17d11847a9bcbeac680", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746720, "uuid": "8d6a22f1-2af0-412e-bd9b-1301582bdd24", "value": "T16E15222471C0C4B7D46B413544C9CA72AA76707247BE99DBBBED63B9AF203E163342C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746720, "uuid": "d4104980-11ec-4ec4-a0e3-6e788f6db88c", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746720, "uuid": "cb5f2917-1bd6-459a-9bbb-ad40cbeae4a5", "value": "24576:/Y+ek70Trc18BSnLW2CRBKViu99LK1Rad6yZcTx:0kQTAKYS/v6h3+1uhZcTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746720, "uuid": "5532e5ad-a69f-418e-abe5-57c89e0753c4", "value": 923104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746720, "uuid": "d8730558-a761-4ff1-a61b-6347522de1e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746720, "uuid": "21e192a3-3867-41eb-acef-8f75ee86c2d1", "value": "gDh2gBzhwOYte10i.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a842dffc-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747377, "uuid": "493e17a7-ddcc-4497-90be-9b1dd3ebfafb", "comment": "Malware payload (Snojan)", "value": "81e93c9b375ca53fbd596d35a74eef16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747377, "uuid": "f25b94ec-1d15-4471-97eb-f303c62bd329", "comment": "Malware payload (Snojan)", "value": "b23ff1e1a27136bb206b5d02df19d5fbd2fb8a2fc4f52b775fe5a5a64e5ce706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747377, "uuid": "330eb380-4d48-4543-b3f1-b022e5abe78e", "comment": "Malware payload (Snojan)", "value": "a8950a55cf6a5ea444216ab8dd21ab780fe1b657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747377, "uuid": "6d71f219-21e1-4dce-98ac-6ab4dee2e40c", "comment": "Malware payload (Snojan)", "value": "7544673db4fb1f98f47a666ecc3f650b37ef7cbda8b6f25ac01f393e594c21f97b294c88746c25639f20e2122c4eeb7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747377, "uuid": "a508d2fd-49e4-46f6-a54a-a9f00e5e3228", "value": "T182F3021646DB58F7E49B12BD469D9063B2FBA06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747377, "uuid": "22367732-8869-46ac-9faa-495f9a9d8db8", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747377, "uuid": "39e71c18-098e-4c7e-915e-a928d2e979c8", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+WK:QJ0TAz6Mte4A+aaZx8EnCGVuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747377, "uuid": "5bf736c5-bb3d-4d26-9597-33a3ea116f27", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747377, "uuid": "862bab32-47ba-4773-836d-33e21f53ae92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747377, "uuid": "df4c744a-7853-4bf5-9ccf-3431255d6b5a", "value": "ymwXYwLth4CPMaOR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7dae481-6174-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780728989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728989, "uuid": "c31eb345-a8a9-4acd-bca7-5161f1599bd5", "comment": "Malware payload", "value": "0dc5623bf68931412ee2fd3c6f23a4fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728989, "uuid": "26d9a1a4-e78c-47cc-9a7b-cf97325298e8", "comment": "Malware payload", "value": "b2aa3c4fc1b9cbc162da1446e25344ef86d8681c42395392244ca2249a2b3b39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728989, "uuid": "d4cedd32-e688-45ca-8ea7-19431f689f2c", "comment": "Malware payload", "value": "c2550e480ab923f44ca66bb581c117e9a3749c1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728989, "uuid": "f6df1453-edc5-4231-bb26-7dfeb8dd057c", "comment": "Malware payload", "value": "0ee7c2ddde298260a219c669a9bb552a53ff5ad8ed8fa2ce149202de7dd3f1cfef70f7fa9efd179aa32f2f3a7cac815f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728989, "uuid": "16d6fb71-b2d6-4890-b531-d41617f0cdd3", "value": "T18903F19C52F335F5C9FD46FC09CA57B26610B5A3730A4F8CAB819E204799C87A8854FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728989, "uuid": "2d759695-462e-450d-878a-ea86aabc12a6", "value": "768:FEC4ve2zgUUVRur7UXUMpulYe5JRIXF1dgwsTByMP0tN/hlV+WR/Q:FEC4vVEUU+Qw6sRIXF1BChPYNplfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728989, "uuid": "8bc470de-f20f-449f-a35a-06b36903cfe8", "value": 41376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728989, "uuid": "1db22704-ea39-4265-bd87-58f6ee07d7f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728989, "uuid": "284d0268-6f30-4106-8606-6ab3c4541f10", "value": "MIPSEL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5deac32-6180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780734166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734166, "uuid": "cc036feb-c7d7-480c-9c2e-ac4e46cc613b", "comment": "Malware payload", "value": "d667354d8ba290edcfd38944fe48d609", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734166, "uuid": "07e39e0b-3340-40ba-9624-25086e4173f6", "comment": "Malware payload", "value": "b4319e1f1a4d54ded5987284c427034d85d73fa347393e65ed8f372794171cbb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734166, "uuid": "ad1caecc-b66b-4601-bb54-871b975c1fba", "comment": "Malware payload", "value": "2cadc50ea47f278fa1155a94d7a666eda2c66b01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734166, "uuid": "f75f261a-718f-4543-9aa4-2f7a14590f3a", "comment": "Malware payload", "value": "ded98a441a3b972a80e409a30a4c86a098c7d4812db9a7c5c482f290f3ea3dbfd18c989deaaf4989b132d2e1226e1582", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734166, "uuid": "45ef1264-00d6-4ea3-9e22-773e985687f7", "value": "T1FBD2DF34C4D82FBDEEAA2A1C06FA6620D7D68B1E9498860637077D9B4F37C80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734166, "uuid": "200c329e-f006-4b78-be8e-c0ad01a35b37", "value": "768:HumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Hu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780734166, "uuid": "ef7f1ab8-9ac8-4c3d-a965-a81e5daa03e0", "value": 28662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780734166, "uuid": "84e31f83-0a06-43fc-8776-1678d81faf28", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734166, "uuid": "9a6be2e4-0945-4fe8-8b9d-892298818221", "value": "23.94.110.24_1780734103517723_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1921206-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729381, "uuid": "a8fcdd50-7485-47fc-aa9c-2c64287bdd77", "comment": "Malware payload (Mirai)", "value": "3f39fe6997bf3248969771fb3ba62777", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729381, "uuid": "4f5bd510-7445-4301-84c4-a7ce723fb97c", "comment": "Malware payload (Mirai)", "value": "b4f8ef7705d2709ec3fede27b70715ca85a96f58b6b4001b83191e35e5079727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729381, "uuid": "96317509-938c-4a80-b15e-09b7bcd150cf", "comment": "Malware payload (Mirai)", "value": "fbf1ba1831cc8cc21007eb35f1d2b559b9ff16c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729381, "uuid": "87ddcb19-7b06-4dd3-80b9-3fe39558bd7b", "comment": "Malware payload (Mirai)", "value": "ee50e91e69cb01f9f00508d0ce49539523906c562661f73d94853a3712389bbb146ae0133249bc2e072479ded48216c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729381, "uuid": "45afb5f3-bbfc-483c-a9d9-db01afaf1204", "value": "T1ECE45B02EF441FEBC4AFCD30852E835B19ED9D8712D5B678A1BC8D5CB68D2695BC3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729381, "uuid": "71ea8149-387d-4db4-a7a7-fc28731a0b51", "value": "12288:2X9Xn19Z9voyOIr1rHFXOyx55xceOcLf8NGctVMLZOJx/F1/1zraq5smzf6PxhdS:Vtu0fcrDqtfnBGRy7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729381, "uuid": "080e2f39-b9d9-4aee-8e7d-4f1bc2fb33ef", "value": 717692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729381, "uuid": "374a649e-6c5d-4903-84b2-46b89f24aa7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729381, "uuid": "58e82766-967e-49b2-be0c-0f333e2f5d45", "value": "kaizen.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f229ecd-61cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780766689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766689, "uuid": "3567acf7-f1a3-4a8f-ab1a-c8ff0b1567d0", "comment": "Malware payload", "value": "19a3318fa6659477a7104792c206439f", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766689, "uuid": "48a1ba41-055f-420b-ab7d-5f92f01f214a", "comment": "Malware payload", "value": "b5251a95859da1c257101c66c86ab2fb6fa06814b139057ae946c4fa69404b83", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766689, "uuid": "807ecfdc-dc74-4651-87d4-40db8b204609", "comment": "Malware payload", "value": "ba3f9248df11c0e1ecf7b92fc84234d5d12d8846", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766689, "uuid": "83fac73f-eb8d-41da-99c4-39b50aaef553", "comment": "Malware payload", "value": "9e700022ec6eae58a00b32dc9b287e41f617d963fdd6881e3476322982f2dc4d4c17ee78ddb091b04ce27e6ee715002a", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766689, "uuid": "4456281c-470d-4b6b-8db0-83546cf76116", "value": "T111D59E06F89150B8DAA6F1310CA1A202B6317C540F35ABC33BE6E5755F337D92EBA785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766689, "uuid": "6332ac1f-2fd4-4e36-822d-11688738b38c", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766689, "uuid": "4918ac81-4c4d-4f98-bce6-a14fcdaa19c6", "value": "49152:rNdMzfLIAfrb/TDvO90d7HjmAFd4A64nsfJMoKSFn00IZf9ldplEUSgkKWQIk8DH:ELIAOhFnU1lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780766689, "uuid": "cc765b30-5fed-4d48-b40a-9fd3638aec3d", "value": 2858120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780766689, "uuid": "8bdcf618-7538-43cd-8f8f-1c2b54642886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766689, "uuid": "15cce45a-ee6b-4c0d-adad-bc8bccde8815", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745d07ff-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777355, "uuid": "a85cbfe9-e491-4886-a948-6b1eeab22f57", "comment": "Malware payload (Mirai)", "value": "f4931c2d1d82f84fb14d8563b8271ff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777355, "uuid": "02110504-6daa-4861-a928-26b44864c6d4", "comment": "Malware payload (Mirai)", "value": "b5b6350b0c8c52f4700efd47382956c023542b3344f8407118666ad5022e9866", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777355, "uuid": "f6044066-83dd-4d6f-bad6-bdb675591623", "comment": "Malware payload (Mirai)", "value": "14baa864bcbb2501a0bdf1ba4140e5438db13f04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777355, "uuid": "fc3b15e0-24b7-4e82-92ba-ab8ca65df93c", "comment": "Malware payload (Mirai)", "value": "82feecd26423d92b2537ab77821711c5b01e4cb71410bb018cccb259b09414e94d8377102e7847f961a1bc061f89f4cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777355, "uuid": "0a1bbd8f-4228-4362-a132-13cd628e4d34", "value": "T19014971E2F228F7EFBB8C63547B75920A75C33D626E1D544E1ACD2011E6038E641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777355, "uuid": "65dde596-26b7-4004-913a-c94a7a251ebb", "value": "3072:jCgMgl3Q+FQElE5twflGnvZUcycE5c6yDLwme3b3Wy:OgMgtQyQElE5G8nBtEOUmub3Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777355, "uuid": "d3e6e36d-461b-4db8-9f01-e1c8b4d67c44", "value": 193532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777355, "uuid": "2095af0a-33dc-48c3-8614-1842f1df9e80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777355, "uuid": "4c174413-16c0-43ad-abae-7e0f91bdc1ea", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608850a8-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709461, "uuid": "b148101a-fd34-433c-8053-49962f10659a", "comment": "Malware payload (Mirai)", "value": "179828a52b1f4b3b30cd150a50fccc98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709461, "uuid": "9b418749-b236-4212-8179-00e04327161d", "comment": "Malware payload (Mirai)", "value": "b653bffb5f857034eba028968fc5ee5cbd44c6715ef795c0efca74139efe3976", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709461, "uuid": "e1df33a4-ecba-49c2-83c6-3be5e806f53b", "comment": "Malware payload (Mirai)", "value": "2fc335da53e1a881c2b8d9add6c26c98c56bd004", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709461, "uuid": "4052471e-3c66-46f5-b371-24919343d2e2", "comment": "Malware payload (Mirai)", "value": "42890f35a387a4a2e937a1ca1ec2b31ff74182f10bf300881cdfa73da90e3394a5a4b3b484f878e54338c36c7eb12a5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709461, "uuid": "a0d778e5-ccd7-4052-90e9-d99ccf879d2c", "value": "T197C34B1775C180FDC8DAC2B44FEAE526DA73B0295134B21E2BD4AA275FCDE206F1DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709461, "uuid": "88f84dc0-4e38-465e-b5fc-eb80334d641b", "value": "3072:CcFnw/dVU14v1iLR/XSMiNZxzvR4sBMzRIJ:jOCWzVxvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709461, "uuid": "5f6615a4-0bb5-4710-84b6-8ae9035d6463", "value": 126856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709461, "uuid": "8df35059-aa39-4c07-b866-803583ed3a96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709461, "uuid": "6cc1ccf5-3504-4cee-9ca0-c5b90c609f73", "value": ".Sassy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5c8b86-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729372, "uuid": "9c8ae6e7-bd71-451b-bfb7-2e9bb0f0c77c", "comment": "Malware payload (Mirai)", "value": "2e8a9129ca81f69960875f1c40ac36f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729372, "uuid": "7f2e018e-acb5-430e-84a7-4ce5c49b7387", "comment": "Malware payload (Mirai)", "value": "b7104cb3012fb58b696862712e97455b7ef0b2717ebfeeb930413360d1183c71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729372, "uuid": "0fa6b193-3677-45b8-9af0-cdd585e88dd8", "comment": "Malware payload (Mirai)", "value": "560937a57523e5a72e8ff31b8632478313210c55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729372, "uuid": "5dfc3154-fa96-42ee-8cd9-1d372c702f8f", "comment": "Malware payload (Mirai)", "value": "c6ac79cee63f6b54d49dc04b584ac58e74e77d03dd0aabb340012268db2db9c876bede77c4e3a089b0dcb1f00ef5fff0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729372, "uuid": "66b3cdc9-1a4e-404e-9b0b-b5c91e69aa35", "value": "T189C44949F8809F61C6D426BAF64D42AC335747B9D3EBB2069E145B3437DB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729372, "uuid": "34937199-ea78-48e1-a8e7-839d80fb436e", "value": "12288:fiFZuGXKlk00/3MXgKfYbtElyELs0BNR68Vv5sfI3oB8p1OJF:qFZnXKl5C3Mw7pEQELZBH68JC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729372, "uuid": "98322065-ce00-43dd-9f3b-3936e1b8f0e1", "value": 595788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729372, "uuid": "fe59bd77-beab-4ed7-90cb-f75b998aa32a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729372, "uuid": "843af6d3-9da2-46ee-b928-bc046cff3236", "value": "kaizen.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c17911-61e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780775456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775456, "uuid": "0710a74d-50f9-471a-89e6-00394132f265", "comment": "Malware payload (Mirai)", "value": "562d60891e7cb67e8eef7575b006a8af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775456, "uuid": "380f993d-c8cb-4108-a13f-b1091f2ee4ed", "comment": "Malware payload (Mirai)", "value": "b7a25fc2e6074531ff161ff41583fa7512131aae51488de092b0ae66a942d76f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775456, "uuid": "efa57010-e46e-49e9-a89e-7aaff8e6bf95", "comment": "Malware payload (Mirai)", "value": "57943f823dcf9d0fe96372741bf1573ea61517a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775456, "uuid": "508af0e9-9257-4e98-b1c8-c18d6c4c9539", "comment": "Malware payload (Mirai)", "value": "9ad0eacdd0f324e6adac265f083b4d7f00512674beb1281cefda1468f6f23d0d294a9a9ac597314b309dd18e9d23263a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775456, "uuid": "de7f124c-0697-4353-94f2-18e7c7bce0ea", "value": "T142E35B0A79D270FCC687D13092AE9F61FA36745C02183DBB93C2AE711D36ED16E15E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775456, "uuid": "bfe53637-65bb-473e-a92a-9aef8ac170e0", "value": "3072:Fp7XN2ReABHRGyjIcrauX2oc/pPXyps6TOYrFjY:F1XQeOHRGyjIhvypswzRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780775456, "uuid": "7b053157-3ee9-4720-bbc8-1dd1c2968370", "value": 144416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780775456, "uuid": "20c44faf-1316-4799-8f40-8ee03e31ad0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775456, "uuid": "83685106-c06f-4ba9-b918-34be3e1c0b42", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85424cc7-6185-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780736151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780736151, "uuid": "4ff525ad-850f-4df5-9083-7f032bc56747", "comment": "Malware payload (Mirai)", "value": "9681cae2739ed75bc328242f2c0c6b83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780736151, "uuid": "b40cec29-70f9-42a6-baab-72929c1fb2fc", "comment": "Malware payload (Mirai)", "value": "b81fcb141064a0004533c6ba40fcf0bb32d7485c5f87fd3043e1f1f3fbf86308", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780736151, "uuid": "573de8e7-6bcf-4a8d-9078-331e8f71ecc2", "comment": "Malware payload (Mirai)", "value": "5e6b4031de64c67fae9e230e500825ccf0dd7515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780736151, "uuid": "45dfa2de-f37b-466d-8af0-362986b3bbfe", "comment": "Malware payload (Mirai)", "value": "e63d7e4971ce39b064d390743303d0483464d6837ebb9ccd6031456583563ea8af8c752a754b6507aecd00d6378320ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780736151, "uuid": "d9f4ff03-c2e0-4094-a6c4-9af959a5c359", "value": "T1B1E30A45F8814F12D5D112BEFE1D128E37231BB8E2DE72129D246B647B8A87B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780736151, "uuid": "f2764e27-4404-40dd-93a3-b8e32d7f3034", "value": "3072:yFz5KjxnEVPa5HN+bwX8FIJpFFmaJGNCBsIytN:yDKjxnEVPa5HNDXNpFMa1BsVtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780736151, "uuid": "7f6a299f-6fe7-4814-818c-f9e2918b2a67", "value": 151900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780736151, "uuid": "fd1fb958-4cde-4a68-93a0-cc740ac9e970", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780736151, "uuid": "891cbbca-a0c5-4bf4-b806-b3e7ce43c221", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b7b92b-6145-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780708857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780708857, "uuid": "f0ce06df-4467-40b2-a8e1-3d3909ff6e03", "comment": "Malware payload (Mirai)", "value": "b47a4524619cebf3a5cce2927e35abcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780708857, "uuid": "1f7419c0-b0a5-4eec-ac08-ad2e2704535e", "comment": "Malware payload (Mirai)", "value": "b82bb591d3efc63d075e77749dc0aa28a2e43c0b079f4dc5b3b058faf38609b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780708857, "uuid": "7ff1c2eb-254a-4d96-90aa-c87f61f0e9ec", "comment": "Malware payload (Mirai)", "value": "b6e121e6f077e2d07e95171b25cbdf58e6fe36b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780708857, "uuid": "a4f33c29-eab9-49f5-b77d-f2421300be54", "comment": "Malware payload (Mirai)", "value": "32188fdca31599a789d76887b52561e57f944b7c0c42d39f201f8ec02611cf96c4d6c16c3b42bb5e4cfc182aae0e778c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780708857, "uuid": "929ba2a1-794e-4406-8ce8-9f78559b4764", "value": "T1D366E819ACC42BA6C06C4B7554EEC96622B05D044AF14B3626A4FFEDBC762787F07C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780708857, "uuid": "e754de88-cbdc-46ff-9cc8-f20fdbb9b9a3", "value": "49152:nbMnHF8+oT9gjWAovnZEJSfkGq4vV2D7lj93MWr805E0:aGnWJS1MOg8GE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780708857, "uuid": "689f93f8-138f-46de-a960-eac63fe8731f", "value": 6553815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780708857, "uuid": "d762966c-edf2-4337-88e1-792ea2e51c1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780708857, "uuid": "ea92b8bc-b67e-48c9-81dd-25a7192bceed", "value": "SecuriteInfo.com.ELF.Mirai-AGE.76883659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce86dea4-6148-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780710075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710075, "uuid": "0745ebf0-406e-4d01-a2fd-23f1538aaea0", "comment": "Malware payload (Mirai)", "value": "e3f6ed1853a0d1d9a4c79ae2a0a60b4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710075, "uuid": "688f3926-6af3-4f42-959d-8e60e43f9ad9", "comment": "Malware payload (Mirai)", "value": "b860a1fd15ae4f4c9e38b63558f32db2ab704d6afd62ecbb80fed7d239a6bfa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710075, "uuid": "5e003927-51be-433a-97a7-6dbc38bae71e", "comment": "Malware payload (Mirai)", "value": "ed2a56e6884c8c8771ee6d0be42bac63883df1a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780710075, "uuid": "cbfc34fa-4a9a-435a-b495-78aa9aa0e5ff", "comment": "Malware payload (Mirai)", "value": "d5615023db3686179be17568c9b03b09e9ec83dc5efff41260ebe04e4ef1363f9c3a76812e415cd095e52c854a523d8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780710075, "uuid": "18745958-b446-487d-8bbd-94e31e9b1cd3", "value": "T1CB143D5377224F90D365D6720BB38F565AEB01822EE298D5936CCB103A207D9689FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780710075, "uuid": "e25e87fa-99bf-411c-9fa4-00dc2693d70f", "value": "3072:1KDKjIzgnPUH4vQUlN6odRdyHVz36J+AdrEYOB4uDliM9MpCH:gDKU8PU41lAo/M1z3s/dAcukM9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780710075, "uuid": "d68b41cf-1dd2-4f38-99f6-dbb717712958", "value": 196672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780710075, "uuid": "8bc26edb-35f7-416e-8941-7f12a133ad5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780710075, "uuid": "2ab21bbc-438b-48ff-9335-2206d5fb4925", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ec9c5d-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765702, "uuid": "eea590a3-bc0f-40b8-89da-51d348810d0f", "comment": "Malware payload (Mirai)", "value": "e789d594bea34fa894145161f0a74a6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765702, "uuid": "207b3a32-8701-41d4-917b-a20ee69062d1", "comment": "Malware payload (Mirai)", "value": "b87570fe382a02b2f3359fe527347b19073222c95adb6bb172144765eb75b822", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765702, "uuid": "16d86208-4994-40bf-ad6a-ff4c56994c5d", "comment": "Malware payload (Mirai)", "value": "1f8e6d7f1a6d5c6984a35ec6a1c034f4a4355d09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765702, "uuid": "b51a02b0-f88d-41eb-8e2f-9ba54676603b", "comment": "Malware payload (Mirai)", "value": "5e073f70a47e21d6a0afecccc140f7905a5251a94ade56f8d7dac5fb8fb44a81f98dd30cb1108af9c48364298f627a7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765702, "uuid": "5ea9afe0-a1d0-4350-a1eb-74aec1ea62d5", "value": "T14EF2D492BC939A26C6E4237AFA6E418D332663A8D1DF3217CD211F057AC651F0D77B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765702, "uuid": "d1b042b3-9408-451c-a5c9-b24a0d7abde0", "value": "768:9AuF4dnsueEBEnRCAT4a99qBnoSBklvQcK5EwnBmkooIPNw:6dnkyEd1SBoYBm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765702, "uuid": "ca54f882-021b-48cd-b7cc-26600715f0ab", "value": 36744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765702, "uuid": "3aaea8e4-d633-40b2-aad9-d0a1c53655f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765702, "uuid": "09252a50-5315-4e61-b3b2-5c8698e43ec2", "value": "cff527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a93b84-614d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780712241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712241, "uuid": "0e07013e-6a00-4215-a855-b79d5dc01050", "comment": "Malware payload (Mirai)", "value": "4cf4efcf29cc3d43d639bd3038b24370", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712241, "uuid": "a3f7ef96-f4cb-4799-840f-2f15103a4a0b", "comment": "Malware payload (Mirai)", "value": "b89058c46f18087a6aa1fb9f52fc8cf824916d2e67c594bf7f631a1eee683c31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712241, "uuid": "d12b70ce-d95e-4716-959c-e1a6b0c7f7a2", "comment": "Malware payload (Mirai)", "value": "20684551474e07e2025f153e60ae15883a58c27b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712241, "uuid": "5407d91d-6bfe-4256-b12f-ca0b014b0559", "comment": "Malware payload (Mirai)", "value": "d5eebaf913f5793dfd39f11e4d1c46c76e87769816f107334b9b36c6a828fa8564b67baeb09af8fa342196105f4543bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712241, "uuid": "bdd3a980-3020-47d7-ab30-684bb7f2caf0", "value": "T15E156C5BB2B374BCC057C43443ABCAB2A935B42502226EBB65C8D7303E17E741B59B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712241, "uuid": "b5b1a6e1-e8fe-43e7-b555-59de68344086", "value": "24576:eL7LF4sRkaZPtL9qnt1m0V47uyjItacK2:S7B4sRkIEQNstacn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712241, "uuid": "609a693c-6b2c-4397-b2b8-6f097a295d3b", "value": 894152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712241, "uuid": "b05859c2-8059-455e-9f8d-36d925fe02d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712241, "uuid": "aaf5e700-b853-4917-81a6-21f07224c419", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd3847e-614d-11f1-a769-42010a9c0008", "comment": "Malware payload (LiquorBot)", "timestamp": 1780712139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712139, "uuid": "e9023695-f193-4b55-9f90-a4e4f3ab7aa5", "comment": "Malware payload (LiquorBot)", "value": "5f70d38e2e37485d14ac419d11467300", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712139, "uuid": "1cc08fa3-d92b-460f-84ec-7584c5368198", "comment": "Malware payload (LiquorBot)", "value": "b8f4bad06f98328d7e8cfdee4a2131b2ebdc0640a53818a91a8d6ce9adbb2a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712139, "uuid": "e0d07ebc-792d-4aa6-a544-21f6112a6c99", "comment": "Malware payload (LiquorBot)", "value": "62177b009088d2b76221c7792ba537bb901495d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712139, "uuid": "94b3658d-1d02-4c87-aed6-8fdba29fc20c", "comment": "Malware payload (LiquorBot)", "value": "acda855f10d95243223bf161adb1b83d9bb5e7548b53bb67a1495530d014c14216ee9dfe43744ab85b80d8bea9c8bf7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LiquorBot", "colour": "#1604D0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712139, "uuid": "346470d1-db69-433c-a7d2-6aadbfc4144c", "value": "T189853383368116BEC59B35BB6B59E75E0F00880429A94683F52185B277ADD37BF702F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712139, "uuid": "50bffffa-0dd5-4ce2-9672-c0ed67af478d", "value": "24576:bUPQS/PwolA04HcQBSwm8z6sc7v6yCzwhn6R+sc1F/NLmb1+2/xDXqFidO:bUf/PwOAX4Ib0VCMQi1tlmbB/xDaFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712139, "uuid": "2a7af1f2-c965-4c95-ba11-10a541f39ca8", "value": 1709360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712139, "uuid": "6d5b36ac-c467-41f3-bca7-8633f96c83c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712139, "uuid": "71202c67-a556-4b11-bf96-114bce8d1996", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f71a058-61e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777776, "uuid": "f99c9f53-245a-464a-9c06-1c655c22f433", "comment": "Malware payload (Mirai)", "value": "dd1a1d35c803eda82cbdeeff4d03ad3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777776, "uuid": "8c0ef7f0-1acc-47f1-a849-62fd0757d82f", "comment": "Malware payload (Mirai)", "value": "b9537d263c2440fac330e038fa43cf02fbe5de5850208a9260799ad443f72de3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777776, "uuid": "42d1ce59-fe9d-4336-83a0-3917791466f3", "comment": "Malware payload (Mirai)", "value": "0355e4b308078833af4af39872fae8d578733291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777776, "uuid": "97df48fa-8d28-4d29-a433-95b0c766067e", "comment": "Malware payload (Mirai)", "value": "685ceb49dbe5dd5e06289e1ba332decdf58e5e9670ae3a39b03e911f5025823522339e7e1a6e36c26f2e448584a27c6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777776, "uuid": "f01e604f-cfdb-4d5e-98af-faacbd4a4f6f", "value": "T14B932B8ABCC1C611C5E0A1B6FB1F91CD376643A8D3E67213DD18AB29774B85B0E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777776, "uuid": "98ec7283-e9e9-4475-b41d-d6a41d7d6c7d", "value": "1536:U/k44qGpU5yBXoI5VRdiX+Vlfs5GJYiu3O9ubogxeSW:U/kikUUXdrdiuX0b3O9ubogYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777776, "uuid": "d07a29eb-7f91-4613-9131-93c5893b4613", "value": 93976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777776, "uuid": "ce4449cc-abeb-43f3-9b45-f9008d3145e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777776, "uuid": "1dc59de6-3740-457d-8a86-e4e44a7133b8", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fe7f9e-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729251, "uuid": "2b1c8826-1197-4a12-928d-e67f54eaa516", "comment": "Malware payload (Mirai)", "value": "b46889601b6827f8355f31f2b0c05b05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729251, "uuid": "cfec2d55-fe96-4ef1-a108-3ab738aa4583", "comment": "Malware payload (Mirai)", "value": "b9a3c214cd898b0373f98527e4ae6dfbf641e69474e19dbd1faa50bfb0d050bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729251, "uuid": "a4fd2a30-d7c1-4336-abdd-dda4b6dbec0a", "comment": "Malware payload (Mirai)", "value": "ebefeae01568aabf6acbcbbf95b3c6d41232c591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729251, "uuid": "8c5fb907-4dbb-41ba-a48c-365667170baa", "comment": "Malware payload (Mirai)", "value": "57ed6a2f02f0b8f4af4210528a6c0f142fe1405a209ed8e2ac678a55806ded6c5ce0bd349e83aeb78963b19b46d6abe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729251, "uuid": "98abee70-c4f5-426e-8576-ee472261ebec", "value": "T1F8044B97EE091FAAE5AECF74845B50AF056E05E637A2C023E35C1D35369F38B079488D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729251, "uuid": "8316ca7f-759a-4bab-9f37-f65ec114a03d", "value": "3072:1VKOpb77o6ocBCJ5sahjL/tSPlLZA3/Um:lmoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729251, "uuid": "8bfd9ba7-917d-4ff6-8cb5-a5ab8f533a0a", "value": 181384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729251, "uuid": "d95b0a82-c62f-4d35-a03c-0f764a71694e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729251, "uuid": "6a67a956-8a24-4d8d-84eb-73e2b9301dcc", "value": "kaizen.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d512829-61bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780760861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760861, "uuid": "55c0cb4b-9891-4a80-a2d7-01d2755fb81e", "comment": "Malware payload (Mirai)", "value": "8e96f46860521ffe8ff6d5d62088b1ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760861, "uuid": "19a7e289-e1b6-4393-9cea-75eb41435818", "comment": "Malware payload (Mirai)", "value": "ba8a21f445070d5ff3e03f88f22c8be7ba5fb76f2c5c07a1b83905722cd9b130", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760861, "uuid": "a1fef699-c683-453c-a524-0aee8131ff63", "comment": "Malware payload (Mirai)", "value": "a575e3bba48ebd9d19c9b2e26115d8d8c2fafc4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760861, "uuid": "ebbba452-69bd-4159-b650-689844512139", "comment": "Malware payload (Mirai)", "value": "95f8bfac7980da364b246425ba3aabcf035152a7d99a4b22677b9e08907c56a9465e704d1095da148c1dd0938ba72a65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760861, "uuid": "c7107d81-9883-4c21-a6fd-abd13ff36e92", "value": "T12724F60EBB220EF7E86BCC3B05F91B01218C651722E97B75B974D918B54B24F4AD39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760861, "uuid": "af70e2e2-672f-4f1f-a21f-2eb4a6606770", "value": "3072:9E8zSrn+aF1AVC4uOSxfreNws3g2wmbrD601um+xx3Q7mySRXr3Kaj:9jSyaF1AV6OSkfw2pXu0pkhQ7WXr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780760861, "uuid": "9bc2f3a9-bcfe-49d7-8dfc-28e9ef5dcf33", "value": 210648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780760861, "uuid": "7181aac5-6ad6-497d-ae9a-e235c0a1256b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760861, "uuid": "1bf2c8b0-dc61-4e9a-bbe0-967afc86b0c8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0b532c-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780748029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748029, "uuid": "73311faf-84f0-4b04-9f7f-be564cd9ac99", "comment": "Malware payload (Mirai)", "value": "c9d801b357b35d0ce14d3402a5f32bff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748029, "uuid": "9197a614-fd46-4e74-832f-36bd0ec60538", "comment": "Malware payload (Mirai)", "value": "bb289989267c92b321a475460dde13ea8e76f15ce750e84c7a4d5be068cce43c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748029, "uuid": "46292f77-ef6d-4ff0-a002-12948c770b12", "comment": "Malware payload (Mirai)", "value": "2fb1228ceb4f2bde1608de05bcfe99adaee6ce44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748029, "uuid": "d67daaf2-1f8e-43c3-86f7-4e0af4bf2de9", "comment": "Malware payload (Mirai)", "value": "777fd7ca9d38ba1c063d897175ec7b6f26b6b7e6c0bdb84fedaf0b57978709335b9bd768f015f5ffb7e45a668da3fb5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748029, "uuid": "27e34e53-10d9-4b82-841d-e04e8fb8a691", "value": "T132A423ABA3E1CF33FC55277FF2401AC66929227548BD155B9ED484A8E33F203895C927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748029, "uuid": "09adf6e3-c5da-448b-aca9-88e4ae0b4829", "value": "6144:fbPprkekDU8uV+erGOgDalC73x9hzsUGm8RDWIyoTvx/ZwP1NGMo+Vig+AR8YBz0:zPjgVu/U+lC723hRCIyoltC+Y9WXB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748029, "uuid": "781573f1-27a2-47be-a6d6-d6915f4dd982", "value": 479644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748029, "uuid": "bc852746-a383-4f35-a54c-0ee99e86bc91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748029, "uuid": "630d38d5-5557-4f31-8126-e7c22072daca", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be36b1e0-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709618, "uuid": "bb1f81cb-1e6b-421e-bc8e-832cd6918dbc", "comment": "Malware payload (Mirai)", "value": "6ff661b295aef9dc0b10b03ef9d6349f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709618, "uuid": "5ad9221e-760e-4a60-9fd3-c0f7d80aff8e", "comment": "Malware payload (Mirai)", "value": "bbc0f584fdf93306f23f78d8ede1b7cab9067c2882d316a65057da64fad818ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709618, "uuid": "c8f7016b-47c3-4410-8ed5-394a2657a240", "comment": "Malware payload (Mirai)", "value": "80006ced3f4a0719f590017207ce21f0b28e1ddd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709618, "uuid": "17cfbcf2-d726-411e-b2e5-9b7d9c4d0f01", "comment": "Malware payload (Mirai)", "value": "df7e920673f0ab8b26b07b589f622e3bfe8f506aaeff89f1b8b05d7f1054ee43562d5fb1fdf5d7d9d056331bab3c1ba6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709618, "uuid": "c1aa4b2b-df5a-43e0-a98e-a8112d9375d3", "value": "T1DC6617137B2CE71ED22821346CB1DA842B2A1C4A45D79917B391F319F9F20BC996EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709618, "uuid": "55c7a51f-458e-4003-aaf6-fabadee94a8a", "value": "49152:ifpwQ+ZkOJ9uJP5LVuQ3iEIn0d3pv9zEJ1b1JBENgm4pCNbQp6ezwNWiHHEt5EO:XQM1vm4MttNWinEjEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709618, "uuid": "38324192-fdd6-43fd-b748-cd8804452780", "value": 6553815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709618, "uuid": "821a6713-1bde-41c0-b81f-8e18dcfff0e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709618, "uuid": "cda47ba9-ad63-4456-a9f3-2602d0945027", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e349edbb-6180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780734162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734162, "uuid": "300afd42-277f-4999-b0c8-aef48b4c7de8", "comment": "Malware payload", "value": "a8c9f2c63d45445e38699395f565ebd5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734162, "uuid": "ebfb9d10-bd86-4026-92d9-efeb4b8e7c2e", "comment": "Malware payload", "value": "bc37a83efd104ec09b9caf3ecee8924dc85157c28e2672813578efbce88aa93c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734162, "uuid": "0cdb6a75-51d8-430c-a517-800b6187bd7a", "comment": "Malware payload", "value": "7818fe8594d72d977264d91b4e9697cdcc530327", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734162, "uuid": "3501fd8d-9f88-4fdf-b38d-d4728c6394df", "comment": "Malware payload", "value": "e6ad23d50f5b40634e584311531a11b6115529c27bd832f19cc22697600034b2c75ed462bbdcb100ccb475365ab0ce7f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734162, "uuid": "86f78087-b1f0-4046-9dfe-27c0d0c24fc8", "value": "T12AD2DF34C4C82FBDEEAA2A1C06FA6620D7D68B1E9498860737037D9B4F37C80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734162, "uuid": "be7a084f-b881-4627-a2b2-2a890ef79b26", "value": "768:JumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Ju+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780734162, "uuid": "3aa1f1c7-4877-4fde-a464-12ef2823f0c3", "value": 28656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780734162, "uuid": "848bd8fa-f97a-45fd-b316-622c16b74c04", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734162, "uuid": "3552cc99-ecc1-426c-b5f0-3a094bdd0fb2", "value": "23.94.110.24_1780734102246941_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d066ef95-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780729406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729406, "uuid": "7a84af65-867f-4f3b-af54-44895458f215", "comment": "Malware payload (ACRStealer)", "value": "5b27ab516c949142c8297e211a5ef648", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729406, "uuid": "d5f8c57d-9794-4cb8-9aad-04e77fb349c7", "comment": "Malware payload (ACRStealer)", "value": "bd842426b139da65e5e7a8b963569ee3433c6b26fab4c0ab9abd68ee8afa09c3", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729406, "uuid": "a9ec13c8-6eb1-4f12-86ca-71c6ebd73922", "comment": "Malware payload (ACRStealer)", "value": "22b76629f955e41b0ab7c9d7e946e64c7a22106b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729406, "uuid": "0fc2646d-9609-44dc-a190-be962220b300", "comment": "Malware payload (ACRStealer)", "value": "8048c628c4dddc728050d6254b67b2cd50b883a7d0b1a04c23abf16277866d5e2788088941fde0f3fc945347d7d65215", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729406, "uuid": "aaa57cc7-1ca4-4668-a7ac-5976129c9f2f", "value": "T16AB59E51FCDB24B2E902523248B662AF2335E9091F35DBC7DA447B7ABC335E10E32695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729406, "uuid": "3333562e-5eb3-4c7a-a7d5-08504708f743", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729406, "uuid": "344c53c6-8d0d-4ce1-a788-aaa09d014986", "value": "49152:fIZzAdnzlPVfgC6nPOvJxt7Y6cmBUYK1Z:whAnPVfEmMg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729406, "uuid": "d8b8414b-c9ef-4750-bd19-73c972baa7de", "value": 2376320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729406, "uuid": "7d462562-ed91-4754-a9fd-8d1a3f4da07c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729406, "uuid": "37d1f010-b746-4418-a038-b174db6c35dd", "value": "5b27ab516c949142c8297e211a5ef648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f61a174-61f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780782339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780782339, "uuid": "ebcca52e-e167-415d-b298-5e705d45ff46", "comment": "Malware payload", "value": "7deab38d814da83c0c44936d90a2381a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780782339, "uuid": "2414f7d9-ecc0-44b7-8a65-70ec00ab48dc", "comment": "Malware payload", "value": "be2cbb34f0f87c275a175063fe77861f9805e17c35882fadf7784e8689c24cab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780782339, "uuid": "cf589962-097a-43e0-8680-e23563a8c77d", "comment": "Malware payload", "value": "fef10d0b8db7f6d2b403e405067ce7f4c5e3ceba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780782339, "uuid": "88bca32f-cc53-402c-847c-6a55647eff5e", "comment": "Malware payload", "value": "0a60da9d322b4355c797c5563ee98b1461c93a63aade9caff6b0ade909788c2c3103b638e96ee6db8824b193faddd42a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780782339, "uuid": "c95efea0-cec6-48c0-b6da-ee97a45d0ca0", "value": "T1D1E423D3859F48D8E45BCDB3416B2F33E620B9012B29C2F757DA56061EA13E11736BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780782339, "uuid": "14969668-3d8f-4316-98dd-6381e5e499c7", "value": "e6c6166959e9db1494bb9a620affb282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780782339, "uuid": "ea191090-6782-460f-80c8-c62743f84145", "value": "12288:Zdwo12zDmxm2qflAKz2so6W2XGprJ/uYUFbHFM8wIRkblE:Zb1YDmxmdua84FhM8wVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780782339, "uuid": "a958d105-81ab-4b6f-95fe-6258481b7ac4", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780782339, "uuid": "37905632-5c99-44a9-8f85-029e8e154c00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780782339, "uuid": "82424598-e90c-444c-b947-e2f2a235d092", "value": "Exodus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7a565d-61bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780760865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760865, "uuid": "26550771-8053-40b5-a1e6-48c115999e00", "comment": "Malware payload (Mirai)", "value": "3a14a2b2123c49565d7741468d3f2565", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760865, "uuid": "8abc74d6-be85-41da-a23c-794f9274b304", "comment": "Malware payload (Mirai)", "value": "be5053449eec9855acc145c2c268f177c035e6bc3066003ad37c472572f2bbd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760865, "uuid": "d085281a-ec0e-47dc-b036-c5ac932bd75b", "comment": "Malware payload (Mirai)", "value": "1940d4856a1be1ab666c215898e48aebcd330297", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760865, "uuid": "e5a2c11d-fb1b-480f-88a8-0733a6f0def3", "comment": "Malware payload (Mirai)", "value": "72b5b48a830d64e1221263d90a645ca5e8127d8c11901cdc5f681be848a5beed2e44d6db4319c769c768ab4e9ba0fd12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760865, "uuid": "6840afca-b7c4-4190-a85b-a67208428ba8", "value": "T1EA14B50E6E25CF3DF369C73857B78B30935823D626E1D655E16CE2112E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760865, "uuid": "8351d97a-008b-4058-bff7-8059d1368d0e", "value": "6144:+wDj4w7yB/xADeG0HYXhFfrWqyFh4V6QXvE:+/w7jDdRlSqyFUXvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780760865, "uuid": "7d84e85c-1293-4e5b-98f4-6aecba2e316d", "value": 205960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780760865, "uuid": "ce57ec6b-59f0-43d4-a1bf-10751dc338ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760865, "uuid": "1b270c27-f504-4acf-81bf-d879d4f7cf70", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468fd05d-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746784, "uuid": "a69d79b3-a376-4c29-ad14-c60eba0831f1", "comment": "Malware payload (Snojan)", "value": "76f78f458680b9c03382ca4a77cb830e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746784, "uuid": "e7f831dc-105d-4299-844b-b033ae53a69b", "comment": "Malware payload (Snojan)", "value": "bf274240a65911ee9836d27b9d930b47e0c194d16642241b8e8747aae3ed0e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746784, "uuid": "cb4e76b3-3efe-4286-be19-fa72118b7e5d", "comment": "Malware payload (Snojan)", "value": "05dc6cc9f0695ceb4b49fc31bf0708f16efb2503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746784, "uuid": "3dce8bbd-5fc4-4478-8e6c-4a9b7f5104ef", "comment": "Malware payload (Snojan)", "value": "450686bbcfe1871fc4748ecb46bfbc0be2d5a33804b2c8d0cf8fdefe631231bc5411ba7759cefa63771d8748d8ab42a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746784, "uuid": "03dd1d72-5584-47e4-9f35-bfc994033f26", "value": "T179345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746784, "uuid": "cf82933b-4109-458f-b2e1-fe07d840d3bd", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746784, "uuid": "b3fe4606-3df2-4e7a-ac45-d072a73edee5", "value": "3072:FJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/L/FnncroP9:PwDeM7iNEkgiOb31k1ECbJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746784, "uuid": "47ec7d8a-b593-4a67-8832-42d72a8d5f83", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746784, "uuid": "17d78a2d-2db4-4222-8d6b-04ecee3df288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746784, "uuid": "a16b30b7-a27b-49b8-8613-5c34dc213991", "value": "xrUXSCpvbpDRtijU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fca596a-61e2-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780775978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775978, "uuid": "5a79bf1a-704e-4671-9fda-62463e11a6f9", "comment": "Malware payload (RustyStealer)", "value": "e0bcd020b379426291d73499ff220f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775978, "uuid": "edd10c41-627f-4286-bc4c-8fc7e523992f", "comment": "Malware payload (RustyStealer)", "value": "bf33e425bbc2eb6b867cee71c90f85b7c5d9945f5ddb8b8d70636e8005496e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775978, "uuid": "2e0df06c-7984-4e05-a996-ffc71bf363fa", "comment": "Malware payload (RustyStealer)", "value": "d2276f5ee2e19b6deca2e64d49e04c0daf1a374b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775978, "uuid": "2a890350-7138-4606-8e6d-d27e826248d8", "comment": "Malware payload (RustyStealer)", "value": "87821b46081f15c90a8ee9b472bbcca057f963ec73943471da57988cd9fd5844e464047536ad3cdda724d4639e6791d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775978, "uuid": "a027e8cd-b8dd-46b2-af11-e4cf98e61295", "value": "T10E16125529E649BFC0A3C770C25968BDF16BBF854C71C89BAF972E400E32805CA77B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775978, "uuid": "aeda2cd1-ccef-4c28-9b6a-2e6afd835343", "value": "66e4622a2560a497065719058a0b3263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775978, "uuid": "8d2fc61e-b2ee-4e78-bf8d-7eeb722be275", "value": "98304:WMBQx157y4QIOR5f4uq8IfoAdquQKssnRktE:vA/7B+Ja8bAdqur2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780775978, "uuid": "2695e601-8122-437e-a735-efa0b80b699f", "value": 4147712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780775978, "uuid": "fab2801b-8467-4005-8211-d1c8f7000768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775978, "uuid": "a8762777-d10f-4cef-b266-d853506d753a", "value": "Jun_agrm_rate_confirm_Bol_Jun5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bd2218-61af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780754129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754129, "uuid": "0e028e20-7312-43a8-810d-61d2e27d4933", "comment": "Malware payload (Mirai)", "value": "d4612fba4c4368e880445a659cd97c57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754129, "uuid": "d516227a-c128-4230-81c9-3e444c371c8a", "comment": "Malware payload (Mirai)", "value": "bfbe7015a7845d8fbec9de7136722f8e50a4d5e64a0638c0795f890d5a9c8afd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754129, "uuid": "cda7cc4a-3b0b-42ad-a5f2-4d40a76de818", "comment": "Malware payload (Mirai)", "value": "31d45773cea5bda24bcfb1106a419b15396fbf31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754129, "uuid": "be43669f-3a10-43ed-adc8-4995e68ad59c", "comment": "Malware payload (Mirai)", "value": "db610895400255b231d273afb55e9492d9b365ccc5b3bfbd442d350541d185010e9053fd7837a3050a59c1299fdc77e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754129, "uuid": "712730e6-8b8c-4f86-bab2-239c51f28ae9", "value": "T126A31BD6BC818B11C5D165BAFE0E61CD33134BB8E3FE72138E145B2A674A86B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754129, "uuid": "7fa4fa08-c29b-4ed6-bea9-82c487f80d1a", "value": "3072:NlARAIpUpi+HcZEz15uUo54iPDi0ISmTJOM3kL2D:PRc0vuUBgDi0mTJL3+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780754129, "uuid": "49c2ef60-f6b6-4d7b-a22b-549ed0a7b076", "value": 99044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780754129, "uuid": "d4aeb7c4-8f4b-456d-b6de-65adb6826ae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754129, "uuid": "67720f6d-933b-41b1-965f-485e488a5f3a", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1872433b-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780758732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780758732, "uuid": "eccfc9f4-4de3-440f-a715-289243e8f16b", "comment": "Malware payload", "value": "4b1aa17dce581f97639086ac7cb6ee40", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780758732, "uuid": "721253af-68df-4260-9ff5-40e8fadefae5", "comment": "Malware payload", "value": "c0fba0f11a678e9601675da57a5ae8b359940ea6cf73bffddd379013ac1ad0ca", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780758732, "uuid": "23481c49-7d0a-4e1f-ba5f-a39436cd4fc8", "comment": "Malware payload", "value": "06cc8187c51825c00f20a645256c23b3897ecf68", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780758732, "uuid": "f12d8afe-f614-474f-b93e-736b5ed7d830", "comment": "Malware payload", "value": "4230cc45e600badb20fcb859861ca43623b81dbd3ec4b8ae9037c75c22b9165f9e8ee674dd43688a59c28b99db38cf4a", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780758732, "uuid": "a50e28d2-9104-483a-9a15-4ae28b3feb57", "value": "T10145232773E830E5E273827AC5958A16F7713835176157EB0BD883651E23AC09E3FB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780758732, "uuid": "c11775f6-58ad-4358-87e9-2d3ee47a9f62", "value": "a453654622cc4ac6ac24d3f62715ebad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780758732, "uuid": "4b9629b3-2cb1-472d-a835-4d21f3e54c9d", "value": "24576:/eJH6H0kC3EY6LPHOUnmbtmVq7NKp5xqQipIsh7TGckNcG0DE7vS:VU9J6OUnmbtmrxJipjh7TGckN8gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780758732, "uuid": "9399e6e4-400b-4715-a7ca-cada6555003c", "value": 1245406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780758732, "uuid": "3dd59a95-6e2d-4e3f-b973-9c76a89aac26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780758732, "uuid": "3c692f00-81c9-432d-8743-afe1dfd9ea2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0f2a5c-6180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780734146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734146, "uuid": "48ffd67d-043a-4196-9820-956479abcd42", "comment": "Malware payload", "value": "b51c09a5f9d3d4dd5f6383c828495bdf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734146, "uuid": "a9ae0ddb-8090-451f-9268-10b5dd708e1c", "comment": "Malware payload", "value": "c102490b93050dab1c6e12c504949e50a5de488642f5af688d4dde4493afd106", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734146, "uuid": "0370c53b-082c-4f6f-a938-2cf5de0069b3", "comment": "Malware payload", "value": "e69a79e8cc6580f2d71fc24a24c15d5843993642", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734146, "uuid": "1f88cd00-7d0a-49e6-83b8-4078e65a7251", "comment": "Malware payload", "value": "d859d135aa2d4758ed1402603e940e3099439456feedf71df5950b99638203959bec69fb3731240f75bf469bd3be57dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734146, "uuid": "a29888e8-4b5b-4573-af33-e19ceb8b1306", "value": "T10AD2DF34C4C82FBDEEAA2A1C06FA6620D7D68B1E9498860637437D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734146, "uuid": "e888b879-6202-4dee-bdde-65ca207f48a6", "value": "768:jumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:ju+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780734146, "uuid": "9957028c-ee5d-4ace-8c56-5d327c169141", "value": 28650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780734146, "uuid": "bb028601-1b1e-435f-9dd0-602b3c89cda5", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734146, "uuid": "db7f626b-8eec-4dcb-b923-9d91ed545e28", "value": "23.94.110.24_1780734101317599_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3993a2-6150-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780713504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713504, "uuid": "d305de20-92cd-413c-8994-80b4ab91cf84", "comment": "Malware payload (Mirai)", "value": "810319149548c5f4af0928081f0eca91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713504, "uuid": "28befb3c-8d8f-41a5-b38c-eecf157144f3", "comment": "Malware payload (Mirai)", "value": "c2069fdecb00207dd6f1e57f625ad85b959ccead6b0d0cd4fac48e245f259b5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713504, "uuid": "e7beef0e-bfa2-4012-be31-3de7ddf0f0be", "comment": "Malware payload (Mirai)", "value": "a71d971e405672b97ca3810a377f9058685e4cd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713504, "uuid": "ee252023-4de4-4893-8460-09b5705c5380", "comment": "Malware payload (Mirai)", "value": "ec48077550849280ba8fc9e908176c6ea9bfdaf5f963903f07deaa72cdf0542ff7249099548690c177710a9ecf1fbbfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713504, "uuid": "a49304d1-9d34-498a-aca7-692459ece93a", "value": "T16CE3980A2F228F6EF269877047F38E31A75977E716E1C685E16CE5501F202CE641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713504, "uuid": "b833ed79-554d-4f98-95b5-d6b02bf93022", "value": "3072:PATaMmT21SfhcXd0Y1ZkYPzETUlypVRbv0P:PATtc21SOXdfhrETg2D0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780713504, "uuid": "6d4a0904-0f38-402d-bdd5-c791eba90bd8", "value": 149772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780713504, "uuid": "834bcccc-49e5-4d62-a12c-801180cd801d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713504, "uuid": "9e758a61-8aea-467d-9927-6250b6ead364", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b475373-61b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780755355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780755355, "uuid": "cae937f3-eaa3-40c1-a830-4c9e0b9ca969", "comment": "Malware payload", "value": "5e309fdc8999e506e226573399e8ece0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780755355, "uuid": "e08e0241-c5d9-446d-9b83-503535974f8c", "comment": "Malware payload", "value": "c2266936c52ef7c7fed954d9e08576f1ce8b2b7baacf370a3f6e868548bcbb5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780755355, "uuid": "4c9ba4fd-a011-42ef-a5cc-0b8a9c502e7b", "comment": "Malware payload", "value": "e0f8f1e3378c615d393f9a248abc4fbbd80c1274", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780755355, "uuid": "0a217d3e-481b-4b75-b59b-73861c525507", "comment": "Malware payload", "value": "5fb926fe17d224bd0232060e0f7328e3434b575e1b5e3566662465fd9ee4aea9047ede77d7ff24f06f33892c7c969a4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780755355, "uuid": "581932e2-46a5-4a59-8e75-fac9161bc8f3", "value": "T1F627BE77814338E9E5A98DB4D41025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780755355, "uuid": "2cacf285-abe4-4361-8907-b3c649bdea8d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQD:cqYUQuVDt0TZEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780755355, "uuid": "476f5c11-d32a-4fcf-8eca-883128e0e18e", "value": 20611072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780755355, "uuid": "53b2c917-20a9-457b-98df-9faf9fb70bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780755355, "uuid": "95a31e93-3fc9-450b-a93e-7ee5e3b7dde6", "value": "c2266936c52ef7c7fed954d9e08576f1ce8b2b7baacf370a3f6e868548bcbb5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e3f952-6176-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729705, "uuid": "460a4cc4-fb4d-42e4-9561-f8eeb72ac266", "comment": "Malware payload (Mirai)", "value": "abc181be0f54f0710e8a82574243da7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729705, "uuid": "03c5b2d8-b0f7-4d1d-b831-b85e13e570ed", "comment": "Malware payload (Mirai)", "value": "c2ef26fdcaa5a90ece25efe87dd4e4e8d0db1a7298ffa00eddee4bc36602b2e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729705, "uuid": "76a3e1bb-4a8d-4f3d-b40b-69d1dccf9843", "comment": "Malware payload (Mirai)", "value": "45a21517e8eb1d54dddab11907c1691d34d7ac8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729705, "uuid": "cc637cf8-04eb-4f9c-a864-91b681de1711", "comment": "Malware payload (Mirai)", "value": "13555ba195e44223d0db061abd758b3219db48932074fd3f2cb01a34c9b650184d0da6de793623132e74af1f1a9d6e4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729705, "uuid": "ef3b1418-7fee-4053-88fa-03cf52a02691", "value": "T169164B66BD2EF563E6C873707B6582C4323EBC48DF8192276604BF6E59F63588F12112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729705, "uuid": "1a2fbac9-eb0b-4d31-bad3-2252a3bef7d8", "value": "49152:4Eu8qBpM+njjahzGD+2g5EEGBH7uhMB1:ju8qBpxnjOhzAHSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729705, "uuid": "6fb02a39-38c3-4265-85a1-813930de6f12", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729705, "uuid": "9b311b95-0dc5-44cb-9869-e1b5e8738cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729705, "uuid": "1c17b11e-814a-4f94-a12b-80a3279311df", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57ace7a-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777464, "uuid": "64ef0225-dd6f-4ec2-8dbf-d3da07f1d24b", "comment": "Malware payload (Mirai)", "value": "edd65966ec9eb365a85320622459de0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777464, "uuid": "a56ba72b-73ee-4dc4-b639-fbf0bd9a4372", "comment": "Malware payload (Mirai)", "value": "c36f034c9fc48dfa9164d0ba27c5e4e9fc8c8bbd3642adb724a8f149d0042c40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777464, "uuid": "96429f94-dffc-45c8-b535-03ff0b52d2b8", "comment": "Malware payload (Mirai)", "value": "7471455e504bece706f8c474c8714cddb172fc2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777464, "uuid": "9db85aba-3e5e-4be7-8be6-e4e07acc83a3", "comment": "Malware payload (Mirai)", "value": "fa9e0fcd94ed5b8d9a4de4646dafe7dd2967e705d094fac4d01f81c59af9fc6e25bb3f10b479eaa57ed1cf6739ac97b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777464, "uuid": "fd1dd0f0-636e-4ed8-ae7d-5de740d5a104", "value": "T114F31806AA41AB01E4D736FAFBAE414533536BBDE3FA3002DD205F6523CA99B0F36515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777464, "uuid": "9f996d37-d4aa-43e7-93f6-4c6f5cfcb55e", "value": "3072:S0p5tJ7ODgigr/xSJ3TF8GanabKC/nJsPEahemn4gsnWzi:z5SCoJjF8GanGKC/nJ8LeA4gsnWzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777464, "uuid": "19a1d752-6d15-42af-a6ab-bc84529811a4", "value": 167252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777464, "uuid": "29523c53-1774-43b7-a3b1-488b512b9544", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777464, "uuid": "7c1d97fb-07ea-4864-8b9c-dd6ee2cb80e7", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e00975-61e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780775550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775550, "uuid": "4cfd2cbf-e98b-46a4-9303-0b7f0e019272", "comment": "Malware payload", "value": "e5d6c8c0b4e092bb1e16b75d6e8ad223", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775550, "uuid": "cc36d13d-faf8-4871-84b0-da0b9cac9929", "comment": "Malware payload", "value": "c48d157991215ad0b7c4e03924f6b11427a87142d29415f06b583b3dddf63592", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775550, "uuid": "6ca62f37-6d30-4733-8dc5-f9f386b9a1ba", "comment": "Malware payload", "value": "9bbac1f226216b2c08eeacb2b8d03af8d9b2b601", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780775550, "uuid": "4514f21b-3e7c-4dca-9cb6-23e6cab29472", "comment": "Malware payload", "value": "52ecbffb552adacac2b04c21f0a940a18f2adfc28d2df956cacb2cc1dda993891fd9552c23c703e6225abec32001c127", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775550, "uuid": "a3feae82-9549-4107-8da7-f27929b05b9c", "value": "T164018EDEC0058B5042C6E85D22975096F431C3CF36568FB5BE6C583ECBA6A587069F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775550, "uuid": "fc1ff0d9-cdff-45b2-aa15-2c00cf5c72f3", "value": "24:kXCKysE2hi0ziQvZohaL5ZNfy28OIGNRX:e9Qp+MsL5ZNfyjOIGjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780775550, "uuid": "630198df-6fcf-4162-97a1-cb04ad03edb7", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780775550, "uuid": "87a1d30f-2afd-4ffc-a78b-fae0748980b0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780775550, "uuid": "c56c0777-6e7d-453e-b6c9-05de452d4f54", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd41ed49-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771491, "uuid": "0b650a7d-6b7a-4fd1-87dc-c09d87b39d25", "comment": "Malware payload", "value": "1bc3cb9272bea8af789e1b0554abbcad", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771491, "uuid": "5a993fce-ce4d-4f08-a4c9-0908c7e943dc", "comment": "Malware payload", "value": "c4f541577c1379b838533bf1ea636688ac6bf2f6827a21f9c842e622a3b498f2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771491, "uuid": "4d3c0cb9-59c5-4b1f-a1ef-820cd05fa85b", "comment": "Malware payload", "value": "115064cd7876db1321d30d8380f12e7112cf6ec6", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771491, "uuid": "af4bb355-98e1-444f-b749-844f58e5d739", "comment": "Malware payload", "value": "443cec0112f36458820a1e51031dab81fc17adf3288371b08e39fd3f82b49881d684ce43da29f41116ee23d11d854e75", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771491, "uuid": "e88c3d12-55c2-45d3-979f-62b4db01b245", "value": "T1A7B3120D841EC80AB4EBB872CDB431D75010FEDF1C7700857695E5A4E2A76A8D6EAB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771491, "uuid": "d274ee11-6a48-4c65-947a-eff459fc97dd", "value": "3072:DSO0pDXfYU8bG6J0+ghI3QefE+UiUVwCS2oVrBP:Q776JkhIf7U9VwCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771491, "uuid": "cc83b82a-8b1b-432b-9a52-9ee2b232fecd", "value": 114940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771491, "uuid": "c39b7442-c904-471b-b8c3-62136eff9e4c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771491, "uuid": "a0a151a0-3a4f-49e6-b6dc-5edbbbbdcd8c", "value": "Payment_Receipt_Swift_50%_Against_Order_Confirmation.pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d4393a-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780729445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729445, "uuid": "49e7d458-766d-44e0-aec9-c098f0dafc6f", "comment": "Malware payload (PureLogsStealer)", "value": "b7513a69ae95d72dd703962d2ec323ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729445, "uuid": "6671b54f-aae4-43d1-9187-fb5d2e60abd9", "comment": "Malware payload (PureLogsStealer)", "value": "c52755dff77ce635cbfbc96ce0d74519584cef8b9721b3f48210d3a71be4ac2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729445, "uuid": "dd677069-29cb-4a1c-aa18-b7d2b06f3e54", "comment": "Malware payload (PureLogsStealer)", "value": "3c38b356770debdae4896754f568ee1377e2b74e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729445, "uuid": "9257054f-91d3-4d44-8208-44142a905e2a", "comment": "Malware payload (PureLogsStealer)", "value": "10db2bce771a83450e87a3c47e86c1206059d5fc5a29a9e72e9a62ec54d40202fcc292dd2b517bcf2339991fb29de9c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729445, "uuid": "0df11582-6b80-4d6d-a22f-3fe1b7542561", "value": "T1F56523787E9BC033D0170B79946AE1B573784C9E7612EA189FFABCDFB6522395900390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729445, "uuid": "0754c82b-928d-4fd6-b233-49e4bafe59fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729445, "uuid": "eab38c94-f036-487b-a3a7-4792fb01eabe", "value": "24576:Jnk4xnVFHFYxjyJ0iTaZeQ5jRF/c7DJv9u1yode6+eNPmxQP:BkoDOiae8FFC99u1yob+elLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729445, "uuid": "9aec1684-50a7-4704-a74e-7f9df0d4de9c", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729445, "uuid": "ed0d7649-ec41-4dd8-b9d7-13f8d78335b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729445, "uuid": "d3025d36-8b2f-4271-9d52-c1f1958dd200", "value": "b7513a69ae95d72dd703962d2ec323ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f9846a-61cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780766732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766732, "uuid": "12c81373-fa02-4523-affe-6470dfdfd9a5", "comment": "Malware payload", "value": "167c02c5c06eec8819201259de0d39a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766732, "uuid": "ea314c68-18d5-495a-93ec-67e173e2c94c", "comment": "Malware payload", "value": "c72d45a04bea65ca34b7ec1fec9de83caafba85182d829b8cdf748b433eb3c34", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766732, "uuid": "6d39148b-b143-416a-9104-162c603f52cb", "comment": "Malware payload", "value": "195aa20b206f2c35a6344c687ad6e632b1a951cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780766732, "uuid": "61e93ead-7506-4654-977a-189c5ea36277", "comment": "Malware payload", "value": "7282e2ddc6ca23ce6bc64dde141c5fa98e3e6efe10ceaa509594c9dca0b949f25fc0e77384828607bb513c1c66100ef9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766732, "uuid": "049871aa-b531-4326-8ef0-90d441b6cdaa", "value": "T12361E6EAE831A934781C492E325B30D84C826EBBD4727E1D360E7D27454C58DA7BEA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766732, "uuid": "875f1e81-d1fe-4628-8524-21f6fd2bab3a", "value": "96:cGfk0EZL0ra40YtJ0pJG0ma2402Y8M2x02R0L0r920Wyh0BHdWl5B5q5su:c4OphP2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780766732, "uuid": "e6e59162-c6f6-4cd8-b666-a69f86a02b64", "value": 3283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780766732, "uuid": "46cd3564-8f17-430e-adde-4770512fc9b2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780766732, "uuid": "131578ac-6211-4174-a1dd-ca22c4e64c2c", "value": "adb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f349782-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746771, "uuid": "34833358-6146-4126-b54e-a98f1f6ba5d9", "comment": "Malware payload (Snojan)", "value": "8875584bd43cc082915b2ec0bd27f382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746771, "uuid": "93f85d22-1b54-48ca-b7b2-5c14b0c9b42b", "comment": "Malware payload (Snojan)", "value": "c7455d22061a82be0264febea1c8f0a854f5fafc210dc2b64cdd68ea46c99919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746771, "uuid": "759a8907-9c13-438e-8b10-cad501d74146", "comment": "Malware payload (Snojan)", "value": "d677a26a407e3ac6aceb4887a0cf01ffc236bcc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746771, "uuid": "986b4e01-2f11-4197-bf13-1aacf40b528a", "comment": "Malware payload (Snojan)", "value": "e0e38d6e37fe0e14d06e48d2e4f2cbe1b944fa6352d4e17f81618b008511481d0eaf16e6edaac0e2bda7fb58ec3dc462", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746771, "uuid": "ce547274-c847-4445-b0f3-0d27a3740714", "value": "T1D1345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746771, "uuid": "03fade9d-8702-41ef-b023-80a8b9e48485", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746771, "uuid": "e74cf1ce-2239-4228-9c06-c38d31757af2", "value": "3072:FJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/W/FnncroP9:PwDeM7iNEkgiOb31k1EC4J/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746771, "uuid": "684840b0-6a2c-49d0-9dfd-3e945380e1a9", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746771, "uuid": "2e1a578d-5c22-4d9f-a905-3ad488beb1bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746771, "uuid": "2b698345-be43-4433-9a41-8a1085e51539", "value": "xLuEg4lqj7jS53ts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109d1bc7-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746693, "uuid": "cdb52e21-b975-4813-bcf2-d9065fad4066", "comment": "Malware payload (Snojan)", "value": "b0fe5210674debe76965641cf83e7cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746693, "uuid": "d483d63b-a91e-42a4-90cd-9eeaaa72bbdf", "comment": "Malware payload (Snojan)", "value": "c7aafcb84ba6126cf48aa476c7ae35c5e26ab5eb85bc83533882324fcef8be2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746693, "uuid": "141392d5-f1f8-4cbd-81ad-745441a1e830", "comment": "Malware payload (Snojan)", "value": "8fc9fba87a912b19cb3bd55d1ad7fd5b4ca280a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746693, "uuid": "63e91f3f-f241-456e-9be6-17123116ce4f", "comment": "Malware payload (Snojan)", "value": "0896903da6c4aee47e068570ab7850ee8b5a338ac6975f235c4f29a27a81f89b29e2e49c2675576201e905b96ea90eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746693, "uuid": "ba8e7c93-7f23-4850-b964-a29f9b8d8cd9", "value": "T197345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746693, "uuid": "4416b0c3-e9ae-4234-b3b8-9388748e0b15", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746693, "uuid": "b46728c7-885e-4d58-91a2-3d23ba077314", "value": "3072:FJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/c/FnncroP9:PwDeM7iNEkgiOb31k1ECqJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746693, "uuid": "54dfbe32-1bd1-4a23-943e-995d900b709b", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746693, "uuid": "229f71e9-5e5e-4a29-8872-1cf673de0bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746693, "uuid": "209f9044-d490-41c2-aab8-88d5c38da592", "value": "2d19sEVLy1JbR3cZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18333a0-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747366, "uuid": "a0fcb5f1-f03d-4b0e-b46e-566263f75e34", "comment": "Malware payload (Snojan)", "value": "3dd933fc06c21c7d9b46acab0635ba9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747366, "uuid": "e84232b6-a0e0-4d8d-91ab-d6fb25caa660", "comment": "Malware payload (Snojan)", "value": "c7e9f8ffa8d7b6f78a233d930605dcbe7e800a1652120d1ea16f8d2a5dec9c74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747366, "uuid": "fa81b1b5-192b-4068-a7a8-2cc77cabb127", "comment": "Malware payload (Snojan)", "value": "3336a6fdaad126a359c0217a73413e932f40f6f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747366, "uuid": "570bd44a-b476-499f-8a80-b53db266ad7c", "comment": "Malware payload (Snojan)", "value": "d3fe3ca6050bb44e971e0d0c4133efa05afb394df07663ce9967da010f9c39207872ea7b44800f7dc978ac38df527e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747366, "uuid": "8c7fde8b-7d6a-493d-846d-f86b988bbe83", "value": "T172F3021646DB58F7E49B12BD469DD063B2FBA06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747366, "uuid": "b6a70d90-eca3-483c-8530-ac26003a89ff", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747366, "uuid": "a8c23b7a-408b-4212-aef1-05e127436e18", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+QK:QJ0TAz6Mte4A+aaZx8EnCGVuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747366, "uuid": "a67d9068-678d-4a8b-9b5a-d91264e4097c", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747366, "uuid": "50ea0530-1d4e-4375-942a-4e919a124d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747366, "uuid": "5aa697b8-7bd3-48d3-8389-96f7a6d42265", "value": "sMuhzvJOSCCmjWgz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ee98fb-6174-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780728992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728992, "uuid": "a3be666a-3f2a-4f65-babc-244da87dcdf8", "comment": "Malware payload (Gafgyt)", "value": "1e24094273016d4cf25aefd7feff0d06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728992, "uuid": "575e481c-0480-4bd7-9ddb-af81c77e2adf", "comment": "Malware payload (Gafgyt)", "value": "c873e0efda14c37fac014dc3a8ce73fbeb62ac3a5c8b2b8651acffec0de5e8e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728992, "uuid": "5245a233-de82-41ab-9ba9-c862f8cdac52", "comment": "Malware payload (Gafgyt)", "value": "87ca96f4a0842ffe5b27d5d3fde995de31aeba5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728992, "uuid": "08c8fb63-932a-47e6-b4d3-029088ad807d", "comment": "Malware payload (Gafgyt)", "value": "cfb31c2b806b154c1b0be225829f762a6dcaffcb05aff954c6ff6672efa857d0c556bcc3aa2c26c347d0ff9e646b748d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728992, "uuid": "7787d15c-b26e-48a0-be00-34a76a3235ab", "value": "T1E0F2F112CB84E8F6EBB44E79E6D45C421B3C3B1DAC8BF864059C96653F41443BBE1A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728992, "uuid": "bcc5703e-0049-4b66-9fdf-f9365545c11f", "value": "768:8J7Lij1AWqPUiXh8NpuAVQpkGFi2Kv3eiY/TY9coepQIEW3UgD:8J7uG1sih8NphQVKv3eiY/OgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728992, "uuid": "f9dfc2b2-542a-4f7f-81c2-d7f280ef1baa", "value": 36288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728992, "uuid": "fc433036-94c0-4e11-8dfc-181832ae8246", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728992, "uuid": "9e8baee8-765e-473f-aaba-64b3c54061d6", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2e26d7-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765716, "uuid": "cb9f58f9-ed9e-4fd4-afc6-60cfd59f9b3a", "comment": "Malware payload (Mirai)", "value": "376ab457decdf8162fb8037a245309e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765716, "uuid": "1671e8a6-6f04-40c0-928d-5bfd0d341362", "comment": "Malware payload (Mirai)", "value": "c91a922543d0cb30e112e0e9d5d475974eab37f764ce172bad0a0f5affa85835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765716, "uuid": "e4c538c8-96c8-4be1-b670-ccf8a7f12631", "comment": "Malware payload (Mirai)", "value": "08eda2ee34e5682be4de44fc12aefc2b8dc3aee6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765716, "uuid": "39ccf065-0faf-4bda-89ef-d4352c8e876d", "comment": "Malware payload (Mirai)", "value": "6d6f6f7c1b00def8eeb4d3aece30898b2384aa1e336d4203ec9a8fd71f21039bd3d1ce67a3ead488c042d25261c1bb93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765716, "uuid": "9d7111d4-a493-4c1d-b584-1247beaa5d55", "value": "T1D1330B96B8828A15C5D413BAFE2E118D33236768E3DF7212DE106F14778796F0E7B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765716, "uuid": "1d981e89-2c47-42d2-b6e0-28b8d6908647", "value": "1536:JdnqNGtwGZ/OrzimUUjEOjeLjI6iR3An4r:OVGlszZUUNt3An4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765716, "uuid": "f284167e-aefa-4dbb-99bd-49f2255d1b30", "value": 54400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765716, "uuid": "98c4d28a-4033-4b9f-9563-aa6514225651", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765716, "uuid": "c1c05e21-09d5-4eb3-b560-b56ad519d259", "value": "4de1fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c862ec-61b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780756037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756037, "uuid": "fd7dfde3-6dfe-463b-aac6-603f74f2d1ca", "comment": "Malware payload (Mirai)", "value": "68c02e3840b77c21dd01e85f976c1f98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756037, "uuid": "6d552490-de90-4350-a506-621382ca35cf", "comment": "Malware payload (Mirai)", "value": "c9327c3b14413dca16ed98af473eae125d3c1b9cad9b2b0d9dedcb9cb57b9068", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756037, "uuid": "39d8a038-3f62-4c1f-bcf6-40ec83adfb0f", "comment": "Malware payload (Mirai)", "value": "062d45624f80530ce39e0bbba0a426d80c0285f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756037, "uuid": "8d8960eb-afd0-42ef-9c91-300041aa8188", "comment": "Malware payload (Mirai)", "value": "f56f389da02a31ff036251bbf5e983e9a75a803f4925fbe2c90ad3e1e40a96629c7a018ba749b93696d6878809784ee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756037, "uuid": "a857dd34-c817-4e5b-9401-0bed77069e03", "value": "T1B3931986BCC1C612C5E0A1B2FB1F91CE371643A8E3E67213DD19AB19674B8A70E3B155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756037, "uuid": "0ebe787e-35b2-4794-881f-ed0974ce8fae", "value": "1536:e/TnJzkSTyNHjmdrIVmpY2UKTBsQk45+UJ/Qr1KTIRuAvi:e/FFTsHyccp60eJa/4slW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780756037, "uuid": "ca5f3a09-761a-404a-bbd6-13cb6b66df13", "value": 96728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780756037, "uuid": "b27efd5a-5fb2-4837-accc-5ec4bd2cc5c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756037, "uuid": "d7a1caf8-faab-4f0d-9ca2-994c1972e82c", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c5c41c-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771344, "uuid": "f3ec5e71-b680-42c2-8c95-5e58bfdfa5f9", "comment": "Malware payload", "value": "72824a7ee0c1c8879d90a4bb495adeb1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771344, "uuid": "ce5ba27d-6177-4eaa-b5e8-436ce5859fee", "comment": "Malware payload", "value": "cb2e24b2b95e53076ca8867bb1074e6d1814c20ebbea5912c6203cd3ed6633c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771344, "uuid": "b6472901-b35f-40c0-a5c2-b55e79839060", "comment": "Malware payload", "value": "6020e2705d0c9fb9adf927b50384579f891e7790", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771344, "uuid": "28f4576c-7537-4a53-8066-ace20c1e78ac", "comment": "Malware payload", "value": "5acedcfd634fd35e0401dd8594b34acee53a50f3db6c66a36a93d3b5525403b7755756498420a1e2a33334af09fc3026", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771344, "uuid": "af6e5150-5ecd-437a-ac2e-7c493419b897", "value": "T1546315E3A204960F99C5244EB67F3AC5E3872946805232F857E544EFFBFE5210DB9392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771344, "uuid": "94e96320-44a4-4da1-835e-6b9adffa785d", "value": "192:cEEg05ad1Q01R2YsoPFnSQenLbo6WGUa/NJZwxlYuyEIUO28AEJQSumSRPA9Dzr4:T05s1NSBfdJAWyOvQSuZPADzZ60y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771344, "uuid": "26e8b504-ada6-4232-af48-6ced56d6ea47", "value": 73074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771344, "uuid": "8deea231-bcb0-49b9-a571-5f03173a9f11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771344, "uuid": "70ae4a35-7169-469b-b025-563a656dfd6c", "value": "Swift_00023140k$_(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf432af5-618b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780738826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780738826, "uuid": "dd24bc9b-8e06-4c08-aeed-532f02153c83", "comment": "Malware payload", "value": "250dd5af6a89f39060bb178030f60cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780738826, "uuid": "03c0c6e9-1fcf-49c8-9fa1-1ba7525e179e", "comment": "Malware payload", "value": "cb47ae11e0a5aca50577566e47a98d9d07f93269d63946a3cd02239a0ca60f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780738826, "uuid": "54aee289-d711-4ad3-a7de-1e9177b3907c", "comment": "Malware payload", "value": "2fb26b1ff2e3341825de57d25953dba4387acfeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780738826, "uuid": "8ae97953-1cf5-48b6-b1ed-b98181092130", "comment": "Malware payload", "value": "61267a94bfd22c21669429ef3337905e258eddabf5c6545d2553503a3618283f49c64acf9c7c9c9ce82243a429429f17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780738826, "uuid": "96071ceb-f7c7-4c99-bfc7-cfae3ea4cfdc", "value": "T15108339CC191C22DD1A550B16DE05EC0B1C9996BBF3E16097A6EE72C336A5C032DD3AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780738826, "uuid": "8beba0a5-840f-4637-a2c9-7a5a622604cd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780738826, "uuid": "49677628-103b-4a76-bd10-ca30755c4f93", "value": "1572864:lt9IKPWCq0RWYCIRgBlSY5OCKe3Qrn2QEvcQwZUZS77:lUKOC1RWJsL7e3QrOvcQuB77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780738826, "uuid": "be355082-f61f-419b-beb5-7983d39faf6c", "value": 77474763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780738826, "uuid": "889362fb-1747-4e6e-9277-d3d573c29686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780738826, "uuid": "9b658e83-aeb6-4a58-a07e-71325ae111df", "value": "Install_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb22827-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780771493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771493, "uuid": "fe7c8c74-f428-4b42-aced-6c494a5484a0", "comment": "Malware payload (PureLogsStealer)", "value": "7c448aac93cc8497c91e36d38d56dc4e", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771493, "uuid": "7f0a17bf-cd59-4b56-bb77-55a4731bcca3", "comment": "Malware payload (PureLogsStealer)", "value": "cc237eeae74df7eefb8721f329c6d8c52f83d636547c6f4fe34b4a565e1ca227", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771493, "uuid": "e6ab81fa-f459-42cd-8e45-f8272a07a5ff", "comment": "Malware payload (PureLogsStealer)", "value": "7487d7aaf8b279f6f5b1248733badae12fc82de2", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771493, "uuid": "4faa7c1d-8c10-45bf-b528-b2f3aa49b135", "comment": "Malware payload (PureLogsStealer)", "value": "cbd3c54f37334aabb543c3b0ab3a7d6b43fa381a4a06fc066879228355ac0346d332c73726b36293174b11fb35b6d8ca", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771493, "uuid": "099025a5-c107-4f75-9855-325d6a131081", "value": "T17CB3122B030878A59B570B26D71656F8441CDA1B4F378A365E438A2FB0F4C7D68DB6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771493, "uuid": "e7743ba1-fce9-4263-94d0-c4452d202962", "value": "3072:20hpW2tlOZJhpeFWBSr79jILJy8BY69+pdAjdvh:20hc2vmwWBS7a08BY69+pdAj5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771493, "uuid": "c0fcde34-bf89-4203-9dcc-eb3400110312", "value": 117672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771493, "uuid": "36de6e03-7c8f-4009-af2d-da50622aecfb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771493, "uuid": "ab162b2c-f818-43f5-bcc5-e047b9198f5b", "value": "PREXALERTX510739420.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55041af5-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765706, "uuid": "71d5a497-28e9-4ced-9d98-663c37de7a87", "comment": "Malware payload (Mirai)", "value": "08424949c5468d418e15bdb64b96d23b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765706, "uuid": "199cebc2-ffee-4995-af0d-c08fc46f4af5", "comment": "Malware payload (Mirai)", "value": "cc9f61599c20cb015cade6e6daacb69c67712032b89003cbedfceb0ab49335c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765706, "uuid": "67355ec7-d11a-4a64-ae48-0ee51b3dc68c", "comment": "Malware payload (Mirai)", "value": "cb0560013cc814e9232bcec7dd9ae8c72e9f8611", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765706, "uuid": "6013991e-dbe8-460f-bf67-960de59edffb", "comment": "Malware payload (Mirai)", "value": "49795cd5f5b24b94c69142dcc5bacdeedf65e70b97fb0fed0ca9c6d76a000da7fd29e81d7c8dbdf87ac7cb274d08b39b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765706, "uuid": "b164202c-78e7-4d32-9600-a013972d4b78", "value": "T1DE233921B9391E17C0D4A87A62F7476CB2F5074E29E8CB4E7D720E4EFF24A9065076B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765706, "uuid": "68149ec1-23e0-4bab-96a2-07df8e93a800", "value": "768:IMokadtq9UL15YKxjRSD9mXfGM+178Hnm2SYO+v:IMvadtSUL15YKxNw9mXu1snNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765706, "uuid": "bddcc6db-fb67-439e-aab9-77ffbeeac04b", "value": 46740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765706, "uuid": "19028ee1-d098-45ad-a020-8ec0a7e1c155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765706, "uuid": "57c28c8b-48ab-47ed-97a3-68aab541f19b", "value": "7dc165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9ba0e7-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748086, "uuid": "78f37a98-5bfa-48b1-9dfb-9130ee043f8d", "comment": "Malware payload (Snojan)", "value": "65d59a4c2c25abb51d763a458034e62b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748086, "uuid": "3464c1b2-1a86-4c40-b4fd-d6fd59cdb512", "comment": "Malware payload (Snojan)", "value": "cca86781ed71d6e859e68ae09db4732616f7066d337d559958fba7e16856a3e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748086, "uuid": "cd859dc1-dc29-483e-aeed-3f5aa976c8c7", "comment": "Malware payload (Snojan)", "value": "4ca45ad4a2baa734ca9b77797f8d7d7250c014a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748086, "uuid": "a1fedbbb-d1ea-4ba5-8087-6a969d328dca", "comment": "Malware payload (Snojan)", "value": "ea6d7497d758ff495c52b752190c9bdf45a22cff8687c8b2959e562d291a7020f8522aa36fd11e62d504dd1ef9f64860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748086, "uuid": "97feb6ce-3b86-4559-a6b7-0688eae00049", "value": "T1CC84F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748086, "uuid": "949701f4-98c3-4508-a90d-df748effe17a", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748086, "uuid": "ddac62e8-b9e9-4736-89aa-62bbf64cbd20", "value": "6144:NrFZaaZmEJudDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uVh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748086, "uuid": "5b1565fe-4d65-4742-aa54-753fecea7b3b", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748086, "uuid": "f78f4d3b-cd95-4f41-8ed1-747d775c228e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748086, "uuid": "1d9d4d7e-3e63-49fd-9f4a-49db11452c07", "value": "DTZrkdqu6DIZIu6Y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1614e486-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780729093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729093, "uuid": "9653048c-2326-4d1f-ad78-f32c3f7a019b", "comment": "Malware payload (Gafgyt)", "value": "774b8e6bb321d6be4f1b93160c6b74d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729093, "uuid": "f7c98392-5d73-46e8-9765-fdf402bb8212", "comment": "Malware payload (Gafgyt)", "value": "cca94012b2a00dd3b0fd950f0dd80deedd9f3e09b74dc6469e13b3b5525ced23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729093, "uuid": "0a47d5ac-232b-4f53-a7be-303c95ef871b", "comment": "Malware payload (Gafgyt)", "value": "125fd794402a29602ecb469e164a80cd75d0d7f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729093, "uuid": "788db25a-06ac-47ef-8e62-61902886bbae", "comment": "Malware payload (Gafgyt)", "value": "5b2a937529b5db84fec8ee10a781a9c995bd87c31484db71bf1a4010e4a9869f7f30dee24a3e8fb9c17f9b299cc5d6d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729093, "uuid": "0251c3cd-a1df-4aac-b669-b4b9de4e91e6", "value": "T10003E1FB4133F4F8E1BD483AAB640584FE54486751968B7F08ED903BE8F28813923768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729093, "uuid": "75bc46f7-6b49-42c0-964c-4f9cac23517c", "value": "768:FRF6MBicojh5QtW7cLGUm86U6cYNJQtzxrYLdj5Wsv9sPw:FRpoUp3m8L6cYNJQrrsXvFuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729093, "uuid": "2e6868db-8bbb-4afb-9ecb-c62fbbd21606", "value": 40012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729093, "uuid": "68ef1400-7e6e-4eec-914c-65fe709b01e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729093, "uuid": "f0ad5416-ce17-4a53-ba79-b2bb87df1e45", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f3827a-61b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780754618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754618, "uuid": "4e0e5725-c75c-46ec-9829-4c28a50cc1e9", "comment": "Malware payload", "value": "e41362c3eb99dd5ce5d915b23c6cdca1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754618, "uuid": "356fbce3-4eb1-4ee1-92c1-8c6287a09b45", "comment": "Malware payload", "value": "cd4762212239b02973e6c1f70cfefcec0fe8a11a3ab04023d6be784b91a6fc2a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754618, "uuid": "99e1da3a-3575-4b40-af8b-d48611ce7393", "comment": "Malware payload", "value": "457ec4d688ea8d66326afeb45a9ba80c327ab186", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780754618, "uuid": "99bc7cbb-3c3e-4396-ac31-eccc77c0e147", "comment": "Malware payload", "value": "cd05727ca2684b5dfb5dc52345cc59c6e3cba8b35b3cd83fc5b0f5b0409e0cd7d1a3f063142487531c7d9c8aa95ed3c4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754618, "uuid": "14902c0e-c0bf-4ab2-9232-4478dcec7691", "value": "T108137D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754618, "uuid": "011ce64c-7e36-4d95-a45d-b6d6aef3023b", "value": "768:3r9NyXsZztCb9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bHusZhco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780754618, "uuid": "51516561-a3d8-467c-9c88-eb6dd0d2bc80", "value": 45501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780754618, "uuid": "c5c3872a-4cc4-41e1-8f59-ca96c9a56865", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780754618, "uuid": "67d1a71a-17e4-4f15-9776-9120b3a97d16", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4f66e1-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746714, "uuid": "9a77da0f-0da6-498a-b5e2-3d473b86e612", "comment": "Malware payload (Snojan)", "value": "d8b2745991c1a4c68f34b8d56bb90b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746714, "uuid": "a0ffe98b-2c04-4745-8330-3c14ad1f8e35", "comment": "Malware payload (Snojan)", "value": "cde0a598b9ff12324a92c74e27e5ac3026ceb80e39ab6c3d3c2e8f1a64579cf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746714, "uuid": "63af96ee-6ead-4b2a-bf03-9d67857d5601", "comment": "Malware payload (Snojan)", "value": "87441bc8a5e781898e6281d161fe2eee3950ec66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746714, "uuid": "bc43ce53-9120-4ddc-a5ab-b2470e399fa6", "comment": "Malware payload (Snojan)", "value": "91c723ece527d95f2087f91ffee0b5889ef33bcfb280af802a967d96cbdd8e299805b9074025da0fe32db8f5ae856f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746714, "uuid": "0a108f88-c1ca-4aa6-86a2-1a0c13c1f7d8", "value": "T18B15222471C0C4B3D46B413544C9CA72AA76707247BE99DBBBED63B9AF203E163342C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746714, "uuid": "a33f31b4-3f09-4b8d-8530-07c3385cd00f", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746714, "uuid": "105e3c1b-899a-4e15-bc32-e0d1095b67f7", "value": "24576:/Y+2k70Trc18BSnLW2CRBKViu99LK1Rad6yZcTx:4kQTAKYS/v6h3+1uhZcTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746714, "uuid": "d03048a3-697d-4f13-8ea3-7302cbe4062e", "value": 923104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746714, "uuid": "83681d68-767b-4a34-b859-851a3ad1d4e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746714, "uuid": "2dc70689-eb45-4e94-b1c3-0664f45f7e7f", "value": "g5JV7Cc88RNhGorU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bf2a42-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780729094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729094, "uuid": "6aa638d5-bc46-48d0-935e-699e84e86c2f", "comment": "Malware payload (Gafgyt)", "value": "9198eb1b748834fbcffb27fd07d2614a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729094, "uuid": "ee871460-884e-4d2b-806c-32bb715a58d9", "comment": "Malware payload (Gafgyt)", "value": "cdf16fe0e568c5307463a4553c5e8e1ec5fce43b9c08841b2821476cbd6cb268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729094, "uuid": "b55c158c-27b1-4ab5-9d67-8eddc9070843", "comment": "Malware payload (Gafgyt)", "value": "e9930c74c589fdb7ac2fc51d77194ef5b0e053d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729094, "uuid": "9b096137-000a-46af-9af0-0a78a7857c96", "comment": "Malware payload (Gafgyt)", "value": "53c4bcfbdf9730a6dfa41719e3d177947db33a92404fbfc4757da0a445c338581cf696e932d7daa1520e86656eccfe20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729094, "uuid": "39864d2a-d760-40b3-bedf-4b4b25d88789", "value": "T1D3F2E19171AE574AECE5807C089D3A049824D31AD3E031B8E5ECF47BEE53F694E9C25B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729094, "uuid": "dcee8094-ac33-4027-8f37-142fab259c82", "value": "768:fYYH0WMhwYQX6DnqPgcGZvV+nExFyp4jcGFRJaUBbKnbcuyD7UWyqP:fYYU57U6DnDLvV+EFjcGPJaUNKnouy82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729094, "uuid": "de9f110d-44f7-4493-8ae5-9a8295dc3fef", "value": 37108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729094, "uuid": "db1a8998-6c2f-411c-89f2-2e023faf6a8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729094, "uuid": "f57b4c72-9ee0-4928-813d-cd762bcfd436", "value": "I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9ebab5-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729377, "uuid": "c14e2427-6ebd-4195-97ad-b70eae0f3593", "comment": "Malware payload (Mirai)", "value": "d04119490074f43fbebaca3f57cfb722", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729377, "uuid": "6188ec39-d265-479a-ac43-d06a26461808", "comment": "Malware payload (Mirai)", "value": "ce29b07f1fc85c430755a16075f9666a3ec78d83f5170dbbdf6a1523547b2520", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729377, "uuid": "c9e22057-25ff-40c0-8566-22777abd8a2a", "comment": "Malware payload (Mirai)", "value": "66614acd1ac2c5cd581d20f76d7e6236efada600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729377, "uuid": "779b93d5-f387-4d09-8362-3f02b80f5df5", "comment": "Malware payload (Mirai)", "value": "3358913e2fc96d8c847bd6674daf6954228cdbf3a3df178a763240d909e934d56c3480207bd3cad921f65137fad12c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729377, "uuid": "752939c8-18d1-426e-b29d-28b0be7c760e", "value": "T141E47C6377218F98E361D27005F38B655AA4215307F281C6E3BCD620BB50A6D6C6FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729377, "uuid": "774530b7-0b6e-4de0-a558-792611b94af7", "value": "12288:s4oSOVB49pc6NW1McErq0fT8Xp4SEGqWGofUq7W8phgHKvuV:Vol49pc6NBJrq0f4EGZGBqOq2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729377, "uuid": "5d40f010-300c-43d7-82e0-d17f0a841812", "value": 717692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729377, "uuid": "89771994-9a6c-4c8c-846a-aa338ff8ddb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729377, "uuid": "90a7d3f4-1a64-4268-9360-51ea1dd5ae24", "value": "kaizen.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eda733d-616d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780725752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725752, "uuid": "e9fa4246-cbd6-4f99-ae1b-6752974fb119", "comment": "Malware payload (Mirai)", "value": "3888989d06c131f9ee3d401466d6584c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725752, "uuid": "8aafb572-3708-44e4-b5ea-7a4bbfd2e0e6", "comment": "Malware payload (Mirai)", "value": "ce3eb59a08f333e034396ffe602a2301dd8429e18f244ad0a435cf72fa13a60f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725752, "uuid": "185fed34-f69d-4ea7-9c18-ab90f8aeac96", "comment": "Malware payload (Mirai)", "value": "327088678c967c8363a5aa1fb7439e098708649a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725752, "uuid": "b218c758-c09b-4924-8e4d-2bf2a48d88ed", "comment": "Malware payload (Mirai)", "value": "5470606dd205056b66be3fead883ddcd86f18b266d4c120afff5b8422912ff2ffdb2dc1c7482c13dd06f7137c6f3043d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725752, "uuid": "362215e7-208a-40fd-a883-05fde19fc496", "value": "T18431C9B9F178846F4650EE01F7E8098BF0BD77DE50A6D66DB467349440C94CE322DE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725752, "uuid": "b78ee64a-5e72-43be-ba43-cbf7e178ae59", "value": "24:brH9cCF9M95tmbFFKBoPNIB2/KFn6mKP55KBUB9PWBMB4BQBjr6NBQBmNa9rn2D3:rXesM4WKP5pn2bOP70v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780725752, "uuid": "b332ab1d-ad88-46f3-a7dd-95856a1d09db", "value": 1816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780725752, "uuid": "09dc84e0-7e7d-45d6-ba0f-a1bb660208bb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725752, "uuid": "6c893642-2697-4e9c-b78f-3d004c50e967", "value": "zb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d022efe4-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780771496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771496, "uuid": "03f8b013-23cf-41bd-bd84-39f53821a4f6", "comment": "Malware payload (PureLogsStealer)", "value": "3744114d4f933e80ec4c13d74958bc27", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771496, "uuid": "04327a70-9a1e-4fbd-8b71-64e10926279c", "comment": "Malware payload (PureLogsStealer)", "value": "ce5768c813e1acc449d0dd4af0bbb2db04d3ed87ac516ca265aff99340b54160", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771496, "uuid": "f9bbd28e-aa81-4353-bba7-f2ca2215dfda", "comment": "Malware payload (PureLogsStealer)", "value": "475d6f3cd08c5edd19993ace8c1a758c49739f37", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771496, "uuid": "8d4180b1-5855-4054-b960-3e18d2b35d1d", "comment": "Malware payload (PureLogsStealer)", "value": "6264c74fb6e8542b03fecd9a87b750507b062af0e27c8c83077b070ca2d0770c0bbbfc7c31b93134d8ec6df24feebc55", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771496, "uuid": "d93b537f-d59a-4354-8301-a14337aa7196", "value": "T16BE322357907679D1439C58E7D8FE50F27D58C764EB8323039EA8003AB97B91E2C5E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771496, "uuid": "41147500-0b09-4fd8-802b-4b394ceca3f6", "value": "3072:DPF4URZEay3b5HI9KhGM9dBFDkpqnhdyajIZQH141akdL9C:DPFBwFIVMvBFDCaQQHa1lx9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771496, "uuid": "c5cf2ed3-a082-4a23-b6b9-4fdfb98f9011", "value": 153191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771496, "uuid": "4a34bd36-b9fc-4f19-a556-d34f2022918a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771496, "uuid": "e45b45c0-4c4e-458d-ad09-8b701dab5719", "value": "PurchaseOrder_00871_Shanghuigou_20260603.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4987a7a7-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709422, "uuid": "7efe4d1a-b54a-4aa8-ad65-2b16400de07e", "comment": "Malware payload (Mirai)", "value": "457f83b14bf4e342af866fc406e6fade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709422, "uuid": "2d3fe358-a67f-4664-ba3e-565eda912575", "comment": "Malware payload (Mirai)", "value": "ce7c1638e53f1c108f0e758d4c9eeded78d7059dbf20cf8bfd0eb5acf56ee0c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709422, "uuid": "0b6fd6d7-b781-450a-8955-76f024940748", "comment": "Malware payload (Mirai)", "value": "f36b2469e6fa43ec876e18b993b794646d688d7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709422, "uuid": "4398f5b7-b792-450e-a9c5-5d8ba731347a", "comment": "Malware payload (Mirai)", "value": "7896521b7e502a6278476551fb4bf153ae82ea48c6df29bc6ffeb1af9ddba886ca8251b84e98ed947768bc9add6a5966", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709422, "uuid": "c84f49f1-4278-40c2-8705-b44f92255fe9", "value": "T1F0334C4CF793E4F0ED4B0531115BF77E97349F025024DE6EDB94BE66AE32A02A127628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709422, "uuid": "272cf90e-4c19-4e26-9d52-773942fe0d66", "value": "768:1wyHuRYOu/Du1eMGhUJ2ShhpcPRSWwKT6FmAaVHYYvaeVUUYQ31A5A0NfRhfqDOC:1w5RWiY6TpIsO5UUV31A5A0NnTWVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709422, "uuid": "b507c65f-5ecd-40da-a395-0032d9667854", "value": 51340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709422, "uuid": "db604681-813c-415c-ad33-8d1a4423106f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709422, "uuid": "7ac29a45-054d-4274-ae38-166f49a12ec1", "value": ".Sassy.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ee91e3-6176-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729703, "uuid": "c21df587-4eb4-44d9-b06a-83c54a892eba", "comment": "Malware payload (Mirai)", "value": "0b2a65449446290e1c782a6d968807f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729703, "uuid": "c0995a9d-d601-4a19-96b7-f3216c2aa20c", "comment": "Malware payload (Mirai)", "value": "ce9e13e6d947d3b3344ac975e31f7bb44e096d53d7ef14575be3c5d59f229988", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729703, "uuid": "f20ac58a-f204-472e-9b51-89c8b83592fa", "comment": "Malware payload (Mirai)", "value": "e7e99671b638eb933f87c505e7e61f919e212e29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729703, "uuid": "e1501bdc-3afa-4c32-b318-b2a2a476ab9c", "comment": "Malware payload (Mirai)", "value": "b32dec43336114305e8eda5017a5522689e1d44f55777795c8e96c901d953c9a4cefbd727721e4db1aaea01b7d58e94b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729703, "uuid": "ffae585b-4a87-4ceb-a8f7-0f308b914d8d", "value": "T143163A42B6046FA9C924493389B78ED117727E556F325347AB48FABF6CB23024F11E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729703, "uuid": "c14cba61-5f4c-4b00-9f85-ee6a28352959", "value": "49152:Fi8Yzbp7jlFSp8KYRaNykn19BszV6tfW/OzdXKS+73B1:I8Yzbp7jnSmKYRaNykn18zV6IOzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729703, "uuid": "ec0aa24b-0bd1-40e7-98ac-286e8382a1d5", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729703, "uuid": "60b202f4-58b0-47e4-ab88-991c709e2e36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729703, "uuid": "608492fb-6beb-4c82-8998-d789637f9612", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88b4f08-6174-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780728990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728990, "uuid": "014d8af0-b3f5-4f18-a333-66017ef246e5", "comment": "Malware payload (Gafgyt)", "value": "9d439b0da11a1bedefe0aaa64fd31d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728990, "uuid": "6debfaa9-4a47-4e00-b488-6dbf97a428eb", "comment": "Malware payload (Gafgyt)", "value": "cedb10a59c671aa52180feb07ce2085840b6858281bd3604e48bf60c81dd1b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728990, "uuid": "788f53ae-9270-42c1-a096-c7a216294aab", "comment": "Malware payload (Gafgyt)", "value": "f225821729950579d77b486160cfa11909965a39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728990, "uuid": "6305448d-d64a-4e45-828d-d0a22aee3ee4", "comment": "Malware payload (Gafgyt)", "value": "1cd866d3445221e703a9fc1f2c22f622f72fc3c52ac18ab1076f9c5ca9b77d179a0eac035469bb59e638350cc168b297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728990, "uuid": "d40fcab2-69b6-48d6-b92c-877705bfe1d5", "value": "T17103F12106CD2462C0D21CB222AF428E7227DA311EF979391774A73CBBDA5D979785CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728990, "uuid": "770922c0-795f-4c25-b54a-c408185dd7c0", "value": "768:RbDk76rEcs784SVhns+YAhH90G3ZtQ9P9f0rrrUIVoqq3Uwi:RbDa6rEU4SVh08yG3ZtOZArGqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728990, "uuid": "c95a8baa-beda-4a64-a523-5d6d0b85f13c", "value": 37788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728990, "uuid": "7aa0e5ba-3c71-4006-9b8c-1302fa9629c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728990, "uuid": "abd4c33e-b093-471a-8929-a3a2b16bcc69", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bde1cb-61d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780769626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769626, "uuid": "0782708a-dcfc-40fa-bc8b-a96e8e6221f0", "comment": "Malware payload", "value": "06f9be2316c1e1574ea1abb44dea6e0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769626, "uuid": "1f8c67db-f9ec-4904-8d84-48c5015ae61a", "comment": "Malware payload", "value": "cf41e271d28aa826e6e2fd46845754191b40223c8c49223e2ba77c1513a58db2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769626, "uuid": "3edfcb2e-a941-4466-82c2-268d135709f9", "comment": "Malware payload", "value": "6c7440835fa359239807e44f10a80e485b355187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780769626, "uuid": "16bc9462-897e-4e89-8a56-d893a4f7240e", "comment": "Malware payload", "value": "eaad9f1375ef8a8e253ea58e2bbb3855b2674f798faea8cdd62282f65fc6e4c5e80acbc4e567f938516d5ca4256b10be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769626, "uuid": "59b8df30-afff-46e5-a744-e341472b7e39", "value": "T17457DF77920678EDE9B98CB4D01025416DAC788B5778E3C7BAC870E666EB6D08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769626, "uuid": "c6add3e7-ed70-4d56-8656-0121250e8dd3", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQq:cqYUQuVDt0TZEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780769626, "uuid": "2505e064-b574-4579-b8e8-88261bb3157e", "value": 27885568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780769626, "uuid": "ebf03037-2667-4cf7-b8b0-ed2ad940a57c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780769626, "uuid": "7a91ceee-6ccd-4105-a568-6a58288e6bfe", "value": "cf41e271d28aa826e6e2fd46845754191b40223c8c49223e2ba77c1513a58db2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2522e5d5-613c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780704637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704637, "uuid": "285895c0-27b4-4b89-ab68-f9479b240d1e", "comment": "Malware payload", "value": "c9ad70d9b24c78cac9c5ea2d925effd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704637, "uuid": "57273d75-0c2a-47a5-a2d5-ebe227952acf", "comment": "Malware payload", "value": "d02a56de72de2ca706382c64c70dc1edbb2628fc0fc8e890621d29b80edc22e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704637, "uuid": "87d11dff-7d63-466c-8675-440af178a481", "comment": "Malware payload", "value": "3ab889a0c83058050d212f8402d364650d1f9f0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704637, "uuid": "24af1a50-91a3-4056-9ca7-89f4e4072627", "comment": "Malware payload", "value": "1073d8e381e415e9a2ed0d947464f12a147a8a41f32eabed2739ef14aa161ce93624fdf3379e9c22c9487e6f5860c47d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704637, "uuid": "7be61311-56f9-4fbc-a77c-c0a617684c16", "value": "T178462900FECB14F6E9031D3154ABA26F63315D058F28EBD7EA547F2AF97B6910836219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704637, "uuid": "4806e69a-83a1-4660-ad83-e92cf45f360e", "value": "49152:TbS/IkWQ+WY6mAiGfXisToICDMiUcnhKIeD/SbJQ+ZRuq4i15mDrfIuA75Ec:C/IxQbJiGPM/bJXj5QEEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780704637, "uuid": "7326a1e8-8d55-4b53-94af-6ec133955583", "value": 5746872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780704637, "uuid": "28222d06-e2f6-49eb-8842-2736c4689ea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704637, "uuid": "14b88819-50f7-46ac-a434-8b16a334dabb", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4bc315-61bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780760858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760858, "uuid": "59d3fbde-7fa4-43f4-b6f6-641177b7883c", "comment": "Malware payload (Mirai)", "value": "1434c3bcb6734a892490c9eca3544df8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760858, "uuid": "7e3dc3f0-d32a-41a3-a00a-e7b75a862e7e", "comment": "Malware payload (Mirai)", "value": "d0e29f38e0a32fe5e2a054e431a5326e45f3f4424bd1a0a4e8b7b7f37e807335", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760858, "uuid": "f3452a5f-b261-42dd-a472-873f6bd5cdd2", "comment": "Malware payload (Mirai)", "value": "5d38184da0a0b6e1b83ab9afdc06fb1124deb359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760858, "uuid": "7f45e3be-43f5-44b5-aac9-413d029143ad", "comment": "Malware payload (Mirai)", "value": "4fca0ce6a6d49e6fa4db3940b2d3043b8fdd75984a182c3934ab386cf10417d5f5da83c524d983834feece49ab2c1331", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760858, "uuid": "dc535c02-c54b-4f0d-b261-2fb596f3b1b4", "value": "T1D0F36C41771C0D47E6671DF0263F23D183AEE9E122F5B649290FAB8D52B1E325582ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760858, "uuid": "24f7fd6c-4be2-4a75-9d5b-89872cf4dd10", "value": "3072:bb3pvs4s+zNju8dV2JdlHrUQuQNPbEW/Y3gLlQLjtrDDWn8V+:XZE4rxu8dV2JdlHbNPR/CgZQnN/Wn8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780760858, "uuid": "3c9e3589-ea58-4208-ad6d-21c64181c6cf", "value": 157304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780760858, "uuid": "415727cc-b80b-42ca-82d3-51edd288aeaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760858, "uuid": "902995ca-ce82-4a7b-9956-9853cdd6798b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8622ae47-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747320, "uuid": "f97b1af4-499f-47a0-b49c-0501c7e2a460", "comment": "Malware payload (Snojan)", "value": "410a4c6d32dfc9d18641f75e14ed0514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747320, "uuid": "c04f345e-f8bc-40fe-9976-6ff987415672", "comment": "Malware payload (Snojan)", "value": "d0fb86065dc0baef5171b2d9b4db8673dda4b9c68353e634a42ea11ba884a346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747320, "uuid": "e6bb8e92-f248-46fe-8d9e-c44e2d0db0ed", "comment": "Malware payload (Snojan)", "value": "853502aa8e58f03be3e3bfed3b504f068c76ae17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747320, "uuid": "2ec04c67-989a-43c6-8131-27ffd283c1b5", "comment": "Malware payload (Snojan)", "value": "b484587a9879c0f11fdd7f60443e09aa0400301142023fca8203d4f25a3bb7c60a53018c7b6274a4f470f69720d07934", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747320, "uuid": "8772aef4-dbce-453c-89f0-64db553d0915", "value": "T105F3021646DB59F7E49B12BD469D9063B2FBA06F4BCE3EDBE1FC224DC6062B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747320, "uuid": "9dc1c9df-3945-46ad-92e4-cd09939736c6", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747320, "uuid": "7b420908-4dc4-4f28-922b-59fe0dd90e15", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+cK:QJ0TAz6Mte4A+aaZx8EnCGVuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747320, "uuid": "33984ee0-82cc-4c4d-9091-925fe41f4157", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747320, "uuid": "717b8602-eaa6-4af5-98a0-185d8a1fcd36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747320, "uuid": "2dec6191-710a-460d-afcf-f4a3296a0f57", "value": "JSEKImAD0eGaipw8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8173d9b7-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748171, "uuid": "6034c654-9ca1-4240-bdfb-3680a72a6936", "comment": "Malware payload (Snojan)", "value": "19e4c553fe46f1710c0a1e81bc3b4394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748171, "uuid": "315cba08-645f-4ccc-86a5-5de75af51942", "comment": "Malware payload (Snojan)", "value": "d1bee978c18877bc7dda74f9fe7315a51ac821e487604cc817b30e54eb4de7d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748171, "uuid": "784a8111-bc4e-40a7-9695-c3008beb7136", "comment": "Malware payload (Snojan)", "value": "d4e50271a3a0640c976f6853fa8a4211e3ae6406", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748171, "uuid": "9e16696f-f8e0-4320-b1e4-e39238315563", "comment": "Malware payload (Snojan)", "value": "ad51e0bd956f4b3fbec8d00ce4408a3f5774a2378cb5b5a1c80be7aeb1b1ad7a22f859e09a4392287276eea17a70a2aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748171, "uuid": "a0bd57a0-e317-4008-9ca2-3d1983cb934a", "value": "T18484F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748171, "uuid": "36e5f931-0251-4b60-99e6-6f2fe6624cae", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748171, "uuid": "22d3c824-0301-4bd7-9902-b9d5919868f2", "value": "6144:NrFZaaZmEJucDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uKh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748171, "uuid": "9e35bb44-1ade-403b-897c-e49cfdccb1a1", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748171, "uuid": "30423406-c1e9-4b6f-b81e-c700f7e8649e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748171, "uuid": "4c0c655b-a4c6-49d8-814e-646b37f9e3a0", "value": "ywwtnqiAWSiUuUVt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13798a4-61c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780763283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763283, "uuid": "feafbd72-b72a-48de-b978-f6867e16cd97", "comment": "Malware payload (Mirai)", "value": "73fec65a76a931dd2bfc4dd59c45841d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763283, "uuid": "b8eb9c52-6eea-4108-b873-3b242368a290", "comment": "Malware payload (Mirai)", "value": "d2a67aeab652108826675f809512f16317a7dc02fa1b62db05e1455732291c90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763283, "uuid": "0f430f52-0369-4d03-bb03-ab6db5394144", "comment": "Malware payload (Mirai)", "value": "50d32ab37bdea6479807265038ae01caab4d5e93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780763283, "uuid": "fac3762c-ae83-4432-89b7-ba1df0500731", "comment": "Malware payload (Mirai)", "value": "e42efc5d4f491cb887a71f9bc92017c53ce6882b7282778677cadc9610dcde636cb4856567986dd713cb6aa2997c57c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763283, "uuid": "9aebf81d-2678-40be-9950-dd34ed524e12", "value": "T1253302B6D4F51AB4EBFFB5277D69C0D687E22B488AC58DA392E186057EB71130440ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763283, "uuid": "e8693468-52fa-48f4-8652-1fbea75dce43", "value": "1536:kSTc8dNS0iB+9jz9hSqeNG1PTzeIJTZV3Zz4u+qgw09f:kUzdNS04+9bxeNGN1lZV3B4u+qgwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780763283, "uuid": "61ea8b31-450a-4d95-a01f-2c0056539c94", "value": 53048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780763283, "uuid": "8e3041fb-3fef-493e-9592-a5acbcf7d6a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780763283, "uuid": "de02c286-6f31-4c71-95f1-b7fcc98bca02", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd3fe13-619f-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780747303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747303, "uuid": "09355e65-b0c5-4c27-ace5-19f06a43a539", "comment": "Malware payload (Snojan)", "value": "ba6f67a5c5f199e58db4754bff7f2f91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747303, "uuid": "9b6d69ab-cd8e-493a-88b7-205c5dc693f9", "comment": "Malware payload (Snojan)", "value": "d2cdc14da9fb41924b7d82d7b6dab512d03d6b06de1eeb49ed9a58128468bb05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747303, "uuid": "68a6e881-2942-4b6f-8cae-bba70b54d23f", "comment": "Malware payload (Snojan)", "value": "1fdaa9da55bb7d8e956ac8fbe683ebfdda7f06a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747303, "uuid": "c3a476bd-cf3a-4329-a744-af6cee045b52", "comment": "Malware payload (Snojan)", "value": "9e0c428bc2f80e31bd027fe2b51127d62ba3dd18557f13d6f93584159c7330818f4ea0214accf8b167ad1b1f604ae143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747303, "uuid": "10be63e5-f4b6-45be-9c1e-6e837c4e81f4", "value": "T1DFF3021646DB58F7E49B12BD469DD063B2FBA06F4BCE3EDBE1FC224DD6162B01580248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747303, "uuid": "0e84f9bf-c4da-416c-a6cc-b090dbf63415", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747303, "uuid": "55aa1e8d-3430-4a24-98bf-eadedf41c256", "value": "1536:QJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+IK:QJ0TAz6Mte4A+aaZx8EnCGVuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747303, "uuid": "1e41bb0b-2ccf-45ff-9c60-ebc0e3165f43", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747303, "uuid": "4e42432d-11d7-42c6-ac23-22d7c1c56b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747303, "uuid": "a0e4192c-b937-460e-9ad8-50cb50f0810e", "value": "Fsz0AwZzAiliZUji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8029f2cc-61df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780774798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774798, "uuid": "7b8270a5-d000-4be8-b1cf-d9c4a8ba3b86", "comment": "Malware payload (Mirai)", "value": "a793183a6ec1b124ea1838c33ac5dab4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774798, "uuid": "8054762c-df91-4a39-b241-1abfa19df878", "comment": "Malware payload (Mirai)", "value": "d3097b789119bacbf1ff1e8bd4622d5560ff4f2b5181bd2e09b8c97793457397", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774798, "uuid": "a5368416-d19e-4d88-979c-a3e63b243d39", "comment": "Malware payload (Mirai)", "value": "f81b12b5dfe8c5f600bc67cecbc306f3b912af3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780774798, "uuid": "52f0e0a9-8fc9-4b63-99f9-b4f47d6ebd1b", "comment": "Malware payload (Mirai)", "value": "0d13332104887fb4ce14b80cb845ca4a1e1ff9a6436476024bcb199fb59c1904f4f05f1ee237fa05a3865f08355857f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774798, "uuid": "078d7e3b-2e6a-43a5-87f8-58a435b7caad", "value": "T102836BC2E243D8F1E9188131207BF337A632D9B90068FDE3F7589672D466960B64B75E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774798, "uuid": "ff8194b1-e57a-44a3-9ad0-00d983140d79", "value": "1536:tXpUBhIs+UIb0JG1lOzOuOOcNP28eXnYJYnp0zcYQqYsUjJp:tZCt+UIAJG1oSwyPveXYJYp0YJH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780774798, "uuid": "b58aff17-d859-49bc-ab9b-4a02b2cfaff4", "value": 83376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780774798, "uuid": "edd7e7ac-0785-43f5-9bb1-eecb6bbf2c49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780774798, "uuid": "af5dcaeb-3fa8-4486-a8df-c7859a2827bc", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdae0e6e-61c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780761613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761613, "uuid": "baaf654d-3dea-46e5-bdc5-127393fabbc7", "comment": "Malware payload", "value": "2efdd8a51f47834bdaabaa0031a6df9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761613, "uuid": "79513561-8709-4931-8d75-7a3beb16338a", "comment": "Malware payload", "value": "d482cac0754017ccc4e0f3b92c07f0ef4cd6dd394a6e3c7afe1fb928e487aa62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761613, "uuid": "80113787-5ddb-4fc2-8c5e-e7f2db714077", "comment": "Malware payload", "value": "7b7712e2f5fd2f406b041ce2cb6632d2c2c3e15b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780761613, "uuid": "11ff7a97-2960-4a44-b440-41a082032ff5", "comment": "Malware payload", "value": "444d294e34545f953f69dc996cb668365fe0483d947888922d53bafcd9d059d3c3602e3980a491603fb5588ec1ae50a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761613, "uuid": "d202d5a6-1659-4fad-82a2-617d33144a15", "value": "T1C8D6337E30A1C5E6C91D0B71A6E7E4F4105B8D270A3AC073B2DF6E5C722A57711E62E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761613, "uuid": "f509ed5e-9ccc-4a29-95f5-6dc5af9a7970", "value": "7cd322a21a166e5f354457c41d1d9fb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761613, "uuid": "3b69da59-6a33-4630-8690-d6acce6ea7bf", "value": "393216:gMb9hxzm9K0NU1PRRlgss6Q0jGddtIqdJVWkfWt:gMb9vm9Kx3fVRGftIqtWUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780761613, "uuid": "1e04b984-e4bf-430d-bfb6-b1f9abd23623", "value": 13186928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780761613, "uuid": "3ce98b83-d2e1-4a8c-b519-c6d8be8f0bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780761613, "uuid": "9b4e1ca7-a522-40e1-8614-2a0f4f49e411", "value": "d482cac0754017ccc4e0f3b92c07f0ef4cd6dd394a6e3c7afe1fb928e487aa62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9feac8c-6170-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780727194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780727194, "uuid": "d47c3d7c-c7d7-4cd9-b2cd-c45a3f838417", "comment": "Malware payload (Mirai)", "value": "3898f81c10a46d11745803c12180096b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780727194, "uuid": "e902db3a-6f78-4a8a-aed5-d5869efc806c", "comment": "Malware payload (Mirai)", "value": "d87e416a584953f386649b79b571910c3866d13712b3538fac70111f7c9de18f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780727194, "uuid": "a765af52-3086-425b-9975-d2ebaf3beefc", "comment": "Malware payload (Mirai)", "value": "79563fc4b6f1555b966aae2b59c8472e81c34bda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780727194, "uuid": "40e2ce5e-130d-4bef-a63c-c3f5d0ab3797", "comment": "Malware payload (Mirai)", "value": "d0f72e0faaa02ef8b8651cb2328869dd06f4e51d8c9228bf1c24049e49b24640a16d3664d4dfe0b039b23382d51ead94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780727194, "uuid": "b2ce2522-5355-459d-9e58-e57471f18f17", "value": "T1FF562811FECB54F6E943193004BBA26F63315D054F28DBE7EB40BF2AE97BA911836119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780727194, "uuid": "0077928d-6f07-46fd-9919-c848280c103c", "value": "49152:QCoe7wIyNbVO0EXHKgPFkP/wCS4NgkZ0s7W+brZ6L0TuZ2nUCiZJDE4cywE25EW:se7fyFEXqFS4mPsS+vqZ2nUC6kVEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780727194, "uuid": "63ebebfa-bae1-4369-98d8-9766eb734b0e", "value": 6070456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780727194, "uuid": "e8fd552c-12eb-458b-aa08-9d105e8a5779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780727194, "uuid": "ffb7a2c6-cc87-47a1-abb0-85c6e27798b6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f659e88-616d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780725753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725753, "uuid": "b176ed21-7cd4-4fe7-aeb1-96f3904f0b97", "comment": "Malware payload (Mirai)", "value": "8f82dee4c3cda664b07e495fe613a142", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725753, "uuid": "16934287-3f0c-4c12-86a4-7d96414ad1b3", "comment": "Malware payload (Mirai)", "value": "d8827e6315f0cb16b0f4561266b823da4141ac9074bb9f21a3a024a731d37c81", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725753, "uuid": "c8899d1b-6100-4b5c-8647-0a25000e0e4b", "comment": "Malware payload (Mirai)", "value": "6ea711246d11b98e90fac32854752ce903644b3e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780725753, "uuid": "b6ae4c02-8a51-431c-9c3e-772a9257d60c", "comment": "Malware payload (Mirai)", "value": "f2ce8b6c9e9342ceb0887a004446e4d2c8fc7c50aec74e54f5f4da0821fcc854ac54325fc80d6d8420053aedba0db943", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725753, "uuid": "9d9b2a9d-8950-4e99-a9e8-e327be2caef6", "value": "T11AD02EAEB23323930800EF03F32298848019D3C04820E340F0CE047A9EA86003214A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725753, "uuid": "e0d7b7ab-6426-4c44-bb4e-ca87376cabc1", "value": "6:S43EX9PBp843EXi5843EX6NIl5X843EXSa0LKi1fl:mP/R5XNIl5X80LKifl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780725753, "uuid": "3a72a338-6b52-408c-becb-fc0619079c7f", "value": 249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780725753, "uuid": "e66a7bf5-19c1-4582-b104-a0b5d1861789", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780725753, "uuid": "00fd4c3e-5691-4c01-aa69-f2d3b0ac7768", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995008d5-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777417, "uuid": "5a587c0b-d216-424d-be06-ea72c1b8ad75", "comment": "Malware payload (Mirai)", "value": "d6cd9d8041637f4013af31c1e0e236cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777417, "uuid": "4a607462-58ce-4074-a7ac-016d5bc48bb5", "comment": "Malware payload (Mirai)", "value": "d8ae3d33313f68341836f45e876e7b9d0de9594a19a85521a870810af5901025", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777417, "uuid": "69f9c05a-d49c-4b88-95df-1550117b4d45", "comment": "Malware payload (Mirai)", "value": "0fc87bc6d9e97a770e02d49f157e2d7e10811efe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777417, "uuid": "14d85767-2484-4312-a740-93e01edc7e12", "comment": "Malware payload (Mirai)", "value": "1bd888397b922a3a51089c2d6ca3d49d7b1e97028c227276ce7994246904f2e1cdb6661f8b72b0a54573547bfb04cd9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777417, "uuid": "6e9a497e-e487-4429-b698-921c793af80c", "value": "T147E2E155B8B7B13187B20D7AE56AD3194BE56278B0F575F2121445D02BEA38B70F0CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777417, "uuid": "6c8a2dd0-c4f2-4928-9837-8bf8a111c6d9", "value": "768:FyLJp5geGf4BvdNwnZNOra/p1/E/RkYLrzTU+RJQke9q3UEL0:qLwfCkjB/p1/E/RkYLIuDL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777417, "uuid": "fb53bcc4-b053-47a3-90bd-b1c4fc025b4d", "value": 32376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777417, "uuid": "0c13b2b0-25a2-47a4-93ac-a0ee1d713473", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777417, "uuid": "efe05940-bed2-4436-9f38-84457e9389cc", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edfb77a-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780771333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771333, "uuid": "486f6266-7cc1-4da2-830c-e7ab4ebfb4b0", "comment": "Malware payload (GuLoader)", "value": "12573405bc4fca639ff9be8299c4c61f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771333, "uuid": "55b967b3-38e4-4180-a9f9-b3ea8fb97348", "comment": "Malware payload (GuLoader)", "value": "d8b86b1715fdb7b92a937c7c35bf952488d08de884478bb8cd66ee3317879005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771333, "uuid": "00fe15e0-9322-4c9d-8e46-61719681cbd1", "comment": "Malware payload (GuLoader)", "value": "e04f94a8659b47974efc4540b9a4edef5e414c22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771333, "uuid": "fd4d4da3-ea35-4691-8eb9-93031c9c4890", "comment": "Malware payload (GuLoader)", "value": "b57dd8981aeeed5ba12fcbd710bc01f4c4c9dca325e9d9db7aef5b7b0a3c52cc7b4c62a628dda2735b3b059f238023da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771333, "uuid": "dc97fe71-1582-4d55-af5b-362c18ea7a13", "value": "T11454E186B080D4EBD9666831D4BBDD2147263F6A83D15B0F2366773EA873163072F64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771333, "uuid": "657fc22e-a609-46c8-9108-d1231081e8e0", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771333, "uuid": "716b3505-df57-42e3-8596-f2c75d9c8857", "value": "6144:QpZgUXltNBTzfMVuEMqHJ54z8ayCipum5u6Hmk5:AFf4uEMqHJ56HCHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771333, "uuid": "efc0c614-a33d-42b4-b310-8d91331e3a25", "value": 284096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771333, "uuid": "8ded270b-da59-4469-9000-384061a70797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771333, "uuid": "dc420f3a-e48d-4394-8076-927aa389ba3d", "value": "price_request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7872373b-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729258, "uuid": "74c5ffcd-cfce-4399-89be-591f3855d5c2", "comment": "Malware payload (Mirai)", "value": "e9409efb61624d8fcb80bf291c2aed33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729258, "uuid": "90c5866a-e917-4367-bddc-703d33ca752b", "comment": "Malware payload (Mirai)", "value": "d95a862d7afd461aa85ce72df3d33fedcd50139e857ce34c8f834582f3a85c64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729258, "uuid": "0a6c072b-ade5-49b4-a580-b17951ff5a40", "comment": "Malware payload (Mirai)", "value": "f03f691d3c52466e6640e9afaeeecdefae1b9080", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729258, "uuid": "37e20737-2111-4c03-8ae4-cd2a6fca73d4", "comment": "Malware payload (Mirai)", "value": "eac2235e7b3db9e915b86abe73bdf6cb55304a6f299da0a120889a88651482c63a53cf0eaa85813efffc63afb1656c2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729258, "uuid": "ea236f45-5782-4adc-aba4-51cefb8c1fc3", "value": "T1357423DEAF51D6BBC8B0C7FD6892014AF025A831409CA89BDF99D1737E3E1150A84BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729258, "uuid": "5353bf33-b8e5-4bd5-b6e7-6274138c3d16", "value": "6144:DZrjWS4pbh25U3JfGYSd21I/8qkll4OnlsSHoU9IOHlLf6jbuOqDj2:DZrCrpF25U5+YSE1I/8q3G9ISlLf6jbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729258, "uuid": "4bfcdc80-55e0-4f92-9b1b-84cd2013a5a8", "value": 340892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729258, "uuid": "589700ee-3c3b-4b7a-9b50-68f3cde7887e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729258, "uuid": "18b826c4-18b9-4c2f-a1a1-2eaccacf9bdc", "value": "kaizen.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7d8e67-61b5-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780756805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756805, "uuid": "5f638f60-2e47-4d9d-b417-30ba821d511b", "comment": "Malware payload (NanoCore)", "value": "01f09f671490bf9e6f43bc2383d41494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756805, "uuid": "1a9446bd-b756-4bfd-a73c-d64157f96c74", "comment": "Malware payload (NanoCore)", "value": "d9eaa59d25fd1ada2444f7309b08c27d2a124240834cb0797df01df25ed482ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756805, "uuid": "898d0044-713b-47ad-b343-bd10fc526b21", "comment": "Malware payload (NanoCore)", "value": "fb57355ce0d8b98227fbd1ebc98ba308d0136d2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756805, "uuid": "2a974768-17ec-426d-943d-341d8c525bd0", "comment": "Malware payload (NanoCore)", "value": "e7d5fb9988369d72fefd2837cfb5ae616fed433c1dafb5d381eced567a3c00a4ff6d7c9a8cb389c181fcd97e1646224b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756805, "uuid": "849a5564-d4d4-412f-8b8c-5d1be2dcbb52", "value": "T17514D0563BA88A2FE2CE8679712211429779C2E3D8D3F3DE28D455B79F163E4060B0D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756805, "uuid": "403da044-f0d0-4d28-93e5-5598943dc6c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756805, "uuid": "52925251-2bc4-4cd7-bf11-79ae71ab87bb", "value": "6144:ULV6Bta6dtJmakIM5U2B/XMekQlD/7W6Qyf0TD:ULV6BtpmkwZXxVpQyf0TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780756805, "uuid": "77151aa5-7015-4a24-a268-8ca794d862e7", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780756805, "uuid": "27399e87-0203-4ec7-a6bc-5bc953351ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756805, "uuid": "6e4cefc1-2982-42d6-bc94-afa9969e62fa", "value": "jj88.today.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75db6d86-6185-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780736126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780736126, "uuid": "f54bc45f-0bcf-44d9-82c0-559f368063c3", "comment": "Malware payload (Mirai)", "value": "b7e2c1d0d98d9544d8d50cb2d99b0eae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780736126, "uuid": "724f6116-2fb0-42f6-89c1-98a9ec784051", "comment": "Malware payload (Mirai)", "value": "da5f0c9428233a988cd8c6651b6cb0647bc1aafcac2dadfa76cc48f645d11f98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780736126, "uuid": "ab89a9ae-b969-4284-8c83-7d81ed79756e", "comment": "Malware payload (Mirai)", "value": "b1d48d27368ba4b0dd5fb753edd771813e95ba68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780736126, "uuid": "dd18a1dd-084d-4c59-aa8a-520e99802c2b", "comment": "Malware payload (Mirai)", "value": "dd5157d72ddeee3cce057b226866d927ebb3be4a8745bb9e83ba98e499dc7a975bab5f88fceec0fdc69ecb1250ea0d78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780736126, "uuid": "13254151-b06c-4b6e-a075-2d17cf176f0b", "value": "T1FB33F12C201B1579DB745477B5B84243AECD1EFF601A2EC0A86DA5093F7689B3AFE143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780736126, "uuid": "64bc995d-42f0-4293-87ef-bba6dfee6513", "value": "1536:0M6ywSdoh7LpAL0uEd3dLgAsoe/0IeOqeoLN:Msoha7Ed3JW/0ImtLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780736126, "uuid": "9f6c07d7-8c9f-45e6-829f-369c76ecf3a1", "value": 55120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780736126, "uuid": "db9d832e-9662-49a1-b7ff-733df10188a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780736126, "uuid": "3f343c49-14b3-4880-83b9-65495f8ed419", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b75b78-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765707, "uuid": "12645ef2-ce8d-4d92-bedc-538a84b81846", "comment": "Malware payload (Mirai)", "value": "c8a79af58114f5cfa3ee83b9dc944f7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765707, "uuid": "4c0ea811-5b96-488e-926c-152873158cf4", "comment": "Malware payload (Mirai)", "value": "db347e049c6eb7dc2a5b63fe0d6c71ee775e77e75b3131834d35e24a43906e69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765707, "uuid": "2d86ea5f-b02d-4761-b507-7a17f480257e", "comment": "Malware payload (Mirai)", "value": "9701c33652ddca87ab5ad8dbef96847030469e8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765707, "uuid": "b4f99d8a-fb52-45d5-9e6e-346221ed380b", "comment": "Malware payload (Mirai)", "value": "b0b0ae4114d521e48b6f3a64587d1b5aef566a77544afd9e9074558aa4d4f0b392a82ec6e56094cf8ba638c8790a1045", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765707, "uuid": "98d11d9f-21b5-4da0-b15f-6d9bb7f11aa1", "value": "T1A2035BC46A13E9F4FC1A02F03137E7369B7AF13A2029DD97C7949533E852A05D50A2ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765707, "uuid": "d3e32f5c-888d-464e-b34d-3c6cc4fbcef6", "value": "768:N86/BGKwCohdwHpWjTaZv5k5mazUpfUnXMMO64fVMx:66ZGKwCohdApW3aF5LsnXMMO6OVMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765707, "uuid": "5dffce96-4c61-4f8b-881c-f1198314dd46", "value": 39196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765707, "uuid": "7456d055-80cc-461c-bb52-001e572f607c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765707, "uuid": "c99144a5-d9d3-407e-a0e4-28be16f53bfb", "value": "18a84f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d920a3f-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746742, "uuid": "77c65ec9-9da7-48ff-945a-03463e576b62", "comment": "Malware payload (Snojan)", "value": "67f3c53be623a4b99a9f51c6923f7fa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746742, "uuid": "6aa51425-66ca-4ded-8813-dd398c33b765", "comment": "Malware payload (Snojan)", "value": "dd3bf0a082a3f317c88fa6e47e9b33d14a70f6de24ac59e482db57acb67d1ea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746742, "uuid": "d695dbff-dbaa-4f0f-be04-368c983a59b5", "comment": "Malware payload (Snojan)", "value": "08940e94a70a271a588d1c0fc27553f7f907e6fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746742, "uuid": "629767d3-7cb4-4b00-a894-17b9652dbb51", "comment": "Malware payload (Snojan)", "value": "6e6d6704e5e1b8c23c0abb3da63265cb02ac2fda682b22e44d037c1010bce5cee65bf74a2a9fd5a765f3cdc9c3f8973d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746742, "uuid": "6b8147ff-dabe-4b59-ad7d-eca7a71e04af", "value": "T11115222471C0C4B3D46B413544C9CA72AA76707247BE99DBBBED63B9AF203E163342C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746742, "uuid": "81075504-35fe-414c-b03f-6aceec485681", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746742, "uuid": "d2325100-cec5-4706-8f76-1ac992f2dfea", "value": "24576:/Y+nk70Trc18BSnLW2CRBKViu99LK1Rad6yZcTx:tkQTAKYS/v6h3+1uhZcTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746742, "uuid": "63b36d07-3b5a-4aaa-930f-e24d27e937d9", "value": 923104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746742, "uuid": "53724c14-8844-444f-b784-9b5ce9f0c83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746742, "uuid": "62f5870a-89a0-40df-970d-f9a7f4ee863a", "value": "loJO7BfNiscr7prP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9561719-614b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780711355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711355, "uuid": "3cf6705d-26b2-403d-b07a-6421cf46522a", "comment": "Malware payload", "value": "545e0dabcb6d8b162fbf84827e83173f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711355, "uuid": "ba74df94-82ef-4e37-b13e-a7ca0d6d64be", "comment": "Malware payload", "value": "dec6bfd3a6f241b8c3a6656f7db4a4d6f9978dbff4708e47edf1b8c68d3fba20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711355, "uuid": "29aeb707-5726-4927-934c-4675738ea157", "comment": "Malware payload", "value": "3c16f772eaca4497409923f2fbf49d18ea2f30cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711355, "uuid": "03af56ba-1948-4b7d-ad10-3e8527624364", "comment": "Malware payload", "value": "9c2b3b089f8c82a06e5bed51ffa2bb614133cc5f57eb4c453650c837621c158bf6a2bbac5beb4bb75b6dc74491192753", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711355, "uuid": "3e50dca1-e3ab-4782-b4cf-42e89b563d6d", "value": "T1D1564A43ECE555E9C0AAE2348A629253BA717C495B3123D37F90F7782F72BC06A79710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711355, "uuid": "f1c97806-b1f9-455c-abf7-e9f0548e1c67", "value": "49152:SNYouG5cZw0A6u5+8LwG3uQkQssThwIn6lRAlGmpBo3GlytP8ht82JSW4TrmkNnr:SN5uBTBGLlwINTpuj4JSrnz5Efcd+E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780711355, "uuid": "38b3ef5e-cefb-407a-b028-107ff3dd8feb", "value": 6303928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780711355, "uuid": "527ae5c9-3740-4cf9-ba49-01acba03ca35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711355, "uuid": "ddbfee1e-5810-4923-a089-6e0295d036f7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69549264-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748130, "uuid": "9ce58dd5-cb52-41c2-a719-691e8f1c0501", "comment": "Malware payload (Snojan)", "value": "d5f23f10f919329763758bff4ff63255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748130, "uuid": "1c0be583-0107-46ce-aab0-ce8d0a733fb6", "comment": "Malware payload (Snojan)", "value": "df16afca80ab1fd6b8986bfd9ed5bb9068c3b58bc47820b69bfd7abca21ee796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748130, "uuid": "5903610d-8af1-42fa-ad98-58b87b48bfdc", "comment": "Malware payload (Snojan)", "value": "44de9adaec872a59995f3569644f008471a88a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748130, "uuid": "1bf36116-fd46-4f91-b528-71fa799b1399", "comment": "Malware payload (Snojan)", "value": "87b12234ec2305d745afa27a89f11161bd1c2a4d1e0665f35ab6e6c0e119b84b530058535dbe71928f213188b4f7e77f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748130, "uuid": "a364bd4c-290f-41f5-8e7e-d9a3529a1a02", "value": "T12C84F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748130, "uuid": "832af934-fa87-4ec7-8ae1-bbb57ce5744b", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748130, "uuid": "a8e981a4-ce22-4c9f-b370-28ce8bc52437", "value": "6144:NrFZaaZmEJusDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+u6h1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748130, "uuid": "7ce9fa6c-df7c-4df7-9661-886133bbab88", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748130, "uuid": "6c436d13-6d1c-428e-adff-cc66bd01a138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748130, "uuid": "4b0ece67-a3d0-4832-a4f8-0026b8cd2a61", "value": "LplL2fsAY2p1wPyk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0434e7-61e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780778975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778975, "uuid": "696057d1-a154-4190-a97e-cad58c479792", "comment": "Malware payload (Mirai)", "value": "dec4380a47d9632852490b359caa25ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778975, "uuid": "b29259e9-227a-4278-a44c-155cca76bf1e", "comment": "Malware payload (Mirai)", "value": "e0a751a82b482662a5dee237d676e3e6c3ae92eeb58cab01c12f092b47c25ab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778975, "uuid": "db8e0fcc-f674-4171-a7ae-8bfdec682e83", "comment": "Malware payload (Mirai)", "value": "c97c736072e8b6e6b642011d8767cd181f466606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778975, "uuid": "7f7871c0-787e-46f5-b315-1d7094aaf17e", "comment": "Malware payload (Mirai)", "value": "49d436871d1a2f7c19e47149762b092e8385af44e049109d0d12cbbf916f898ef2b57d85c007b0c262caeb548b70c6dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778975, "uuid": "387a6851-a740-41ee-8257-e7f03fd496c0", "value": "T1E9A31905D5508727C6D227BAEB9F429D33336B64979733215A28BFB42FC2B8D1E39121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778975, "uuid": "29073795-2c0d-42b6-bae2-fa811c337fde", "value": "3072:BKiJnNkWax7+VVWaanrexzP6oE0WrdkbSg:BpJNkWax7+VVNzP6BObz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780778975, "uuid": "10dee072-44e4-4250-ace7-58e527816c1a", "value": 103166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780778975, "uuid": "71e280a3-1886-4ff4-85ef-2c18b5c35d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778975, "uuid": "5a96c6ec-76ab-4130-ae20-d4aa6ea0e2e9", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e06efe6-61bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780760862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760862, "uuid": "9881ebaa-fe42-416c-b44a-b4911a886ea8", "comment": "Malware payload (Mirai)", "value": "d059677d12c90165589a743ed8373cc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760862, "uuid": "bb2b64ab-6ff8-4551-b4cc-a0468100d227", "comment": "Malware payload (Mirai)", "value": "e0ee4736e94b5f548312a48602b57f0e6cb9bd3867c31f0596873ae830c80c24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760862, "uuid": "c9972ea0-d9e0-4633-8e28-8f3df1ed18f0", "comment": "Malware payload (Mirai)", "value": "3cb32693dbd21c6aa0ea260624b40ac0e4774779", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780760862, "uuid": "4791e1bc-3138-4afa-acdb-992f3187d8e8", "comment": "Malware payload (Mirai)", "value": "fddf233068417005bfb8db6653d8e1d5a64b26bebe54310c4bc72ba7d8e1b99d7c54f831241dd3862d565b663bcc29e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760862, "uuid": "0f2598ea-09a5-4747-b419-29e916355ef9", "value": "T1F0044C49BD929F11D5C622BAFF5E428933132BB9D3FA3102CD206F5537CA99B0E76211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760862, "uuid": "a7d4a2fe-9418-4dd6-91d5-83033fdd02e2", "value": "3072:YIQesVBOEIdtI4UZ/JB2JZDPlHYIImY0QXYR+b1+OKagaPggvXC40UvGKDKiriHM:YBxBOXrtwB2JZDPlHtIfBYRu1/KagaPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780760862, "uuid": "ad2c13b7-760e-489b-a8a0-7a64c3a2be47", "value": 178812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780760862, "uuid": "6ca5f520-1b62-408d-b20b-528f8270dd6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780760862, "uuid": "60b80a47-b7cb-4341-80d1-c123790f5cf8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f08160-61a0-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780747593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747593, "uuid": "ee841564-5d43-475b-8ecb-2221e56bf0f8", "comment": "Malware payload (SalatStealer)", "value": "ac8be178d938848aff0084e7c1d2d9ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747593, "uuid": "4c75f2d6-58a5-4efa-87c8-7634adabbbfc", "comment": "Malware payload (SalatStealer)", "value": "e265ed33a96aef8699ce6375e3b9338f7630c857a0e1a966a7be7d8be8dc61d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747593, "uuid": "8ffaa24e-490f-4774-a505-7b8f87031c61", "comment": "Malware payload (SalatStealer)", "value": "563b249720624a2365567259b1dc11c343ac5898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780747593, "uuid": "3ec81d5b-3dcb-4801-9bad-9ac640a26e14", "comment": "Malware payload (SalatStealer)", "value": "0cdf9919406a38570f876b7a8327daf9522f52ff46204ee011cd2276e21945cba60154479f1a77930d8ba09c506ea63b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747593, "uuid": "273f6bed-0581-4d64-89ff-9985b4f7b4be", "value": "T140F533A2EE922BD0C635393583D05E67476D72595BE8BACCD23370A62510DFDFD22C0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747593, "uuid": "2cdaf409-0ef8-4915-8995-ee526a6dfca7", "value": "62fa4743b0609652b13a6b66dc9c0ac1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747593, "uuid": "aca9f21d-a4bc-47e6-a37d-37eb484f64f9", "value": "98304:Ygxh2zp/x+VmstYhUS6s2V7fGZ0v7uy064eSlJs4:YgxYpZ+dYhl6s2V7eujB06Nes4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780747593, "uuid": "189441d3-d6fd-4d4a-abfd-b1f80846e896", "value": 3600453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780747593, "uuid": "6850e098-88c6-45fe-9301-638db1ba82d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780747593, "uuid": "4cbae894-de9f-491c-98e8-45d635929f06", "value": "Zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3ad343-6148-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709835, "uuid": "436ca42e-0965-4502-a625-8bd95fc7da26", "comment": "Malware payload (Mirai)", "value": "87570955cc8975f5af97fc78e6bbe2d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709835, "uuid": "5284aa5e-2642-4d19-91d2-0ccdc0ea3182", "comment": "Malware payload (Mirai)", "value": "e2b2c3123c02278b9e31d56f03caceca0f0158c66f3715d8d4cf67d1dff97e21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709835, "uuid": "043123d0-a3db-4cc4-ac29-3edaf361e23e", "comment": "Malware payload (Mirai)", "value": "314f3fcee0309fc1e702b17c119ebb658970dba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709835, "uuid": "31449fc1-6cd8-4986-a438-3a7044eca3a3", "comment": "Malware payload (Mirai)", "value": "700521db844432a4d3a126e62126621d2dfea0b8261c9abcd8a0bd4e4ea3826e49c68734c1622d89f6acf8ccb3a4318d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709835, "uuid": "2f551166-b35f-48dc-98b9-7ebfaf1bfa4f", "value": "T125B32902B70D0F43D1232CF02B7B1BE187A9FDA519F9E584A11DBEC95275DB22182ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709835, "uuid": "ff4ca906-1b1f-473d-bc79-fe84b1654d5b", "value": "1536:35yHsXrxIPB2K30vmEBXa8182aimtWBWb+B5XN7Yt0AhwARhHIH4yWcbx5y3Jjp8:354s7xa1ELm0Wi/yhwARhoH5KWgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709835, "uuid": "d1c63883-f1d9-4207-8ec5-423a32233b9b", "value": 116820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709835, "uuid": "6ab5422b-4e5c-4aad-adbc-cd3bfa5f20a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709835, "uuid": "c0e72be5-1a26-4b06-b48e-bb17f5367e89", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73430b56-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729249, "uuid": "beef1223-c7e7-4c8a-a022-54bf46757c01", "comment": "Malware payload (Mirai)", "value": "36dcb1c411a790db322abac678cabc8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729249, "uuid": "4c32e0d2-b925-46cb-b0c6-037ff8dbd485", "comment": "Malware payload (Mirai)", "value": "e2bbbc119b44e649f951623a0341f19613ef2c5d56174d191315691981f3bf3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729249, "uuid": "201f1be8-6cf7-44f1-9258-fd8f31b8fef3", "comment": "Malware payload (Mirai)", "value": "b33c5c01ab50c7f443333bca8c0bd93dedc5e1c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729249, "uuid": "d85f79ce-c9d9-415a-876a-96be0cca19b8", "comment": "Malware payload (Mirai)", "value": "95126191eba895b3d386f6c5606dabf0bcac259ee89aa44c5ba8b45e8754757d0b076e06a397063607eb5c4113e5fdde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729249, "uuid": "4c361879-97f6-499c-a5df-0fb39449661a", "value": "T15483280B7156A9FCC09AC5348B3FA022D330B4AD5631671F6B846B3A2E53F744F16AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729249, "uuid": "496a73d3-26ad-4dec-9d91-79c595ae406f", "value": "1536:bE3aOPsnyIRv0b91FzV6Rdgf2IJJxoraA5msJ2a7J6tF7VvOMK:CEnyIRv0b91FzV6Rdgf2IJJxoR5UkJcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729249, "uuid": "1f78426c-ebc5-423b-b73b-aa2003ff397b", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729249, "uuid": "f1b14dfe-e507-47da-81ce-e80c4d2db4cd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729249, "uuid": "95dc011f-73fd-43f3-91f1-cb5e18872c97", "value": "kaizen.x86_64_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd523969-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780729427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729427, "uuid": "3388846b-f12c-4044-9950-4cb839dc34c7", "comment": "Malware payload (ACRStealer)", "value": "b7c9ad4f95f4010fd324ddd387ec44ad", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729427, "uuid": "aec8ede6-6917-42be-bf0c-a4e54189afc5", "comment": "Malware payload (ACRStealer)", "value": "e3b824d9402d5cc6c295e1f0be9992af4e9b4bb38727e8c70caac664209c852b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729427, "uuid": "97c69914-1d23-4fc0-85d2-5c74bb63c991", "comment": "Malware payload (ACRStealer)", "value": "9b2dce5705b0db5197780e76f54f9d93c8a41bad", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729427, "uuid": "6e158890-9d4b-4b6b-8180-9e0354f51516", "comment": "Malware payload (ACRStealer)", "value": "7a80cb216cb1437148b167624235509a2b7d653cf6fe2a20a8512815e66857937cea05f4e16aecdd90445f1c28d2b115", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729427, "uuid": "5fe990d8-64db-4433-9d99-612d3be07c38", "value": "T1C5C63316F2411277CE0B0330A82A577E7A3FAD3887228CD7A6D43BDC49B56D10F7995A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729427, "uuid": "b55834b5-bf17-4acb-ab0e-466f540a00ce", "value": "f558b6c533a8e5407154d449279d1b22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729427, "uuid": "65a36d80-9a4f-408c-8247-5c8d8eb09ed1", "value": "196608:ioZKDoY8E8i7x3blh+vcczD+XbViCU5PC7YPkYGTY2K6GnSrXPqK9GJnG:ioMD3vLP5czSLJCa7YKYV6bXCKEJnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729427, "uuid": "9f821361-2564-4e29-b63a-a173532da1ae", "value": 12571224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729427, "uuid": "63d87057-6d13-4bd9-a372-ebd03ce1f42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729427, "uuid": "f3c3028f-8d45-4199-ae09-ae1d50d4324d", "value": "b7c9ad4f95f4010fd324ddd387ec44ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524161bf-61ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780765701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765701, "uuid": "fe6344c9-a78c-4ab5-9c92-e0558a00bf3d", "comment": "Malware payload (Mirai)", "value": "9362ae90bf3ad4b68f1520561c8c4373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765701, "uuid": "d8d471fd-f3c0-482a-b28b-b82031e5657b", "comment": "Malware payload (Mirai)", "value": "e58df93dd08f29c8565cb3164d0d98164bd9f5aeed817680aed0a8504979cef9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765701, "uuid": "22637114-c7a7-4429-9d3a-76c4fae6fde7", "comment": "Malware payload (Mirai)", "value": "91456c1685cc31e774b6065a86b8b421a9448014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780765701, "uuid": "82fd1626-dea5-4ea1-8c88-84f65fd22ca0", "comment": "Malware payload (Mirai)", "value": "628086480a5080ee71a8a5fcbd4cbd8d6227394312fd462ff7c60eae03b6cdff93a7efd406709862f630315706be8739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765701, "uuid": "6eff5078-a167-4edf-98ba-c9bd5c3bb70a", "value": "T1C5037EF6C46D6E84D1195374A8258A787B13E10493973FFE2B5989B58043DECFB193B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765701, "uuid": "fac9105e-398d-487e-ba3e-7603a9bf187c", "value": "768:uakp2uwt2pDEZn5lOSwyeX8qtHtIqqgPT3HC94fo8+gCC:uaq2uwtoDEzfgBFOqVpwbgCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780765701, "uuid": "49381777-a86f-45e7-b27e-db01b2b4b399", "value": 39168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780765701, "uuid": "fe552bf2-5da6-4d94-a26e-c452c7bc0b7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780765701, "uuid": "0e3f2dfa-9bcb-40cf-b0e4-06eea52492dc", "value": "badf9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c082ff3-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771328, "uuid": "b4a6bedb-b8f9-4d2c-9a32-f55afb4eee8b", "comment": "Malware payload", "value": "a10245c69b3ed9f2d287199290bcacce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771328, "uuid": "5a95fef9-4095-44ea-afd6-c84e0c97fdd5", "comment": "Malware payload", "value": "e5b2a48b132c284602d5304a46bf5f9a9691cc214cbf78e66ead55c2e6436b48", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771328, "uuid": "b27fc399-ecce-44e4-a841-36977be888b8", "comment": "Malware payload", "value": "989755d2c59ee400ad93dd65ae6ef3e474a18a0e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771328, "uuid": "695b453d-874a-4dd8-b70b-aea6deb7d95d", "comment": "Malware payload", "value": "c42ac93acc38797a88e915737a5d633e697639cd9a1553d4ac366e3c687d4054c95ed7ad89c2cc31a55ee666214da496", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771328, "uuid": "c5e70d12-d9a0-437b-bd8a-48e8030d8813", "value": "T16EB590BB4A2D25F1ECA8DE25660D747CF9D6A2AF14969C8E3DF317E597710000243EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771328, "uuid": "3a48a4cb-d2f5-4e5b-acc1-47fb220e3354", "value": "3072:YZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZJ:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771328, "uuid": "df79acea-2ee0-45e6-a923-27e2b826f759", "value": 2358331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771328, "uuid": "2a08fa56-42da-491f-a1ad-3160228d479e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771328, "uuid": "aa3298e5-9fb5-4d1c-a585-9fc55ea37aac", "value": "PO#9896640.shtml.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3a6be8-61b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780756754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756754, "uuid": "830693ed-451f-4697-b05a-e7be78967d82", "comment": "Malware payload (Mirai)", "value": "12bd21c2546caf21afeebdf28d7d3d13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756754, "uuid": "662736f9-1798-4d0f-9533-1b256fd78e61", "comment": "Malware payload (Mirai)", "value": "e5f2122313f70640a481751e19b85d49d66a78e5c279d144f41ebd44e8250467", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756754, "uuid": "10528866-ad0f-4bfc-9b5a-177143252b30", "comment": "Malware payload (Mirai)", "value": "d9301a33b67b71937812e65e3d1d4467850d09b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756754, "uuid": "abdfa24d-d17d-4592-8c21-2568d38e76f2", "comment": "Malware payload (Mirai)", "value": "5fbd174cb5a146ea036d8c7023bff1acb84e8291e8eb729a0ea4670e89c6e1bc9b172562eab302680ebd015ceef4989c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756754, "uuid": "912437e9-88e8-49dd-9ed3-f8c353a96d4b", "value": "T10B836AC2A243D8F4E8190175202BF3376632DEB90168FDE3F7509672E4669A1F14BB5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756754, "uuid": "a76daccb-47e9-4b36-a906-0dfcf4fa2986", "value": "1536:SKorgBkzUf0w6n60obqOaOgp5hZYBVYnoic+DZJ0QNSiPY+HGg0syjw:Slr+kY0wA60oGSgn341P+DLhNtw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780756754, "uuid": "b7d689d1-afcc-4e2d-9890-740117f62dd1", "value": 82320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780756754, "uuid": "1fa87885-151d-4460-9f8a-ac10fcef1eab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756754, "uuid": "0b616782-b6a9-47bc-8976-a7ce63b0fd13", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc01f2f-6173-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1780728621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728621, "uuid": "d8ce831f-c982-43ba-b06f-f3b254cee3e3", "comment": "Malware payload (ChromElevator)", "value": "1650f2107f3242ec484f65990502f1c6", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728621, "uuid": "8fde122c-5c14-49c9-bfda-f8b56bbf9c1b", "comment": "Malware payload (ChromElevator)", "value": "e6a410f3eee922cc0faa84c06121b838f3f5fe2488ebd6013f1e65f15cfcf645", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728621, "uuid": "1380e68d-e660-4b64-b84c-afb92d32a13c", "comment": "Malware payload (ChromElevator)", "value": "db2265f97b9be693b5dc9fce25475f5678bbce9f", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728621, "uuid": "473a70be-27d9-486a-bf57-9048216a9b5a", "comment": "Malware payload (ChromElevator)", "value": "0d021f579b603a2e2d062cf4c2d198fc931da2e2251117725476069a37b5c29b7d609db78ce02a052d1afa95d732e49a", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728621, "uuid": "b2fa4869-7422-4d30-93cf-aa2732bf6b34", "value": "T15C47E943F9A985D8D0AAE5348226E123BE603C4C5B3573E7AF60B6241B79FD0A5FD710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728621, "uuid": "5d144801-3b44-48c7-97da-481c7e2e4b14", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728621, "uuid": "faef5ac9-0ef5-4608-8fd0-36158e8a1ec7", "value": "98304:W9BN/69b1O5s0jteCMykoSr57f7ZcKYBqc4QJHZL+IA5WycEQ:CBNCW5K5BcKYT4Q9pLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728621, "uuid": "fd8c36ca-d824-4a4d-af42-9ededacb5a7b", "value": 25565184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728621, "uuid": "2fd4215a-27df-4b29-8ca1-2f9aa43aa5eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728621, "uuid": "c9942036-3b82-47a9-b2e0-be199046b093", "value": "1650f2107f3242ec484f65990502f1c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ed387d-61e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780776153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776153, "uuid": "78e7e9f3-005f-4bcc-9bd2-e7dc9bb1204f", "comment": "Malware payload (Gafgyt)", "value": "7051ca144ad4461580c016cc98310ddd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776153, "uuid": "3b9fe92d-6d3c-4b00-8c27-1d1e3f204b11", "comment": "Malware payload (Gafgyt)", "value": "e6cd0333564dd0d5b89eb6368d4635ba01bbccbf5f6cb40cbb8d85b96a33b937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776153, "uuid": "b529eaee-2bfe-4d3c-b499-9fe08a3146c8", "comment": "Malware payload (Gafgyt)", "value": "ea48597ad54b3ffc20bba965460d6f25a030da10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776153, "uuid": "ffb1ddc3-47c5-458b-9858-04b3276109c0", "comment": "Malware payload (Gafgyt)", "value": "57e23ded81b0ef7c5369436c7c925a386dba7368d81270036b5d33ab0fb30da5c9887b930dbc4ec60c9db5bc73868bc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776153, "uuid": "c4944da6-255e-4f6c-a02e-54b4188b9205", "value": "T15453022CD03D84D1F12893B6071F6D9718A593BCC2848AF57A89683EE4FB1D53DA8E15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776153, "uuid": "aedf9629-fa4f-430c-af02-9d149157a964", "value": "1536:oeKpSFIsrfwECBtdq3p4YDVDrFOtMG5wk2+T7nouy8B8j:HF3Tw7BtUt5OBuQoutB8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780776153, "uuid": "87759e9f-22aa-419c-804a-820a3404d36b", "value": 61792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780776153, "uuid": "a27aaa91-1c78-4778-98b5-f74b773d6ec3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776153, "uuid": "124f6c76-9731-44d8-8f22-444ef2bd39a9", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08ff429-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759068, "uuid": "876a9cd4-5206-4d10-9bda-b01b684bdc00", "comment": "Malware payload (Mirai)", "value": "9b012691115365b394ec46b215d30035", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759068, "uuid": "8384d84e-65dd-4596-920d-d43d2b09469b", "comment": "Malware payload (Mirai)", "value": "e837348b80609cc32cbdd458e8aae513e8da0118f8df1058828cbfc41d13e80c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759068, "uuid": "7c133f89-6784-49f5-8513-8404f38f4774", "comment": "Malware payload (Mirai)", "value": "2482ff618cb0624fa419ea84369168b5866aede3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759068, "uuid": "da9e9535-06e2-4bf7-9aba-1b41b17cd2da", "comment": "Malware payload (Mirai)", "value": "7e7f5be07049d36b1e0495f966db44a97fc911994bf79088575c1e463fa948859b7f22928dc75456a5624780bb836872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759068, "uuid": "864b7f85-e52c-4d3c-a8ac-a567c750fbe9", "value": "T194538D72D8392E94C64946F4B8719E791F63B58192C30FFA1A99C2B68083DBCF6053F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759068, "uuid": "dc6a03e0-3686-4af7-a3dd-59b5dcbf4fb1", "value": "1536:KaJwtf22F9Ak4K6wIxKH+xGkfWucCwwNaAGUs/F:Kep27Ak4KdIYHAf7c0YXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759068, "uuid": "120ca85b-d91b-4d8c-bcc5-46ab6b54b0e4", "value": 65164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759068, "uuid": "8c942d65-4ace-430d-bfd3-914a6b3de22a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759068, "uuid": "27356b50-009a-4af8-aa0d-3962bd0796ec", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fdb5f6-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729245, "uuid": "02501e4c-a53e-4e31-a705-3f972b7e09ee", "comment": "Malware payload (Mirai)", "value": "9f20f7551dc851a99579300707e831dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729245, "uuid": "784804fd-7689-40df-a75d-8caf828a202b", "comment": "Malware payload (Mirai)", "value": "e8aef7c572007e2c5aa3954f590822ed1c077698100b9924af825dab1cf91902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729245, "uuid": "a4cf9f57-a9f4-4b37-996e-50671a1555ef", "comment": "Malware payload (Mirai)", "value": "3fe7de5f81d3a88c144e2ec0c57e7693b5b98344", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729245, "uuid": "88564868-963b-4fa1-b8d3-8e99a4fc1ddf", "comment": "Malware payload (Mirai)", "value": "04ef6760afe09b0188e7bf4cb48170527b37e94439d3ddb688dd139ba98d1f8df0fc645f1c695b67563c5039fe43cda3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729245, "uuid": "ecb4724b-6d73-4ee2-a39c-71850050f4a9", "value": "T14BD3295AF8C0DE63C6D436BAB95E018C336257B8D2DAB1039E146F2437DBD9E063E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729245, "uuid": "ae6448db-990c-4e9f-bfc4-db801503c790", "value": "1536:SKA8re0wRdzoK72d6HONiiYJOfBRjaM8aEsBUM/ZM0DJj0Y3uvba8b1Q0rSTeNZ4:SK5rOtfiJDZtnr7puvt5WtOTBIzNEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729245, "uuid": "0e59a9f2-3e73-4020-8676-f2c776081f4a", "value": 140584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729245, "uuid": "c70eb21e-81d3-4fb8-af66-38acd83850c3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729245, "uuid": "9ce5f089-bdb1-46e6-afe3-fd29c4bd5559", "value": "kaizen.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbbd065-614f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780712788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712788, "uuid": "c829d1e8-e47b-4f94-8689-6c864b981e2f", "comment": "Malware payload (Mirai)", "value": "2f2387bf0efadf04f9ba402f036a2e97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712788, "uuid": "02ea1a43-e410-4008-a7ce-3145d58db6d2", "comment": "Malware payload (Mirai)", "value": "e8bb7e5e546a43c602d5aa61868c62bf5106cffaa296beeeddace741e2fda068", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712788, "uuid": "d527fdcc-ae36-4148-bc25-75d3e82618c7", "comment": "Malware payload (Mirai)", "value": "1e66439cf4555060291ec1b7e88f840ec2b23e41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780712788, "uuid": "392bc422-5b25-410c-880a-b844afb49c9b", "comment": "Malware payload (Mirai)", "value": "5413d7d978c44c99082780eb15263d96d6cbc66a2e63e6446bc76ea2e051189146fb286fad4289ed72508026b6f2c078", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712788, "uuid": "45f54924-1b0a-428c-aefa-3dd2c9f13ec2", "value": "T131144987EE880EDBC467CEF086AF836B19E3659B4DD2F6F5543C8C0C355D18A4693688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712788, "uuid": "c3e8de94-2a19-4b22-b628-56dd3cd77a8b", "value": "6144:dlb13PDNZpfCOK+kIbvCkh8tksLfvsqB:PTZpCOK+ukuDvsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780712788, "uuid": "5fa0d62f-101b-4704-b6c2-f9f7d142fe45", "value": 200772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780712788, "uuid": "dd299db2-186d-4cb9-b8c9-d415a6023928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780712788, "uuid": "17bcfd30-4172-4c45-a05b-2578a4f067f7", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbba8537-61ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780759060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759060, "uuid": "58ba704b-b80f-4ef5-a2b7-9b640afc0f70", "comment": "Malware payload (Mirai)", "value": "07aef2ea126c64fd555d58a906867e7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759060, "uuid": "877838a8-3e15-4da4-8b7f-7545d8060870", "comment": "Malware payload (Mirai)", "value": "e95bf884f199174ae9fffa4faca0d18318491211c6bb5496d1e06aedbdc6be8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759060, "uuid": "4c312205-ba62-4eac-b905-ffcec4759eee", "comment": "Malware payload (Mirai)", "value": "8feda177a2a2e7bbc28605b2c7ac5e7891ea8df8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780759060, "uuid": "236054d2-2148-4997-9619-36fbc87d9e93", "comment": "Malware payload (Mirai)", "value": "f5c9892fa868797eac62994cf8675ff38fb212bf002e48e7ba63b79b011a686a69752f534a6fab3da8efa1569f655538", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759060, "uuid": "6f294b33-5003-4cd9-b3c0-44f8a3058b52", "value": "T171831995B8818B12C5D512BEFA2E118E3323177CE3DE73129D206F24778796B0E77A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759060, "uuid": "fbe35cdf-6faa-4541-824e-e24f721c2c72", "value": "1536:ajnxSaKtZz4IIqP0vebT8Tcp3Pa4DliyQ+MwiJPBJQ5P7Et5YYUs/g:raKPz0QjTKC3Pa4MPBJQ5PAt+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780759060, "uuid": "0fa2c2cb-9e6f-44c2-b7be-930707e11db2", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780759060, "uuid": "f06d6f9e-2f60-4749-b5d5-908a210467a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780759060, "uuid": "3997e1af-f3b5-4882-ab42-de51d3e04250", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f12c8a-61d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771799, "uuid": "631debc5-3900-40c5-b80d-0d7557de6e00", "comment": "Malware payload", "value": "f080dbd9de52614f8e13bf52ad948b6c", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771799, "uuid": "f7af6359-3207-473e-a496-99def1ed67af", "comment": "Malware payload", "value": "ea521e5fccb4a49739dd8ccb4be27aac504ce43289f887fe05367a76ca11d92b", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771799, "uuid": "d4b18c79-bcda-41ff-82b1-e6424941145c", "comment": "Malware payload", "value": "34e2ab048d8f4fe11e301d7ee144be8530348709", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771799, "uuid": "a1fdaebc-2d8b-494a-8501-dcbe014d7ad9", "comment": "Malware payload", "value": "642a856ba22b8ac31bb433a8c5cd73af10fc8200b0ce04719e526a1aa1169b6784975096c1c8decb7947e521221cce3a", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771799, "uuid": "2f517f82-87f0-428f-ab12-3782299a2315", "value": "T1CE08332D847AE73AF513E8BE0110E3B2615DC715FD38196F2A3DB286B6A078051A971F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771799, "uuid": "a7818d19-d14c-4718-90c6-4d4a293ac2fc", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771799, "uuid": "99338e41-d82f-4f56-9012-072373957e1a", "value": "1572864:2t9IKPcuZ5HNbYx/gnDnczgTOa4GJBXB2QX5h6oRh8Paduk7:2UK0uZnbWgn4gTHNJn2U5cob8fk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771799, "uuid": "d406203f-045d-4eba-81ae-5441201bcf57", "value": 77654937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771799, "uuid": "3d7a17b5-9326-4b8d-8f89-6695b2e65fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771799, "uuid": "4f341d58-6a1f-4ab1-9e9d-a0c4f416cab4", "value": "EliteCheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1803948a-618d-11f1-a769-42010a9c0008", "comment": "Malware payload (DocSaStealer)", "timestamp": 1780739404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780739404, "uuid": "d8586ffd-e6e5-4f54-b71e-68e8276df3a8", "comment": "Malware payload (DocSaStealer)", "value": "713e9e89cf4f2508ea7fbaa36cb15fb3", "object_relation": "md5", "Tag": [ { "name": "DocSaStealer", "colour": "#3749AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780739404, "uuid": "32caadc1-1118-4358-8eba-a27646cd4d3e", "comment": "Malware payload (DocSaStealer)", "value": "eb03106fc4ffe1d6580fa7a18cde415991d1a3992ce1b5d4bdb25f4906d38e5d", "object_relation": "sha256", "Tag": [ { "name": "DocSaStealer", "colour": "#3749AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780739404, "uuid": "cdf3085d-514f-4af5-a910-915e400da29a", "comment": "Malware payload (DocSaStealer)", "value": "19d1ca835f3c3f13c72c85811dd4ecfe72cc92dc", "object_relation": "sha1", "Tag": [ { "name": "DocSaStealer", "colour": "#3749AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780739404, "uuid": "5732c590-edc6-4a5c-bc75-b2342ab4b10c", "comment": "Malware payload (DocSaStealer)", "value": "47ab4ff66ce8c0ebf5ea6051c2a7f272c679d4604d5bc1c1bc10e344da32842b83f5a9ba2d49e7b83b8d8ea946539242", "object_relation": "sha3-384", "Tag": [ { "name": "DocSaStealer", "colour": "#3749AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780739404, "uuid": "6bd6b16a-c0c1-48d2-aef2-c7f6a53ed371", "value": "T1EF956B4BBCE014B9C0AAD736896665927E71BC440F3223D72E90B37C2FB2BD09A75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780739404, "uuid": "6aba35ce-c593-40c9-9f75-a5f8dc718e28", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780739404, "uuid": "04473ae3-1eb5-4878-a091-84ae50f4d836", "value": "24576:B7S5IETNmYlOL1LTnk5eojuB+tjx8u02IYuXngK4sdgStUBR9zqVJ5:yIETNmYkLTnk5eojtPIVGsdrUBMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780739404, "uuid": "71e5006a-2ba5-417f-9681-addc7fb18802", "value": 2027040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780739404, "uuid": "02d32752-335e-4c51-b74b-8d1f0ebbf977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780739404, "uuid": "01936a29-89ce-415c-89fa-fc2c6a297253", "value": "Voltrix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f0c582-617e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780733030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733030, "uuid": "094055a2-7764-45b4-bcf6-1349fbc9e8cc", "comment": "Malware payload", "value": "23e7a7b8927d20b8d382623e2ee53f2f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733030, "uuid": "5e1d04b2-7f64-4f23-a709-a78172ea34c9", "comment": "Malware payload", "value": "eb0d8c4e08b65a9e41fc67d98bad6607cb457d7979faf0274df3423fa7e4569e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733030, "uuid": "b50fce87-9a83-4cd3-8ecb-75042e64c560", "comment": "Malware payload", "value": "404dc92f39539e7fde44eeac0cb56a5ed7d25fbe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733030, "uuid": "b7e8fb41-d728-4cdc-a870-cf3e0356434b", "comment": "Malware payload", "value": "cbfef571848ddce3938e5dbfe46f1cac39b5aa4a52ba57e0bae47becc5d711f3c51bce342bc7f33f8a88e0fa91a45ab6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733030, "uuid": "03b3d7ae-587c-4ba0-a19a-3513badd0e92", "value": "T179137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C19B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733030, "uuid": "ce3815aa-d09c-4e31-97af-154a3ca620c1", "value": "768:d+a9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:d+Pco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780733030, "uuid": "85efb5f1-9ebd-4353-b3af-79e557383f7f", "value": 45529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780733030, "uuid": "9147f0b7-71d3-4500-990d-dba5127ba210", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733030, "uuid": "6316d473-5f04-4c0a-8698-166e935245b1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55996d92-61e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780777303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777303, "uuid": "82ca9aa6-e1f8-4fff-b592-b8ce2b8ccdca", "comment": "Malware payload (Mirai)", "value": "90fd52e71dcab6f5d216b4eefb3244d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777303, "uuid": "4693dcf1-a06c-4a02-89ad-31451c2208a7", "comment": "Malware payload (Mirai)", "value": "ebb675df5af535404f15f512b3b8e760a66369604158f34b22487948eaa22a1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777303, "uuid": "8e646287-0b0f-4768-9666-49e486760d79", "comment": "Malware payload (Mirai)", "value": "7ae67a4ea7e90c6c278e26739263f02beafe2ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780777303, "uuid": "d3fb74d9-bfde-4e3e-b29e-1aa51e66059c", "comment": "Malware payload (Mirai)", "value": "6f751b1074c4be64fb89229678f5fda207024e274585ff93d3e3557d689bdacb3de7feabdaf4c13affae68f77f68e9df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777303, "uuid": "11cca825-9f49-4603-9018-3bc2527b7510", "value": "T12233F2AC1932449FEA4ECDBC43DD4A80DA911FD79DCAFC5A3684D70789890E6F043BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777303, "uuid": "7b957e99-d838-4f09-8db9-779e49659322", "value": "1536:maAhxo6fK0RTjYql61mJgtb7wH5IeoNL7VJuW:maAhxlPjvl61mKtA5IeoNXVQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780777303, "uuid": "d40ae018-562b-4baf-a11f-a14dd9853aca", "value": 54772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780777303, "uuid": "9f16e3a3-da50-4df9-a90e-3b36fab5ecd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780777303, "uuid": "af466e82-6556-491b-83d5-2e031a9ae420", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa2c168-6174-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780728993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728993, "uuid": "405a249a-8921-4d2c-ac4b-21388de0e60f", "comment": "Malware payload (Gafgyt)", "value": "946139056e5485219dcd27109b407f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728993, "uuid": "9ae1a389-728b-4fcd-a59e-5cfdc80885a4", "comment": "Malware payload (Gafgyt)", "value": "ec318ad071cb53d8d91f1bd10ca8f10834b2b9e7e4d5e60979b664eed7ba0711", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728993, "uuid": "2bff95ef-b95b-4db5-9a04-b2e03bc7098f", "comment": "Malware payload (Gafgyt)", "value": "ec728c89cfc58c6e0a56a58e9b0e53d6307b1c09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728993, "uuid": "a89963bd-b87f-4425-9820-97f6a7f4c73f", "comment": "Malware payload (Gafgyt)", "value": "8713e7fd088b80de4d15577d2fb1471d8bcc6b9233c64bed5a11abaa437280efc931b1dce4f193e7c5785f8a984808ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728993, "uuid": "f3f29186-3330-4a1f-923f-cd936703bbc9", "value": "T1EE93188AA9625FB7C006B0B164B95D350B25BDD10E5F0E897079BAE0027F5CAB44FF78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728993, "uuid": "b885a4be-47f8-4bc6-b315-1e352e212dbc", "value": "1536:YCkqUmsNILTdXHKlNrK7s89DXCMR1jXPqfo:YCt5zLpXqlgh9DXvPqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728993, "uuid": "9b503c95-163a-40c4-ae1a-ef6a319c642a", "value": 91640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728993, "uuid": "038d3848-f792-40ec-8e13-a4be67ca5a59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728993, "uuid": "906d4774-de90-499a-9422-0cd3b0eeec92", "value": "SH4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fcde31-619e-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780746736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746736, "uuid": "205a3763-e31a-4ca1-bdd2-000467c2f4bc", "comment": "Malware payload (Snojan)", "value": "1f560d0d84fc925901b6b1f544e4ef91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746736, "uuid": "20d10a0a-466e-4a51-b903-d35d769a5afd", "comment": "Malware payload (Snojan)", "value": "ed0a5cebe8523cd9b7d738e7b59dc74611be8e9b78b8b2d0bb9ca24112c1f7f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746736, "uuid": "adf16aa4-eddd-4146-8430-0501d676a2a7", "comment": "Malware payload (Snojan)", "value": "fbf33dd3737070ce61c7739ed03a063d48f144f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780746736, "uuid": "ffd2122a-67ec-4cfa-b2cc-f0c6d5b14bf7", "comment": "Malware payload (Snojan)", "value": "a44c631f5731edc24b7f5cea3e3c491ba2da8bb20e268a83bcb1c72d3e8092514d1c4dbb9822be1515790e0fe4bffbf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746736, "uuid": "fabfab8d-bd34-436e-9e82-9710c4b9d343", "value": "T168345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746736, "uuid": "e7080311-a0e5-49a3-99c4-db885cb09dac", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746736, "uuid": "4deacd85-52d7-4fd0-ae17-aa1ea60fbd0f", "value": "3072:FJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/T/FnncroP9:PwDeM7iNEkgiOb31k1ECzJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780746736, "uuid": "26fdf013-b834-4b32-af75-55ee0b7251de", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780746736, "uuid": "7aaf4a03-75f9-4205-925b-0e403de9f1ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780746736, "uuid": "e91c7d2c-4f2d-4038-8a15-96bfa2761580", "value": "Kyh2NWflOrwycvXj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d7bbd2-6176-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729707, "uuid": "0b096cda-6ba8-4171-91f2-62be12c3001f", "comment": "Malware payload (Mirai)", "value": "238876e9fe26abaef1a6708e896a142d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729707, "uuid": "25ffbd64-f1dd-4b00-95d9-1ae5ca0cd74f", "comment": "Malware payload (Mirai)", "value": "ee7a75c50a53031b76c10264ac935803255caef4fff4f0a9716316ad18d70fad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729707, "uuid": "71cb08d3-1e68-4456-aaaf-0402514e48e1", "comment": "Malware payload (Mirai)", "value": "a98ece4f5a959bcb2247e01ebd48bcb45d77d65d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729707, "uuid": "bb45e519-98b3-4789-b65e-3513cd1ee24e", "comment": "Malware payload (Mirai)", "value": "8fb93b46139602954f93975b38ae2280d19b1970b105a817450bdb60b1675496bb39fa01305da9963ed576511ba67cd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729707, "uuid": "e7c73384-c7ba-43c5-b733-a573049b2930", "value": "T1F7262A51FACB94F6D5031D3140ABE2AF67306D058F25EB83EA407F1AE97B6921D3620D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729707, "uuid": "e48e3ee2-a31d-44b8-b72c-82f7937151ad", "value": "49152:qD6iXDK2+x3WWaE2KawVGhUCL1fqF/h8yz/HzE67n/LylwYi2VJr2yA96OcA0VF1:qmiX2JaE2yG0HzE67rVvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729707, "uuid": "36b626f7-950b-4fc4-b281-a5fd40f622f8", "value": 4468736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729707, "uuid": "c8294270-636a-445f-984c-4327a961fba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729707, "uuid": "532f8e6a-2121-452b-a046-aa5a2cd0329e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d03178-6176-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729708, "uuid": "38c984e1-561f-40d3-bb27-df4c4ef1bbef", "comment": "Malware payload (Mirai)", "value": "71a995a14c7eae6667997beaf43094dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729708, "uuid": "7823bc28-267a-4ec2-8166-f4d956bb74e3", "comment": "Malware payload (Mirai)", "value": "ef259b5d78cf24b0de1f72a829236d174abc3734a1c9ba0a0f06c0bed684ff2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729708, "uuid": "c56c7ade-d4bf-4fd3-b261-30b318877d89", "comment": "Malware payload (Mirai)", "value": "b983956c2f86502e07afb89b2bdd3eaa789fa678", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729708, "uuid": "48ad0084-ef8e-4b7e-9e1b-c715fd0639f7", "comment": "Malware payload (Mirai)", "value": "b6f45ded271b38d6d423f29eaabd7d7b175a440e1cf177fdbe93a771bbb44b9359cac0b1c7a296a517ec68f849512487", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729708, "uuid": "fd41c7a1-63d2-42f9-8c7d-0168d774ca25", "value": "T197262A97B8918643C0E4267ABCBDC2C433632EB99B9752675D05FE3D3ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729708, "uuid": "626b656a-6655-4b7c-b452-c53f5b1f28da", "value": "24576:mrLH9zN6iiRUk0u6fu1gH0OzdpMClBstTSJwj7HFd8nsmPYNZiQ7jdTJ8VmSD/Y1:Qp2cvBv+4K29+Z1G6p/A7WQ5eU1F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729708, "uuid": "245848da-82d6-4a4a-a9d3-c672a3138ea7", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729708, "uuid": "0f985631-0dbe-4803-98be-a8e97195876a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729708, "uuid": "1df2513d-f0a2-42eb-81c3-e554b5af48d5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386d71da-617d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780732587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780732587, "uuid": "2fdb09de-e261-4cdd-8f18-d7cc4155689d", "comment": "Malware payload", "value": "f1cc8d8ee2284aba4a722b87e814dfca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780732587, "uuid": "efca557c-2c58-4b08-acf0-6426bf06a2da", "comment": "Malware payload", "value": "f07a5d49e308bcafd09026ae22c7974edac55aef82bc1d19ef88b04aa4eaf8e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780732587, "uuid": "0f26de82-a4d1-44f8-bede-95645424036a", "comment": "Malware payload", "value": "fdb3113e4c14bd8a427499285f42611331a78f0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780732587, "uuid": "13bbda2d-0f6e-43ab-a760-c0ac75adac5f", "comment": "Malware payload", "value": "3cd7aa4e44ae2259ae8a741f782572e73c713d78bc9c6b7460eeb369b923e34dc9dc05f05d36e122780c537ff308e117", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780732587, "uuid": "4da4557c-2e7e-4956-813c-d213ec53138f", "value": "T1303533F08B278589F8B2246679BE4110A2F672F63E5CF6211511BC783968FC6D60F4DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780732587, "uuid": "87ad9366-b3ff-4c15-95d1-16c5d3b7b88d", "value": "24576:5IrSo8lbGgoJWdBfZlTp8hz5bWTLIKV6x4WjyBgZbMrdo98hqrpi+Fw:5IrLqbSJM5ZlShz5uIKVGvjyAD9kqrpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780732587, "uuid": "e8a690ca-05c2-40b6-ad31-fb56220c8e71", "value": 1109267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780732587, "uuid": "8fcec156-aa0b-4b0a-97b8-e9eb1b20990e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780732587, "uuid": "8a386e07-5d86-4c68-bf19-d333a6fa75a4", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533e0d42-614b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780711157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711157, "uuid": "6d3a4852-7b01-416c-87b8-a900f3bd7f1c", "comment": "Malware payload (Mirai)", "value": "ef9ec04d11828e8b7bd898d51dbd759f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711157, "uuid": "b9633109-89eb-483f-b4f6-612e31863714", "comment": "Malware payload (Mirai)", "value": "f118d1141ff5f64c4fd0a017c12f615470912c4cb684ded22a9fa9c1494a1b0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711157, "uuid": "e3be3690-2b4d-43ac-865a-ff507cea3935", "comment": "Malware payload (Mirai)", "value": "a082851e7549bdeff1f942fe910dbeb05d78c9ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711157, "uuid": "0c072b56-2f2a-4807-a3ee-3ee7c96cda7f", "comment": "Malware payload (Mirai)", "value": "bbe1564e7180a77988bd94bc0974196b26952313e61a3b8a3f787f492885036ce0bc44aed1cc9942ae5edcfa22eb62c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711157, "uuid": "670e9bef-01f4-4208-9aee-171254355675", "value": "T10AE3E60AAF600FFBDC6BDD7702E90B1229CCB95716A53F797534E818B50A18B4AD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711157, "uuid": "b4d2b730-0431-4db0-a76c-655261855936", "value": "1536:7ir3WAVCk1T0mLOlQB9N/EEy83X17/Rip0MKG1u+u8Sw0D4mAZgTvLfiZys8cyhq:Wr4C0mLOlQA8nV8sEmcifiVvhISiIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780711157, "uuid": "a36c0118-18d3-403c-909f-c0a49b808f7b", "value": 151516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780711157, "uuid": "77b22157-9f44-489e-af88-44f63d939cea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711157, "uuid": "a0078d3d-09e4-4282-8235-d4ad5ca0b83c", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2927649a-617a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780731272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731272, "uuid": "2d6898f6-9e63-4b12-b30a-53f3ce99dc95", "comment": "Malware payload", "value": "20bfb91f42aee29f641b1c2c17c3b2ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731272, "uuid": "1684817e-7560-4d41-8f83-8a2d5cf5b00e", "comment": "Malware payload", "value": "f126e9deafa498ac1ade200fcd3f08d38cd18364f571fb87bad5104688afae03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731272, "uuid": "416a0c84-7b34-497e-a5cd-d412323a1bc9", "comment": "Malware payload", "value": "0ecd2e8f276c5fb4555ee6f6e6c018bfd955bc5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780731272, "uuid": "501ded97-5e61-4c63-a5e5-ba9d54a467f4", "comment": "Malware payload", "value": "a2cf917a971859819658404af355be2db5c2d7bd81487157605699d7ecb41864cc55a4c6342fcc9b6fa49f16b798f6d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731272, "uuid": "adcb95de-1018-4b88-a875-9056cbe20d0f", "value": "T1AB567C95BC5D7462DAC976342F721394323CBC499F82C7272624BB7CAAF23588F13265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731272, "uuid": "69f170cf-dcdd-4ef8-9c1b-b876c2dfb6b4", "value": "49152:jcURCgW37bV1PcPZK58KGoep9tm9gDc8gN1qlybQcDuXE35EB:j3RCgWrbV1PyZK58KGoe9tcea17REB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780731272, "uuid": "345b9631-fa92-4df8-88c8-9bcf2f31fed4", "value": 5963960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780731272, "uuid": "e543a12a-8e5a-4ee7-a20e-8b3339414eff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780731272, "uuid": "c787ee63-00b9-4b68-a23f-acd329a1317b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1f5fcf-615d-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1780719037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780719037, "uuid": "f4900a95-c56f-43cd-af2d-aecf8640483d", "comment": "Malware payload (Joker)", "value": "3255e23f2a29642029d4f004b67bdfcc", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780719037, "uuid": "061ee815-784e-4115-b8c1-aeea9e2efa06", "comment": "Malware payload (Joker)", "value": "f1436cf2cae1e79e2fa9956a24df318a613684cbb7ddcc73ecb9fd3bfeea3e77", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780719037, "uuid": "ef21fa00-f00a-4994-ad60-8b301a11601a", "comment": "Malware payload (Joker)", "value": "3c31a70980cc9cd12deee1e6b42e7db793152b37", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780719037, "uuid": "d880818e-bdb2-4484-b073-1626de1a9750", "comment": "Malware payload (Joker)", "value": "1def10294062d9bb851efaf61cd9dc8d161ba9ccc5017fb72a52bbe7f7d27d86c7c2618fa4a4b010e116fe87979d7dad", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780719037, "uuid": "b3b5a8b4-9c25-4b2f-a567-4546b137f8a5", "value": "T15197E11DFB4DE82BDEC6B4FC8D5B0692B12679441A10D19B3827820DED837D90FAA7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780719037, "uuid": "f32e9fbe-bad4-4f1d-823f-7e4ee5aa8f16", "value": "786432:I5svKxN2PBE174QiF02QHh3/sOz3jj5jHhFAcU2Pw0Y31O:I5s21DisZsO7jj5Thqcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780719037, "uuid": "328c4800-a958-4d4a-8c90-8c824b3fd056", "value": 41996774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780719037, "uuid": "84b4c811-c8d9-4bf3-8208-4394e9f563ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780719037, "uuid": "5742deab-f84d-4ff7-aec2-fca6ff89ded1", "value": "4K+Wallpapers_1.0.19.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a43eae1-617e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780733127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733127, "uuid": "32613940-1c73-4065-8793-425bc1df8c2b", "comment": "Malware payload (Mirai)", "value": "85ed8ab9003c2983db2448fe62c4f8df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733127, "uuid": "2b7941ff-1c08-4e30-bcc9-c589f997779a", "comment": "Malware payload (Mirai)", "value": "f185dbc7537e4617257172518d256a8ebd6fbc925bad58d7acf6a91e0dcf5e6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733127, "uuid": "1a5a8c2c-c99f-4c97-8d25-1cb26cf2668d", "comment": "Malware payload (Mirai)", "value": "425d813fcd8f90cf58a1504a34272edd02c60520", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780733127, "uuid": "28e0ec32-5996-425c-96b9-1c77a2c7ba11", "comment": "Malware payload (Mirai)", "value": "153fbd1fbd43ec5a617501c4e5aa432ab7bcdc2b6cc08a53a54549a752ff8e8fbf9f54f636c3cc383a34547d3f8d848e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733127, "uuid": "a661760a-8f2a-45f0-a634-3a78ba4968d7", "value": "T1F7558E5AB2F370BEC067C030839BDB62A835F46541222D7B65C4DB352EA2E741B19F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733127, "uuid": "008f6d56-d188-4953-87ec-f31064396fa6", "value": "24576:SyRKDO9OC29R1ar+d1lrFYqgpE1+7+Y9VSPSemU:SnC9OC29RUr01lrFY9ndSP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780733127, "uuid": "7641b7fb-8bb4-41d3-803d-38f1ed66cb0c", "value": 1324712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780733127, "uuid": "43efaa20-d65e-4002-b747-85fa41976ae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780733127, "uuid": "dab25cef-dfa4-4cdd-b517-9edefb25967e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9370a53-6173-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1780728508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728508, "uuid": "658165be-7599-42c2-a153-047ae91bcb39", "comment": "Malware payload (KongTuke)", "value": "72fa7cd6cf3193f24766bafd5abe3f03", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728508, "uuid": "db7b33df-1a0e-4fd9-807c-b3421b001f27", "comment": "Malware payload (KongTuke)", "value": "f1b785b9f11af50a8c8ca12202676096f4ec8a93957f1aca506f722b0cbf57a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728508, "uuid": "509d4d0d-3d16-48e2-932e-c7c85e4a78e1", "comment": "Malware payload (KongTuke)", "value": "1dc2c3904188860672bae86c74abb651ebe361e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728508, "uuid": "5eec3d92-f3ae-4a15-96ac-21dcb5bc992b", "comment": "Malware payload (KongTuke)", "value": "c5db64f48e7aafacf9e1bf2695eede213cb8701eec3f7be65a4f9ccf181985bfa4d1fa867e61e1b7a05e5e5f7f625c3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728508, "uuid": "8821eb49-4fbe-48d1-b360-524a941063e8", "value": "T1C1B2C6B13795918E66C559DDEA36100301BAC057AF0C02AC37EC729F931B88957BBBB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728508, "uuid": "37fab23b-4215-462b-920a-89f82fbe95d8", "value": "384:PfESKBogS2SKBoP2SKBotSKbSKBoTc61qQxtGQGH6EIovNrovNmjj0poPtRoPtr6:8oSouoDo2FTIoNo02ojoNoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728508, "uuid": "e23e033f-d8e3-43a5-8576-457b013143e5", "value": 23644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728508, "uuid": "f85920f9-c1c2-4247-a1c1-e5957121194c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728508, "uuid": "15a252e5-19cc-44e7-b817-70d3c0efde84", "value": "21042026_1032_Fattura262922857.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704d1e78-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780771335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771335, "uuid": "3586f4a0-b648-44e4-915b-f99562906043", "comment": "Malware payload (GuLoader)", "value": "ea3848b251cf115a9819021ab548f5d5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771335, "uuid": "a38e831e-b95e-473d-8eb1-ece1f733af8d", "comment": "Malware payload (GuLoader)", "value": "f216c3639e88701065d9626360b31950d5b0a4a756ae673588a8760840623a5e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771335, "uuid": "0401e11c-514c-435b-a3dc-e3ac84805831", "comment": "Malware payload (GuLoader)", "value": "581213a365c236fec0328464e76a83a3222149a7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771335, "uuid": "a8f72500-c7f2-4c81-982c-0741b564b9c5", "comment": "Malware payload (GuLoader)", "value": "165d00a8b09d04c00e07392cb61a777a00f35d34046358bec236ca3fb32cf0e0656be8b97a5eb2a6a2e30d3531bbad80", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771335, "uuid": "a6e67255-d0b4-4a93-8c93-64f1ca1e5b10", "value": "T1081413685BE379C3AF12C9E7519B103B04728A5811ADCD95D0539D2AF3E289DDE2E3CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771335, "uuid": "130c21de-cf15-44f8-aeb2-a96af4b7c12e", "value": "6144:znlhsIS3LfNG/l0k+1UGCXNmxRUK9TmSaA7c:A3LVatfGImxRKSaA7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771335, "uuid": "496b56c3-062b-4067-a2fe-7ff47f2cc5bf", "value": 203466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771335, "uuid": "01b3dba8-8629-4cac-a36e-aa791bfd55f9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771335, "uuid": "a1d5c18f-e464-46d7-bad7-c2413738dd0b", "value": "price_request.gz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93f849b-6174-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780728991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728991, "uuid": "16779343-f380-4b75-8500-753c2e6b0248", "comment": "Malware payload (Gafgyt)", "value": "72077a0bcff11169e7078dd34173f95c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728991, "uuid": "28f5f6ef-26f1-4479-b92d-5d3da805509a", "comment": "Malware payload (Gafgyt)", "value": "f22272984edd823d419a439912c2bb82b0ff3ae67604430da5d80219095d0173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728991, "uuid": "4fcf9d2c-e7b9-40c9-9616-8c167b9562ee", "comment": "Malware payload (Gafgyt)", "value": "031987f800d3de12ded1fdec76f7b679ed653790", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780728991, "uuid": "d354c131-2736-4d01-a53a-37faa99174ec", "comment": "Malware payload (Gafgyt)", "value": "699a2ead176b443411808aa98cd8dda704f2d6e61f0c2f9f463357395ba123c57a8681b44c18a565fd76894f0342ac9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728991, "uuid": "098e9491-6b6c-4f6b-a02f-99b03ba8e3f7", "value": "T122B3A53B7B130F23C0C6107152E31632A8B9DF9934B886D7A8E07D9D5F3A9843556AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728991, "uuid": "10c4e727-c47a-42e8-a585-7233e93f01ae", "value": "1536:r9cyn6Svm4weoaIUm1RTVSND5TfrFteAt+OIswx:ZciXwaaLJSN9Tf9Yow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780728991, "uuid": "4d8f75fa-c36d-4e92-8422-6e0280a5949b", "value": 111316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780728991, "uuid": "1fbbf20a-cb26-456a-a104-4cd2700849c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780728991, "uuid": "74c28d31-8bde-49bc-a6e4-85d8249e2890", "value": "SPARC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff4967f-61e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780776274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776274, "uuid": "31516e5c-bf8c-4df0-b557-4019649de446", "comment": "Malware payload (Mirai)", "value": "b3ba86b50644b70309f3ddb66005dd8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776274, "uuid": "1dfb9a80-4a7a-4dfc-abba-0b2a58f0044d", "comment": "Malware payload (Mirai)", "value": "f287563df3f685ba0606b8d2e9f1af14fb0379b24415f314ecccebf9e67cdaf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776274, "uuid": "3d16dff7-149d-49a5-af0f-8ff0066f9f93", "comment": "Malware payload (Mirai)", "value": "f6c5eb688dc62764bf332d63df24d899e7f41d86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780776274, "uuid": "a3116bc1-8b03-4042-967b-f6d6763fa044", "comment": "Malware payload (Mirai)", "value": "2e20654f8161313fd049a6539d02aa23dcc501500daf0c6739a4bca737d04835f3e76fa89195c7e45875933058e6ca6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776274, "uuid": "7dca0e7a-20ce-4832-a4c5-b9b79348e2a3", "value": "T14BB3C60A6E629F7CF32C82354BB78B3AA755279633E0C585D2ACD9005E6034D587FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776274, "uuid": "73d54ab0-7f3b-4684-87d1-916bf8189572", "value": "1536:Kw40VG3R9KIUyEyWSxWSpaS4SM8GjrzqNRbPbWP88wWh3Smv9uyg:KddR9JE4+jrzqNJDnMdVul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780776274, "uuid": "26d50fec-585e-4c64-903f-5a91a33815c3", "value": 115448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780776274, "uuid": "4bf0a2c5-8806-4be0-a13e-02c4d8b40731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780776274, "uuid": "3004a090-1e09-4ef0-9886-953ffd9272dd", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6418d3-61b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780756996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756996, "uuid": "ac65be60-2e6a-442e-bcf5-6c8f9bcf7d50", "comment": "Malware payload", "value": "2ec8bb63402af9e9947ecaea5990ad31", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756996, "uuid": "28646e9a-23f8-4db7-9c05-cbf78a285b27", "comment": "Malware payload", "value": "f2d6256881cddd0aca9e3594faf0e54bab197c2d9b8ea1c6293c6b3cdac9b784", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756996, "uuid": "4f29906c-bac3-43ce-83a9-472e1070e8d2", "comment": "Malware payload", "value": "b7ace4811dd322f145d10c431f54c93bd3dd99db", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780756996, "uuid": "8580333d-5098-49e8-9ecb-0d36e507dc25", "comment": "Malware payload", "value": "abf06c31a4b33d9b901bf015eb1d0ed9582cd47d6f18cc7cfdb09d1f9733f685bd6aa1ce1ed1d2f2acfc25608dd5b537", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756996, "uuid": "5043fd16-5c76-46d0-ae24-eee904506a6c", "value": "T146018CCEC4269A1041D6D85C22E75044B820C3CB254A8FAABF5C147E8F69E547015FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756996, "uuid": "410a42de-cab9-4a8c-9c9c-a5b95a22b547", "value": "24:kXCKysE2hi0ziQvZohaOzJ2qRBEEvCYp6X:e9Qp+MsOIQ6EvCYp6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780756996, "uuid": "5fe70b33-062a-4c78-8a5c-24d8cdad1038", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780756996, "uuid": "7d359fdc-0e0b-4130-bbe5-f3d6c3e0a8d9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780756996, "uuid": "54b1be85-ac76-4747-90a4-552b5fab783e", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f864c74-614d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780711956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711956, "uuid": "7d81fb89-948f-4146-bd12-23c67300f77d", "comment": "Malware payload (Mirai)", "value": "0984de16bd81fac8d92af3afdb61d72e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711956, "uuid": "763f448c-6249-4cdd-a661-282f555b2e12", "comment": "Malware payload (Mirai)", "value": "f4ff17900802e33cbe04e6d8a710a66513ba683ea42aa7167139139cdad3dd27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711956, "uuid": "aa52d273-0c7b-4841-9212-654c030353a6", "comment": "Malware payload (Mirai)", "value": "f312029659fc6f750d4d5850256b6487b04c3d07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780711956, "uuid": "a75fef59-133f-4b59-9b9d-dd3c054ded0f", "comment": "Malware payload (Mirai)", "value": "6a18d95c9d800c8bfcdb95ca7aa5f00dec9881ee43f862bab5ba3f25700f8514e2b84eb2683b76f5662950e46b002ec6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711956, "uuid": "36f3f990-fa77-43a6-bd7d-23c6cc15789c", "value": "T1DE43F189F6C83645DAAC7C7A73D546A22EB2B4D6A1C701C08771CD4E6B3887FB40627D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711956, "uuid": "475b60f9-1d48-4610-abc8-455558bed857", "value": "768:tsZNsWAW7i71iWBnF2YbncwM49VSmp3zgs4CeRgQpjXVLGSbEKxUGTTdELiCC/U7:YSV71iMn4cnq49VSrseRbtxLSqLjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780711956, "uuid": "a7b4261a-5ca8-41e7-9850-5a38b975b73a", "value": 56140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780711956, "uuid": "b90abb95-94eb-4b39-ba8b-5369ca3f61cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780711956, "uuid": "7bbab669-ba98-4c4e-9f0e-e3996c2f093c", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68805c7f-61d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771322, "uuid": "3b95df47-9424-4505-9b6a-d9b9f137da0e", "comment": "Malware payload", "value": "7015cd9f948f2d57a01ea87491adccc5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771322, "uuid": "55e06dcd-53ff-443d-b883-0f30274a9448", "comment": "Malware payload", "value": "f5471e2ea7b393957c4ed4c2e35af9e4999643149b5540b4caa1f582fdf70727", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771322, "uuid": "440b6782-caa2-4dfc-86a2-ab9128d7b5fd", "comment": "Malware payload", "value": "45b121fef382ce551e86e99d0d6db1b5c25daaa9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771322, "uuid": "85806c92-4274-4938-9542-d763cb603a35", "comment": "Malware payload", "value": "8733f1bc25d357b448cf3493f60fdb44ff0650e7f2454954bdbd18fbae7264c2503ff2798bda668679b7c6588c64af0d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771322, "uuid": "e8c5e0e0-7338-4449-bd24-3e5b6a3c128a", "value": "T1E4F312ADB4E88E90B8ACC3845E3335DB7A26E45A9EAE7C35597523F56301B150CCF1B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771322, "uuid": "99e9c51e-fbfb-424c-9ea8-5cf2c0d694a6", "value": "3072:xLsJjr4nQ+X8EecXbdcSRZA2rW89I/RF6zQ4xIvAWPx0GRmAkOuXVl273HA0JZbS:GJjr4OEecX6ISzpszdxIvpPx34VUMAFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771322, "uuid": "304cf729-af77-4b6b-b99c-2da46cd08e50", "value": 159619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771322, "uuid": "0ba221ae-8b92-43d3-9abb-af51f325dea1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771322, "uuid": "1c000616-6980-4121-96b1-552d53259e31", "value": "Order_03827452.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4954dd6-6180-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780734164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734164, "uuid": "31a993ba-05bf-4a90-ae41-3664d95a00d4", "comment": "Malware payload", "value": "9d68e6b5878295c695aaa2ef21bbca04", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734164, "uuid": "9761fe3e-8296-43e3-bbc8-6344b7bf6a0b", "comment": "Malware payload", "value": "f6e2d8e900bc3ac30a90c03a2d8f1a176271520d185a1afa8a19b9178986116f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734164, "uuid": "631eebc1-d34a-4073-9beb-17815a91bed1", "comment": "Malware payload", "value": "33095a9879f99db0460fb370e70d3ef1043cd0d8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780734164, "uuid": "55e2df6f-7a0c-4bda-ad7f-ddf6df81c54b", "comment": "Malware payload", "value": "818213fb2ce561ee6f7c0e3db782c7f3210accb5630691325d203c5e30c82451409f72cda073919401ff0afdd2f6d7b5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734164, "uuid": "eb1f8fbf-562a-4b51-810c-cb592a8a4201", "value": "T1F3D2DF34C4D82FBDEEAA2A1C06FA6620D7D68B1E9498860737077D9B4F37C80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734164, "uuid": "652830a3-18f4-447a-a9a0-c253284ab251", "value": "768:mumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:mu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780734164, "uuid": "74de68a0-2efa-404b-bdf1-22c7e2314ada", "value": 28659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780734164, "uuid": "392c063a-f0bc-44b0-9e1b-8cb5ecb89725", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780734164, "uuid": "6374c3eb-a9e2-4cdd-813a-d67ebdadd2e0", "value": "23.94.110.24_1780734102829759_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24162e09-613c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780704635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704635, "uuid": "d2170739-e38b-4296-87ff-c4563639913a", "comment": "Malware payload", "value": "7adaba707ef0ebe39e52d1ba9929d6a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704635, "uuid": "23f6edc6-bac9-4373-aadf-446960793ee5", "comment": "Malware payload", "value": "f72caa4b201574fd88cc50cb3136d793f582045e01d0c20613a40a9864e9b2bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704635, "uuid": "ad254c98-a685-45b5-903d-6bf1b9f44963", "comment": "Malware payload", "value": "99f136c11ecb5d2e1446638812934a522959c1df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780704635, "uuid": "87c82adf-c95e-4ba2-a776-3bf723915e73", "comment": "Malware payload", "value": "cd943e6f6a55bb8d190ba74c9d26801349e570ff8f3d35888e0e188b3ac5732976252427486b6dbf82a62c050e65c3f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704635, "uuid": "777dce5a-a76e-42b0-a03d-9ead855be76c", "value": "T190466D55BC1E75A2D5C976752F6252D43239BC086F82C3233A24FB7CA9F63588F23261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704635, "uuid": "761dfb1d-72f2-42d1-b995-f0f3849e49e0", "value": "49152:1h2SDYacDtOkHtYS9pLzppot0AIaRpa2rV21p5E1:1oSDYaUckHiS9pLz7ottr81/E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780704635, "uuid": "d3d4076f-c679-42a3-9a45-a543b7848952", "value": 5636280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780704635, "uuid": "da96b47a-729f-4e11-91d1-0fcd5516a8e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780704635, "uuid": "3196d32d-1ec1-4167-8ab9-d632e9b7b53c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c467651e-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729385, "uuid": "8fd910d1-5de4-4536-a825-e227f3655f5c", "comment": "Malware payload (Mirai)", "value": "8680ea11a1f9d3199b7f7284d5c1b3f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729385, "uuid": "6eda41fc-30e8-42d3-a03b-97537086b237", "comment": "Malware payload (Mirai)", "value": "f800679e19163a4bd622b6c8754680668eddf4f9c142037dc4dbfdc2d71a83fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729385, "uuid": "1cf3c55a-a7c5-4810-8675-e453e4b46ff4", "comment": "Malware payload (Mirai)", "value": "f130cbd21d06376ba4c8fdeb445281e3dc24c9fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729385, "uuid": "de199ff8-2c27-47eb-988d-c38958e1f9c3", "comment": "Malware payload (Mirai)", "value": "f43f4b3f036a20a9163f0e60d68db7822349a18a0483d031623e2521ffc4ae27c3492fe5a360e2ff2671a30971a026a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729385, "uuid": "bad2feea-499c-4cd8-b143-52fb55fed822", "value": "T1B4D49D99FE1E3D43D2C7E37CDB8547A1222B75F4D32382727A41025DE8C6AE9CBA1611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729385, "uuid": "06ad2316-de14-4e71-b6a5-d6d913cdf959", "value": "12288:VtYha/zeEtzF63HmxwUswgWuVwMBs5ZeW+:zb//cHmxwUsv9Vw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729385, "uuid": "42e3920a-b057-4d99-818f-ca39278d2298", "value": 648680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729385, "uuid": "e03fd06f-1c20-4d78-9f2b-4d16c6eb476f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729385, "uuid": "1e213623-9b48-46d9-bd53-8f2615d398f4", "value": "kaizen.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae95042-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709425, "uuid": "9f25eff1-830e-4ced-940d-8a9083916c71", "comment": "Malware payload (Mirai)", "value": "d9c8babb3e1d509915fbe04fccd0d596", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709425, "uuid": "731f897f-428f-4dd3-8388-e5b225b0ceff", "comment": "Malware payload (Mirai)", "value": "f846460493f69fba89800d5314728f2f1050e5e94fcde47d05916e3b6883b0ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709425, "uuid": "554035cb-6388-4f2c-9a98-a0a7541f2a6e", "comment": "Malware payload (Mirai)", "value": "9eac957bc7f0b093b19a577c799d9809e290d807", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709425, "uuid": "885c8ff7-70f1-4581-8b2c-4228847f6052", "comment": "Malware payload (Mirai)", "value": "c9bc4af807365f753228bcb1a28cc570e37d6654802db9a81e2e125fd2382a2c7f16e8e51f42ff2714b6fccdbfc7fe80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709425, "uuid": "2aa956ad-141b-46f1-af5a-6df3b684bbb9", "value": "T149F3D81A9F610EFBDC6FDD3302A9060235CC955722A93B753674D938F64B90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709425, "uuid": "e5ab7900-326b-4858-a831-3b5f0a054998", "value": "1536:KfDYTeTHgkKKQ/jAWWFpux59k6/uKH4dg9aXf5fGZXbTq6fbqLiiv2+KjeVY9hN/:KfU+H+KQHDxHudQ90q+Kj99j9/M1WDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709425, "uuid": "fc4a408b-6f31-4ecf-bdae-581f5b15331d", "value": 157740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709425, "uuid": "d47ea21a-e0d4-4ee5-8f26-b5a272141c93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709425, "uuid": "7ee1ce80-5139-456e-b8d9-235f6f764209", "value": ".Sassy.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb90484-614f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780713104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713104, "uuid": "01697352-97b8-4c65-acc5-849c78ba81c4", "comment": "Malware payload (Mirai)", "value": "a8133d90f0a0b968d48dc0e692217d2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713104, "uuid": "d932c9c1-ab13-4f85-a6b0-14201e7fb9ce", "comment": "Malware payload (Mirai)", "value": "fa23945499298f0c17b0d4c95ef7ae02a38e6dc61b47af53e637df918977a9a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713104, "uuid": "8e882c90-30ea-45d4-b662-5e7d5e70d612", "comment": "Malware payload (Mirai)", "value": "d79503b2591823d50741009285b934055815d08e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780713104, "uuid": "95db23f9-bded-4c4e-aa02-c1c43c3c18af", "comment": "Malware payload (Mirai)", "value": "bccd795f5a03381a9a239d5216afc783e68602883e47e1ad19a603e8d041ae522a0ef1a39661dd27a283bc54ec0a7963", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713104, "uuid": "05132e33-3acd-4cf0-85ca-1578a8ce0973", "value": "T1E0932855F8815B15D4D522BEFA6E018E33631BF8E3EE7212DD205B2437C6A1B0E77A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713104, "uuid": "928abd9d-fd0e-43b1-aac9-ce96e5ce6026", "value": "1536:H4nI0tgYDS78AJLD4UaRngTpyqTs2W0dX9PHcOGOxJVRlvadi7HNJa07ZSYYUo:8eYD48MDVsgRPZdX9PHcOGOUUHNJa07F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780713104, "uuid": "b78ac8aa-6e0b-45c3-8c02-fcb9bd154d82", "value": 94896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780713104, "uuid": "66797512-1a63-42a2-9e34-d117fec90e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780713104, "uuid": "c7a1ee61-003c-40dd-b99b-316e4db60562", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02fb318-6147-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780709595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709595, "uuid": "753d0849-d2b2-4a49-9e45-78b0bbec2c56", "comment": "Malware payload (Mirai)", "value": "8b642ff22547d53325de582a672afeed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709595, "uuid": "0e250b55-395e-42d8-9190-8ff13a1dbb7f", "comment": "Malware payload (Mirai)", "value": "fa2814f640e10f418c41e9dc2dc43ab93fccc1f0f3d3a64def83f0a11b841163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709595, "uuid": "2b8fc0a8-e4af-40dc-ba52-b3e4c7277b54", "comment": "Malware payload (Mirai)", "value": "8f5fbe41370920fa2900d290e13dd85901d68066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780709595, "uuid": "f24fdd16-f69f-4b77-b6a2-47fedf48bc31", "comment": "Malware payload (Mirai)", "value": "809a61f8c2daff0c3906894a8ad3094c89e06c4e1781c5db38ce1cdf8a785795cc25d0b8c26e2f19d5e9aa4915359240", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709595, "uuid": "c65ec54c-a496-4905-9d0c-468263006378", "value": "T146753312DBDF94DFD487C07C914B4774C21B48BC4A66C66808A41C735CA66A2BEEF7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709595, "uuid": "3b697118-8e0d-496f-8700-691d3f3702a1", "value": "24576:8MsnklQIkqywzX2GlTgs31nsfwveGOJAqxid3gE7GngBZdAOroRiHJhGdYO96:onklQXjwzGGdgo1Kc3gE7UIfrMiyt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780709595, "uuid": "66f22f5e-1617-442d-84c5-9a68b57ecc19", "value": 1592908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780709595, "uuid": "735ab790-9704-477c-869a-f7c59ca2f28a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780709595, "uuid": "b779e11e-7d3f-4602-807f-223f5a2916fb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2beffc7-61d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780771876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771876, "uuid": "09e833e3-bb08-4daa-aef6-ad47e9eb87b4", "comment": "Malware payload", "value": "effab969c99e57db8856fe97a7ab3bbe", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771876, "uuid": "9477ab3f-e96b-4881-a5e9-5fae1b33a21d", "comment": "Malware payload", "value": "fa9c6aa074e0ef745932eab4e905c72e1f682d3bd9755af7b56b5df78e363e67", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771876, "uuid": "3c8b9e4f-6497-4407-aef5-e56be6d49107", "comment": "Malware payload", "value": "e1a81b685b4c2929dea5ab08859104fe798cb09c", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780771876, "uuid": "ab4bfb13-abee-4eaa-ad4e-ab0a32301448", "comment": "Malware payload", "value": "19302d0bf8680a127917e211b9acd04f7753abb89108d119ec4dee7ffab7b10dfeedd61637c5c75f72266feb1ad56b8b", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771876, "uuid": "fe59821a-bd90-4057-ac6f-56779fa211cc", "value": "T1C008335C62B2E233E6F79CFB0961A591C36DD1332BD4B48CBF0A4294B2E168354ED197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771876, "uuid": "e4c412ea-0d0d-4d6b-869f-c5ab5a5a081a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771876, "uuid": "04a660e1-2a22-4f27-baef-43af2faa1342", "value": "1572864:Yt9IKPu71OVRWYRP6OKMnvrRa5pVugKxeXPkz04Tg7:YUKW7IVRWKOqvrXxqPkE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780771876, "uuid": "2ba98a2b-c233-443e-997c-989f5a472a05", "value": 77931026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780771876, "uuid": "31e6728b-9385-4707-b9ee-2bf16c0756aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780771876, "uuid": "aeaec744-9855-4203-a29f-030ed668ad53", "value": "SpotifyRadio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e076ef6-61e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780778257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778257, "uuid": "0db26861-ca7e-441d-849f-e02a5249d44d", "comment": "Malware payload", "value": "672a2cd63593b84b7da8a13b87aff3bc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778257, "uuid": "925c5258-9643-4a8b-ada8-4266869cc361", "comment": "Malware payload", "value": "fb940c752994f0e0989ff5e757d738954a6eaa5d71cff59a5063a0b1c4b64cd4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778257, "uuid": "9fcc79b1-e0c3-4b94-8129-b4084f8da1c7", "comment": "Malware payload", "value": "1194f363da4e00ea570c6abe19483509fe1da3ae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780778257, "uuid": "9a3a6ef9-6f92-47d3-a00f-990e65349d22", "comment": "Malware payload", "value": "5ceddbb17201cd9e0222dba98ab73dc78ba4409e5ddf09a3fdbcfc3040ad84f69546f0a1210cb83b64ee1f3124dab4af", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778257, "uuid": "1fbbbf43-718d-4f74-8d01-9946b1146d22", "value": "T1BA31AADB4B1D3EEC8501E965B765155CE094E6CB208FE7A1FB8C0CBAD1C8548321AB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778257, "uuid": "0cd89795-3a02-4e19-8341-616c27a94f74", "value": "12:5lGLrlGK917rKdEM5ZrEhIYBIrBiDzB+xrHFY4C7r4Zf6kR9rrRA9vtmrra4HtQV:iAK9BMIH6iDzOFx3F9hO5zQ5Cpv4gY9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780778257, "uuid": "2ffa137c-3f1f-42a4-b095-33a387e4c410", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780778257, "uuid": "7feb316a-8d5f-4163-8e69-9ffd8d15cdb0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780778257, "uuid": "91c79b8d-bb35-4ebd-bfc6-bdf5ed7d261b", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4887c4-61a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780748159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748159, "uuid": "c06404ca-3d23-4b8e-ac64-6e9bda4ef48d", "comment": "Malware payload (Snojan)", "value": "be1c0d3890a4e6d9eb27139808e6946c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748159, "uuid": "75621705-a4f5-4d2b-be00-ce445ef7a9f5", "comment": "Malware payload (Snojan)", "value": "fc45ec927d25a3e85179584382a5c41ee0eb8b92ce8391e06a8ce1de6aa6e3fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748159, "uuid": "a69a17cd-5c5f-4e7e-9f74-bf89c3c62dc4", "comment": "Malware payload (Snojan)", "value": "d5c5a9e1a83c233502dbbee8f9b29cdcc4a69636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780748159, "uuid": "66b21fcd-6d7c-4f87-a018-ab72d8ea4714", "comment": "Malware payload (Snojan)", "value": "803f729cb160c8c80f2b4fdb55591e750e98dd579fa0dfcd781ec927d681add54a770da96e2f2eeade59df1e55a1ac8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748159, "uuid": "40483563-fe67-4c08-9f5d-989ef61ec40a", "value": "T1E284F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748159, "uuid": "d09c7cb3-bd73-44b2-a8f8-8cb76f4005d2", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748159, "uuid": "c7ab11c0-7946-4a84-9c75-fdc008b2d081", "value": "6144:NrFZaaZmEJuTDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+uHh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780748159, "uuid": "49bac812-a6d3-4786-a007-81b587ec4c6b", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780748159, "uuid": "0d60e87d-265b-43e4-889b-3b237bbc9d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780748159, "uuid": "6cd8de09-8c4d-4962-9e22-19b76a0ff096", "value": "TpqJQlKCXnxVLwCf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8e2298-61ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780753775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753775, "uuid": "55698e7c-025f-4a7c-9ff5-afbf16f7fab9", "comment": "Malware payload (Mirai)", "value": "322e040bc03c26b8734b0058ac69a93a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753775, "uuid": "9e5756d2-2325-4546-9e20-e5276800b484", "comment": "Malware payload (Mirai)", "value": "fee8004cd1ae434da5e5ebf096ecb859f3ced9fb953aba945598239d8f8df61f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753775, "uuid": "11b99af4-a980-4b0e-adf4-08a88799cc34", "comment": "Malware payload (Mirai)", "value": "b9ff4fd6243078aeba703f5b059a4cd6a296ca85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780753775, "uuid": "62d9f2bf-7abe-49b5-8827-546680ce1d5b", "comment": "Malware payload (Mirai)", "value": "2b6adb62c2f08376ecc12591f44ed875983f384d2e70766bcfd9c4cf1540a3869b2d7b62077d6b63e83a991d90ef04ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753775, "uuid": "c99f034a-cb6d-4004-a841-aa95f50bb76b", "value": "T1B8931986BCC1C602C5E061B6FB1FA1CD375643ACE3E67213DD18AB29674B85B0E3B255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753775, "uuid": "4f823a21-04fc-43a2-afbd-6f8734e9255b", "value": "1536:Zxl52BQF4KN7HDETFdFChpBQZp1szjhfQf1GmmUs+M:jl52qFZNTDUjChI3qWfwmmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780753775, "uuid": "5f21024b-6bbb-4803-87a4-7e3074d61008", "value": 93620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780753775, "uuid": "898ae841-e04b-4707-8009-9f0c93ed6f44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780753775, "uuid": "824fc215-0c60-446d-86a1-46a176d33504", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d257ec-6175-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780729341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729341, "uuid": "18cd43cc-ef6b-478a-bd40-3714eaef691a", "comment": "Malware payload (Mirai)", "value": "a26b5cab689aecc2a0fcb8e761ed02d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729341, "uuid": "31918f0e-c829-4ef7-a2e9-de1b3f2edb22", "comment": "Malware payload (Mirai)", "value": "ffe42136be3d7185a112e77c689d5fa5f9c3dfd95151f7a1f2eb181bf94b541b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729341, "uuid": "9c91bc19-1e42-4785-b638-3ac7adfad6f5", "comment": "Malware payload (Mirai)", "value": "1d52847cd9bfd45ed73ccb906a844cf9683b89a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780729341, "uuid": "6eca3e27-0a1a-4100-a9fe-b335317c9579", "comment": "Malware payload (Mirai)", "value": "ba0f4bd4572c3f94c4dd48e1f9d1025c5fea3f707dea4dfa6a63474be266f74f5004fbb3a6cfbfb055f83c994d40b802", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729341, "uuid": "e306e4d8-5865-4efb-aab9-1e240ee177e1", "value": "T165D3295AF8C0DE63C6D436BAB95E018C336257B8D2DAB1039E146F2437DBD9E063E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729341, "uuid": "cbc8b824-7c19-4946-be30-7e2a3194a265", "value": "1536:SKA8re0wRdzoK72d6HONiiYJOfBRjaM8aEsBUM/ZM0DJj0Y3uvba8b1Q0rSTeNZv:SK5rOtfiJDZtnr7puvt5WtOTBIzNEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780729341, "uuid": "897e2c5d-a940-4f8b-b36a-e76a23c53f37", "value": 140584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780729341, "uuid": "72c9451e-a559-4db5-b1c9-37676eb201bb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780729341, "uuid": "9b56f8eb-9e76-46cd-a13e-d64058399521", "value": "kaizen.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }