{ "Event": { "published": true, "date": "2026-06-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-19", "timestamp": 1781913782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "93dae06e-2ed7-4d0f-b5bb-ea4b4f0bf029", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72684066-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781876004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876004, "uuid": "8471912d-43dc-4bb3-a50f-a1076ad12cf1", "comment": "Malware payload (Mirai)", "value": "07d64440969fa07739ff075828f0ef0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876004, "uuid": "f838af51-cae4-4289-8aa4-3b5704f94e5f", "comment": "Malware payload (Mirai)", "value": "000cee13f37ce599c24c708e5977e4ae5f611e114bfb609f85c43487876b75ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876004, "uuid": "4dace859-2a3b-4ec0-a788-143b3338408f", "comment": "Malware payload (Mirai)", "value": "446e4c1f449239a833a5883d0809daa92f8abbc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876004, "uuid": "028ed219-8c50-4f84-bcb8-5a50fb9ff0fa", "comment": "Malware payload (Mirai)", "value": "f9c29c1ce14ed8c4d3fd6e0fee7b66f352053f0216e05352505c0cc41533a3a4886ebc59dead1481cb76a8da83eb5a63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876004, "uuid": "4affa710-2dbc-497c-9ddd-d8929afdd257", "value": "T1B3734A9CA683DCF9ED13493110A6AF7689B3E63E2178CB87D7E8E521D823102E51775C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876004, "uuid": "44338e4d-b463-4085-a4c6-9d908813a1f8", "value": "1536:KRQQM8PB1TBKLDd7d7SsPzEnFHskpqAYI8oGS4X+P:KRQwPBJMD7SCzSFHtkAeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876004, "uuid": "3d3138ae-62bb-49b0-a791-fb9998bac62f", "value": 78772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876004, "uuid": "be737508-0ede-4d68-a225-8599238623ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876004, "uuid": "71e53a4c-6aaf-487f-88ff-f7ecfb889e7a", "value": "ytaabxcxa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f246784-6ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781851007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851007, "uuid": "83800d06-8bef-4ed2-9371-a3baa3e2393a", "comment": "Malware payload (Mirai)", "value": "23a6b9d48beb77e94919fb38cfbbd232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851007, "uuid": "b3718a2f-e246-40bc-89e4-64ca756f8ab8", "comment": "Malware payload (Mirai)", "value": "01dbefcd45f50dcce0bab760faef0e264c0b8ade8916d2fd1d710f2b6962bf76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851007, "uuid": "65e2ae88-0ff1-40f7-a80f-95d412c7ea05", "comment": "Malware payload (Mirai)", "value": "ae3a88085f185240a9d58b54c026757a889187f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851007, "uuid": "d90a74de-ac01-4f7a-9c2a-10a195d7f2f8", "comment": "Malware payload (Mirai)", "value": "3eb3def80271fb615994a449cb9eb7fa06de20b682452935414a8028cc2d63582b68d32d6395369e424606d70f5fd6ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851007, "uuid": "7692b508-6e18-4992-b980-13daaf7864f4", "value": "T13BB3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851007, "uuid": "e82b79f5-af56-439c-aca6-f29ea243b7d2", "value": "3072:VtZLbdDS5HE0KNmXZb+L0FMyMzeIde2JBe:VtxbdDS5E03bYyMzeIte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781851007, "uuid": "e609837e-58d5-4a46-84a2-71655986b019", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781851007, "uuid": "59b25786-526c-4765-bb11-b606596c5025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851007, "uuid": "1f7be9a8-858b-4e47-8edf-c8e3c1003641", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3864a5a8-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "4af1d3c6-eef8-4c50-bcd3-61c33495cc7c", "comment": "Malware payload (Mirai)", "value": "9169e95a13094ec91ed87fe3bf2825e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "a09ae9e2-80d2-42b4-9b1d-05ccc1370363", "comment": "Malware payload (Mirai)", "value": "02f8a8622334603a9ae64f80da44331f02d08c492bbeaef9003f79639cfcf8f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "37e5c8e3-8b7e-427e-b42c-39a976671460", "comment": "Malware payload (Mirai)", "value": "23e57bf55aad86596cc329b26e211cb525ced061", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "b4c96f33-9839-41f9-84e0-858ffe6563c7", "comment": "Malware payload (Mirai)", "value": "383997f685388af7c494bc106f2c59edcea5d27a38464e4d56bcfbc1e2e7f021cae24c1feafb6c939afc132b5776c64e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875907, "uuid": "3476e102-66cf-4047-a069-f9467cc94177", "value": "T1C6835C267979091BD4E8A47E62F34336F6F6435B207C961F3D720E8CBF516802257AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875907, "uuid": "e5bbd9af-19ff-41fe-8f56-3a44aca8ca51", "value": "1536:QpPW8qmUARrZpiTDDxeyDytu4Y+5PKPwit5tMMKJ:kO0RrZpiTD8jg4YmwcxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875907, "uuid": "c141383d-1efb-4739-9b24-fcd972b5320a", "value": 86044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875907, "uuid": "cd10bb95-da34-47a8-8439-d3796211e4b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875907, "uuid": "7127edd9-5f4a-419a-ab44-6f412922f6b9", "value": "lqtucsxvn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfa128e-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781880990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "3c2fc888-3786-4533-bd91-105ba3218e46", "comment": "Malware payload (Mirai)", "value": "7236d7033dd7424c12847c3f6e7ef9c5", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "49bcf5b4-bda6-4c97-b2dd-82ac301d9ae5", "comment": "Malware payload (Mirai)", "value": "0348bc1e7db9a0fb758e7c3bf7d97c89cb873577dea51112c378b84cfef3700a", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "b9cb8913-b869-4dde-8435-d501e083eeb4", "comment": "Malware payload (Mirai)", "value": "d8144163c8bf75ed5e79a1e688757532d70c5455", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "7d4506e1-e39c-4c66-8ef1-7ae1b121f975", "comment": "Malware payload (Mirai)", "value": "d3087c2a5acfaa1bd5f20ad1462b5b462e228567256f84e2c7b67bab584eead9167c6bb976190bd3db5ec8cefa1cd22c", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880990, "uuid": "a42c5962-36d1-4592-baa0-3fd0c10fe872", "value": "T16B6302A38E28C51FCD3F4F7D70278639B319920416360B651AB25AB3DA2925EDF81C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880990, "uuid": "6abe6716-f51a-49c4-b03b-0ba92066fd1e", "value": "1536:dNJfIwTPvK8BZyuvIdFlyuH/1N6ksZxaR6CwPpCcZiC2ecT1Fyk:bJQwTnVZJvXW/1QhZkR6PkcZiCKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880990, "uuid": "8cf27c36-5a8c-4eb4-a6d9-8865c061b08f", "value": 69452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880990, "uuid": "05fa7754-f5ac-4976-b827-a49e52e1b67b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880990, "uuid": "e7d9a9f7-490d-43b2-9b83-548192ed44bd", "value": "monero.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1ed227-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875967, "uuid": "9d9efde9-097d-49b6-8658-83080bda6a24", "comment": "Malware payload (Mirai)", "value": "c38b0bc1a8b4c8b75e8a13d3b74f88c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875967, "uuid": "15008f9e-2c1f-42bd-a0fa-929bc5a7e702", "comment": "Malware payload (Mirai)", "value": "07516890507c08a99ce4d3875ec48a718dc7e3e166e539efb269463009dde11d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875967, "uuid": "41ca7936-e863-41f1-9d31-7ef830fa65ac", "comment": "Malware payload (Mirai)", "value": "5ec06a4e09d60b1cc5882fd241997a862948e666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875967, "uuid": "669577a8-1bd3-4908-b3ff-3f17af288efc", "comment": "Malware payload (Mirai)", "value": "4de5acb92559741845d9b018bed43fb5afec872b9e2e34731c50844e1165e2706ff56d1b4e2d0fa35e9bf8d090e7ad06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875967, "uuid": "6807b175-ee88-4255-a9ed-8ccc37d4dfbf", "value": "T1DAB3E50ABFA10EBBD89FDC370AAE274628CD551321793FB57574C928B50E60F16E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875967, "uuid": "11c4549d-3dad-4f40-87ca-d83dddf65a2d", "value": "3072:5wHTbZcBY9Q3hzDq3d2dc9ThZrMOjA2Ep:5+F9Q3hzmN2dc9ThZrMOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875967, "uuid": "9af3faa6-2b2b-485c-8b05-d43761681626", "value": 110668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875967, "uuid": "2a1dd4aa-d015-487f-a354-21450b7fdbcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875967, "uuid": "55f7c363-c08c-4da9-b44b-548db166b9dc", "value": "kznpkpoyh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d94122-6bf2-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781882405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882405, "uuid": "a704d8a8-421a-455f-8fb6-63fad3c16ecd", "comment": "Malware payload (NanoCore)", "value": "a9281c51fd1ef07ab364902f2bdd75d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882405, "uuid": "cef3cbdd-eff5-40be-92a8-93838d1c4bf8", "comment": "Malware payload (NanoCore)", "value": "079009c21d829e6f75f22268cd6904c370f337da514a9a3ffd0ad22574a57772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882405, "uuid": "3ac9146f-a50b-4067-843c-072a77635e5a", "comment": "Malware payload (NanoCore)", "value": "fe0ad5d4b73478d3282e8141953926ad168909f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882405, "uuid": "ebafdb59-b556-4d6a-94ae-0a322b285845", "comment": "Malware payload (NanoCore)", "value": "40d8b38c1a271997b35c2915bc94ff9cf0c21bd2758fd4b6d61b060831239adef8353814ba85e0ccf3d5b128f4e4aead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882405, "uuid": "5f7bc1fa-d0ed-4c0c-b819-f0eeb767a229", "value": "T1FD14CF6677A8492FE2DE867D601212529379C2E39CC3F3EE58D854B74F227E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882405, "uuid": "ca35597a-e20b-4d25-b308-b686716253b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882405, "uuid": "bb83c131-194f-49b0-a7bc-dfaff4498828", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIRuwKNdlIhtRSE8KaDtyvLGVQU:MLV6Bta6dtJmakIM5TTw37ax4L2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882405, "uuid": "bf8186b8-02f7-43d2-9310-8f6572bf76d8", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882405, "uuid": "f298da2f-a5cb-416e-bf36-4537e98994d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882405, "uuid": "94d78eb8-04fc-4d0b-8556-14ee36d39c89", "value": "genz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5073da0d-6bbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781860056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860056, "uuid": "b2328a4b-07cd-4d28-876e-abe0638b87b4", "comment": "Malware payload", "value": "cb2aa076e1adb6eeae32a479da99c18e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860056, "uuid": "144332a8-a36b-4f01-ae97-59df3ebdd476", "comment": "Malware payload", "value": "08e3a08a951a26e5ed32ebc45dcfd1fd9d6f3b2705e8433b27d90b13d70f973d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860056, "uuid": "4caade9b-e379-43d3-8fd7-18caf0610db6", "comment": "Malware payload", "value": "3f37846754594b5369ab2fcf1f8a4c771e1c93d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860056, "uuid": "3db52791-57e2-4a14-889b-75f5cdab6a3b", "comment": "Malware payload", "value": "5d9d03895a023586232a6358ac01a95a41d5ec9b0e625eef406687453487bd733f12cb0f837ef22125f208f0629e996a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860056, "uuid": "7be1aa8f-c0b4-4316-b8ab-eac9e38a3f5b", "value": "T138A3D909BF611DBBE85BDC3305EC0A4735CC960B61593B753A38DB1CBA8A54B46E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860056, "uuid": "07f0f47d-f859-418d-88b2-293356d0d9c8", "value": "1536:zd466vuUPSCVkz5+Jy/SEPCs+SQe969gm4Ovpbk0e:m6vD3y+CW96Ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781860056, "uuid": "65a210d2-1ae0-464e-9480-a8fe76b367e3", "value": 101612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781860056, "uuid": "5f0ca75c-9cb1-4399-b2ae-6002a658cb27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860056, "uuid": "ca9ceffc-b136-4eac-a322-937486dc73ae", "value": "7ICw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c644b0e-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781880987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880987, "uuid": "51d90809-c607-4617-9c9b-de2bacf3c93b", "comment": "Malware payload (Mirai)", "value": "4ffac5a77a729218e6efee85baabc310", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880987, "uuid": "8f1906a9-273b-467a-8eed-37e009b06775", "comment": "Malware payload (Mirai)", "value": "0954c9d3f9c35a9e2557fea766da12e190e192d0bb0643b691d53bded9c27d87", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880987, "uuid": "ff076765-aef4-4698-9905-71838f025178", "comment": "Malware payload (Mirai)", "value": "cb6bdc346d7a2abfead4e00593a6c71e8654734f", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880987, "uuid": "d8b8086d-e626-4558-8d69-dc6d503bb3dc", "comment": "Malware payload (Mirai)", "value": "fbaf62fb55026f5a2576336e953f4ce4f130d146a34a26e1a27f828428175ba5d86cca9eaa780f12d7f8fe5e66d690cb", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880987, "uuid": "3507e59a-71b5-40f8-863a-7abac0baab3c", "value": "T19053029C226C5DA1F7F92BB9F7720C6CA615C360867F24AD168B7B057B010279E1A34F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880987, "uuid": "37c0cb64-a5cc-4e81-9926-b2b915601257", "value": "1536:U/iEPuVXkuhbRnXOTJ+j3GvXsNB1M7qbRdHQP4u41N3IA5qR:amqU7+uIPIN4A5qR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880987, "uuid": "b96a1675-3b04-4bcb-8174-0c49811eebae", "value": 64524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880987, "uuid": "03482983-d8c6-421b-8eef-94ccb01e931b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880987, "uuid": "55351e64-3c15-4b90-a186-07b4a4d1c777", "value": "monero.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7b04f7-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781880990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "66bdce3d-fe5b-4856-bb53-b52f044388c6", "comment": "Malware payload (Mirai)", "value": "cf56769bed0ab640eac21b31f028dbec", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "f0007e67-9043-481a-b301-a2de106b1863", "comment": "Malware payload (Mirai)", "value": "09cd9e6984b8bfa9155b4abbc05cadfae4b2eaf6e98c7b39dd20ec3551da72ee", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "e2464ae8-d7db-472d-95c2-b520b9ea38df", "comment": "Malware payload (Mirai)", "value": "f130c34be2586143d994ecb2326673bf4d53bb5f", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "025cb479-d235-49d9-a903-d451a0ce9a36", "comment": "Malware payload (Mirai)", "value": "c0c03755a49f37999318b5a83ae1320250fe35cea7155270bfca69f98e3f9548a0b3c43bd860e0b9b0c89df355166b3b", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880990, "uuid": "333ad885-bb07-4825-ba91-ebcd76537fff", "value": "T1A643025262A4E80FE81B2138E43D617C720F3A2BCB44A620F3300556684BEBD24EB763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880990, "uuid": "d03232d7-c430-41b7-8a94-68341284ad71", "value": "1536:gBgHNEOLcFb4mpvHvkqXXnZG5gkSdVcSsj10apWWPcjdTZhqO:xtFQJ4Y3kqnnFdVcSa10iWWPc5DL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880990, "uuid": "27c5b2b1-f85a-4b62-a4cb-6cae44a02d12", "value": 58724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880990, "uuid": "2fd4f57b-0e84-4a26-a30a-a89105de30b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880990, "uuid": "122f599c-cc85-4701-a394-645ef23e16a9", "value": "monero.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57101894-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850188, "uuid": "f20cc4ab-5759-42fc-8cdd-07c72b6cb0da", "comment": "Malware payload (Mirai)", "value": "1af64bbf030f4b149282838b1525359a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850188, "uuid": "04e86f24-0639-4fb3-81eb-56a923225423", "comment": "Malware payload (Mirai)", "value": "0a1c461eff7c7b579e1f0bacd5e8416ff013d83eb1462d8e30ce30a9554d9018", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850188, "uuid": "15d76d41-1c14-42c4-bf58-0e5cd241294a", "comment": "Malware payload (Mirai)", "value": "a195b5ef7ce515ff0c620f52a91f713ce505a669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850188, "uuid": "4352ab2d-859d-46df-92f6-81480b55367a", "comment": "Malware payload (Mirai)", "value": "9c7e62566a74c9f9aa2f72081e8a6844a6906faf8f0346df35d1c883951768f5a16601206b2d5fb8d2dcd4a457576183", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850188, "uuid": "b0a6fd50-c809-4eb0-b64c-ceb77ac4e48c", "value": "T180E32A46E7408A13C0D6177AB6EF42453323AB64D3DB73059928BFB43F8679E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850188, "uuid": "64bf9813-1e4e-4046-977d-3ac4a573a9f1", "value": "3072:TVu+iP4XalHzbx8PogNLCz7QHE8E1LNJmM/9KIS:TVuoXalHzbx8PBNQ7sEH1LNMM/9nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850188, "uuid": "8bc43d71-32e3-45dc-a01a-a0f0b48a16fa", "value": 154279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850188, "uuid": "4786de54-0dfc-4d84-9c2f-e91b525ea5a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850188, "uuid": "80581341-c256-429c-aa17-6fb32a42de9a", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492fa000-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886243, "uuid": "0ae3f94e-d28e-4cf2-9150-d2beec07171c", "comment": "Malware payload (Mirai)", "value": "89e202a9fe6ce3cbcdb3a6edd596d7be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886243, "uuid": "6f4e6b10-920e-4332-81f0-55b3a72e01f5", "comment": "Malware payload (Mirai)", "value": "0a618a151510305cf31c00dff9b745bf89264502599138e9c0b6d3f49c57ec48", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886243, "uuid": "2c0e10d1-c97a-4470-aa92-f80532af9cda", "comment": "Malware payload (Mirai)", "value": "529ec58407c5ff8aa18305ae4ac18eedd093d7e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886243, "uuid": "9f1133cc-fcb0-403b-b390-482d4b5f37e4", "comment": "Malware payload (Mirai)", "value": "bfb5b85361e6a11811702b69069dc32d7399d81f5aaf9ee083c924749b6735080c19d3e9d24c06c449511c2ed3c8ef5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886243, "uuid": "89d0fe6b-86df-471b-a92a-de71b23626b5", "value": "T18F933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886243, "uuid": "3e5a2fe5-525a-44e8-bb66-f8b48992dcd5", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+LOR:KvjLrKGG4syfcIhXiuxpUN48LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886243, "uuid": "b751ac69-7dfc-4502-a868-8f3300a6416c", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886243, "uuid": "4987b69e-20a2-4ea9-9f92-08cff76c2d5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886243, "uuid": "a7a0b8f3-b40d-44a8-b159-88de94fca24a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432aa298-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882797, "uuid": "4297e9c6-f2ed-4c25-9d15-45bf53840b36", "comment": "Malware payload (Mirai)", "value": "fb215d74436ae6a8e87bbb0e661a0c93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882797, "uuid": "c6406ccc-20fc-4201-a59e-88fa7586e573", "comment": "Malware payload (Mirai)", "value": "0af3285a52b582524fe9a36862b703eb081297b4b1175f5eb9c5f6fb02c9f59d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882797, "uuid": "7137efaf-df93-42fb-a6ac-91fc8a47353e", "comment": "Malware payload (Mirai)", "value": "da1083287343a1fede98befb135ca5aae0abc1b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882797, "uuid": "b36fd8f7-95e9-48b4-8f81-771622b320f8", "comment": "Malware payload (Mirai)", "value": "5ccdad7ef2d5fa3be9f4c74c44140cb5aef858495fbb4feafb6da542bd5d55252f79c1792cc620c84a557fbd36c6f365", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882797, "uuid": "53a7db2e-e118-41fa-b79e-a035cfb4f0d2", "value": "T153B33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882797, "uuid": "2769fd34-1ef6-491d-99d2-894eaa2a77be", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJ9:4azwz102cPPaRl+AS97J9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882797, "uuid": "3781c05e-cf18-4006-bf4a-a92c297ab4fa", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882797, "uuid": "3e24ce20-d54a-4041-b52c-368ac2957044", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882797, "uuid": "6ab53920-1ed4-4e41-8ce3-b454be9c6644", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5398f816-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850183, "uuid": "2c06d2ff-72fc-4a9c-acc7-b5d039c7503a", "comment": "Malware payload (Mirai)", "value": "40fb550c24d872f10ae5f31701611592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850183, "uuid": "1e16924a-ae4e-4a20-8d18-a482d627ac19", "comment": "Malware payload (Mirai)", "value": "0b2f0fcaba013cea7a171540e94351b2d4e80b033a4502700a28034ae8e2caac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850183, "uuid": "737fa924-19b7-474e-8bbd-c7c2b8dcbcda", "comment": "Malware payload (Mirai)", "value": "5bbdeba6ed86a2e539a4ca70fb52fa371be55d24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850183, "uuid": "75d610ec-ff0a-443f-aac3-522cf59f4088", "comment": "Malware payload (Mirai)", "value": "0c555066d68454a5bf5188089f30bf35e9696691e1478f3e325e68f578dfd1e1b24b91d93d1c2fa0a2e2fe43dfde35ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850183, "uuid": "576c15ab-a6a1-4055-a673-7c91c9cbbdd5", "value": "T121730995B8818B22C9D512BEFA1E118D3313177CE3DE73129D206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850183, "uuid": "0c9a57bf-5ff6-475d-9760-46cb8d0da0e0", "value": "1536:TAnYSDACyTQrb580RbavEwpDQQMgiR33ATHa387oL5oYMd:mMCH3e0Rbavg3ATHa38kLyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850183, "uuid": "119d20d5-9e66-47d4-b5b6-3a8b23391051", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850183, "uuid": "ce4c9376-c923-40b6-b50d-57eda60254bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850183, "uuid": "fb09d0e7-33f1-4f63-a6d3-679626bbecb5", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee09389b-6bdc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781873205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781873205, "uuid": "be3b69ba-a3ce-461b-9e7b-d53e1f547357", "comment": "Malware payload", "value": "ab4da861e0fa4f2e894c7f2b1354bf04", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781873205, "uuid": "9e0d553e-40ca-4269-9363-3324087fc2d6", "comment": "Malware payload", "value": "0c48dd05a59233a5f4dbdf15d440809e01bbb48003c3309e001b0306c085ad68", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781873205, "uuid": "83f9eb82-bb4d-4285-ad59-08f8859bcd97", "comment": "Malware payload", "value": "346ebd1705546b900c9d3d300614f1f68bcd66ae", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781873205, "uuid": "65f57679-cc7b-4d7e-9865-2e6f387783c5", "comment": "Malware payload", "value": "8186d577d6885f626492fa929e2a961e91c39897426be054988c58a2849fae07b6146988ac18a9d7af7733a7c59b5109", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781873205, "uuid": "01f132a3-3860-475c-bedf-5329e05be565", "value": "T134C512794DE8EA4182B5392CFCE908246CFDAC6C7D538EDC6331629E67DA4C11971CAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781873205, "uuid": "06d97576-4298-4114-811a-7925ccf43525", "value": "192:lpa9PoyrDu35mBBLW7LV7XhCiXL88MdCKgsCWxfcKzOtPckzoczz8BAokvUS0PfS:lshS4fGeAsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781873205, "uuid": "46be8efa-1302-4e59-92d8-be5d1ae6c377", "value": 2511205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781873205, "uuid": "48d21222-b3a2-4bc1-91a7-68509d8a661e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781873205, "uuid": "e80b963f-fc03-4b9e-90a4-335f5d0feae7", "value": "EKSTRE 0619.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c33d0f-6c27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781905237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781905237, "uuid": "2e0dce96-bde8-4e8b-974c-102514dcfc43", "comment": "Malware payload (Mirai)", "value": "38ee5b9c3f573abc9dbdd05c1b1b3efc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781905237, "uuid": "6fb07d45-2068-4da5-a316-90f45a89a962", "comment": "Malware payload (Mirai)", "value": "0c558c03b98b9ead328cce7f8ffcb4cbbadd704067800dc019c3a6f329e04f9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781905237, "uuid": "7cead828-b5e7-4de4-ba69-bd9d2edd046c", "comment": "Malware payload (Mirai)", "value": "edc65a7a65f626a757a3d5fb927914e6a1678e8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781905237, "uuid": "cfaad177-1f98-4702-8da1-e0de4e3d235a", "comment": "Malware payload (Mirai)", "value": "fdeef3567548ffee6b7d3325b491ff73c7a7a5a11e15124dd5bebc3df7c0717ac10de4be4a4e412de9769e1fe2a70278", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781905237, "uuid": "8018bed2-6213-4bff-90f6-c4954a09be61", "value": "T169542A46EB414F13C4D627BABAAF024533339764D3EBB206D924AFB4378775E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781905237, "uuid": "500e144c-e676-4d31-943f-63d1eb351016", "value": "6144:wnZ0Tfhafjq/it3G9u4msa74jTPsWEaico11dy6WFGwV/GjSmq2Fs/s:tbha2/D9u4La74jTPsWtdWzi/vmqis/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781905237, "uuid": "022efa99-f9b3-41ad-a96f-f4deab601388", "value": 292917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781905237, "uuid": "0c09b8cc-119f-448f-a9c8-fed1107addb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781905237, "uuid": "30b325c2-335e-484f-836b-c144c0c67cac", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c306f0f8-6ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849511, "uuid": "386aa53c-dcc3-4174-9682-aa9cf284dca9", "comment": "Malware payload (Mirai)", "value": "266a03c7b0d5ab6b79e4f9334b0cd1b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849511, "uuid": "8f6fb738-10b9-4761-afb0-31c4152edebd", "comment": "Malware payload (Mirai)", "value": "0c5636e105c7572c4a64c6aef2564f67304f5d8c17b466d2ad7bc630d0a65956", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849511, "uuid": "7ac66064-c2f7-4bc0-b1c5-e0b3af32bf21", "comment": "Malware payload (Mirai)", "value": "343703b2bbcf7c12afd1c7974ee02f7d3cdf7996", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849511, "uuid": "408640a6-cefa-4aea-baca-12d5f6537ae8", "comment": "Malware payload (Mirai)", "value": "175b363ca7601f38bb53e7f86112eb2be2692e0a12c4f9cf65be45e70c433f767bcebde1119e5385f09b69bd08b859df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849511, "uuid": "ef8bba77-59dc-4f0d-8ff3-1ca072c0ba38", "value": "T13D936C22B5391A3BC4E4943722F31336F1F6478924A88A1E7D710E8EBF256D0364B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849511, "uuid": "120cb1df-d3d5-4676-9830-c04b204928c0", "value": "1536:0f9pCkO3L6T6L7QpKSePBvMdBvtI1Ym56oA2o9tLFcv:fruBq1YOz8Fcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849511, "uuid": "3cfc22d1-bb0a-48d0-b2bc-9dfa5356680c", "value": 91912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849511, "uuid": "85d5a333-5878-4a1a-ac2c-480f938a6d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849511, "uuid": "080c218c-98ad-4480-81cc-80011a47bc3d", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3837c22a-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "371233d6-c326-487e-bdb2-7eb5c591325d", "comment": "Malware payload (Mirai)", "value": "6de893bde4a9ed897f62caae4b9664f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "c1d0acad-8140-4628-844b-d36d5fca3d52", "comment": "Malware payload (Mirai)", "value": "0caccce78945b8a93b4cf197e12a98ca888555f3a7ec983e78d7f53b6a71a67f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "89208483-84c0-4cb4-bdba-0324a91ccdcf", "comment": "Malware payload (Mirai)", "value": "b599560d61205a4f0a2a785104f6e4282eb1de44", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "aee75c45-e8a4-4ec8-be8f-15fbc93df5d5", "comment": "Malware payload (Mirai)", "value": "0e624197f2bb5bffff38f655c26bb8273d79dd20628437d5610536f43e9e748ebfca3d11726fd1ba8ddd16d5fcb120bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875907, "uuid": "f26c0391-2c18-46b1-8c23-adb1306174a2", "value": "T1FE530292B200A8D1CA51F637EDB0CEC423BA16E8FCEA754B5C55CE74B6C0E533275492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875907, "uuid": "5bac2c1e-d19b-48cb-980c-152f6d5759f5", "value": "1536:aj2Gh3IaV7FCz3adfX3HNqyOiLYTAOfpTYHi:ayk22nHN2iLYJpTYHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875907, "uuid": "39058e42-8df1-48bd-a079-63e0dda432aa", "value": 62320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875907, "uuid": "d2a91f23-5baa-4742-95a5-a0831fc09d21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875907, "uuid": "9ef81507-34c1-4967-a359-b8dbbef6aa1f", "value": "lfpxfytvz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c54fa3-6b98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781843933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781843933, "uuid": "8c05f81c-cf9e-4dbe-8ae9-11e97378f4c0", "comment": "Malware payload", "value": "1519923f2b180bd786241cde479244d7", "object_relation": "md5", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781843933, "uuid": "af4e2bf7-fc23-4c73-a622-05b6b6158080", "comment": "Malware payload", "value": "0d46abeec1f612c50a97359a5a5fbb7c4fe16b4eda1bfb76e1c9355080bd3961", "object_relation": "sha256", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781843933, "uuid": "b917c13d-c290-438c-97a8-91df2d70ebe1", "comment": "Malware payload", "value": "08022cefc0692f3a7b2d7cc7cd6f45c273f5b7c1", "object_relation": "sha1", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781843933, "uuid": "13e32b8a-fcd7-42ea-84f6-9f9887aae5d7", "comment": "Malware payload", "value": "4202cfa869e19a4471beb8cbadbab7effaea805c0587a5bfa59c2204410bd7cf7a4469d035cd138c555382e9dacb7ae2", "object_relation": "sha3-384", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781843933, "uuid": "4aae293a-865b-4337-af75-ea727c59383b", "value": "T13CC2537391EA53B5D21F80B69BA5AEDF6033B1F90520194D6FE01B35AC36C2039AD35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781843933, "uuid": "bb79461d-24e9-4563-8cc4-6fcf2e01ae79", "value": "23b425112c31eba2d92483de23791025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781843933, "uuid": "72c3150f-0779-4e1d-81ad-f0c29ec8a8f6", "value": "384:pasGsZjUYu/WiTfTR7YsgxBwXywstHaNdk2ARehWxn7fYP8eh7TkM53gaJnLYnD2:/3wXyhRaNdk28e8yk63IUvCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781843933, "uuid": "15270fb8-8096-4f8a-bac6-b6337fdfea23", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781843933, "uuid": "24e37882-4250-486d-99d4-9332ed12afff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781843933, "uuid": "49dcc570-83fa-4b6d-bf01-b96543d77b87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67ed153-6bb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781857704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857704, "uuid": "c053c02e-e045-40b1-846a-6d95f4a217b8", "comment": "Malware payload (Mirai)", "value": "30d2c4638de64ce19fc1d6a95139bc7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857704, "uuid": "452fd8fb-4dbc-4cc0-96b3-25c988f90f9d", "comment": "Malware payload (Mirai)", "value": "0d8359391ed8e76e19f799544485c25ba167157df8d4f6c8cf41fe2df5005ed2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857704, "uuid": "3908b3d3-36cb-43a2-8269-ce292e6804bc", "comment": "Malware payload (Mirai)", "value": "185ee392137b6f1879dd3da6a221783d3902c700", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857704, "uuid": "d54e5d00-1830-4a13-9772-07c60ca100c8", "comment": "Malware payload (Mirai)", "value": "1947c4fdca1af1c65c8a86733c68dc313466aec7e89edc65906e9884e2466353b17193508533ce1c4ed97cffc7190935", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781857704, "uuid": "c965e56d-249f-45cc-8edc-43b809363cf6", "value": "T14B649733C82589A5E0148CB2226732515D4787BF88EB26D3EE2A59A0FF3545F51BFEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781857704, "uuid": "113844f1-8788-444d-9d5c-fd020109bdcf", "value": "3072:oLySa+F2KgXaXWFqQtGKwjoCbrdKfmaWcsrHqa01N/:oLpa+FNm5t9wjoOKfmaWcsrHqa01N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781857704, "uuid": "6c98eac9-a14e-49a4-9a0e-d19470fce2d8", "value": 336314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781857704, "uuid": "ec56bff4-cadc-4763-806f-6a39188e43cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781857704, "uuid": "3f3c2dcf-7ba9-440e-8a8c-4362e0b2251d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763f9a5b-6bea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781879017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879017, "uuid": "19bb8699-4465-4746-b721-07238daeaf54", "comment": "Malware payload", "value": "fcdc50c7520b30413b4a0eda404f4464", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879017, "uuid": "851b31b7-cb05-4ebb-9922-2df3b27e9282", "comment": "Malware payload", "value": "0eba8dc5391d1b249389f0d5fbaefa07ae696bb661d81ff25c7e6c04776792ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879017, "uuid": "dfab7eac-c791-48db-881e-f20b99e8ad9a", "comment": "Malware payload", "value": "581ccb215daa1d7bcd13b67ce531d553060b19fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879017, "uuid": "51e5d307-97f9-46ed-9bc8-e7a2564b06e1", "comment": "Malware payload", "value": "0392c5f623561480aa979f26a0e1ca41069293f692ddabccc98f3592c17d81f931d51c768895f8bf415a6087eeebbd18", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879017, "uuid": "c49a7386-5346-4094-936d-7d9d5b1f674e", "value": "T116662CD6B259A4D349017FC9CF1AF7938A1481F38ED2140F32B96A454EBB832D44DEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879017, "uuid": "d8e5d0d0-fa97-4631-9b1c-8b53fdab9ef0", "value": "24576:pMHsP8KeHQSQ3P9lMI7+h/q2Dz/mitTRKkHsKcImQiBE9B+On4nVU8gWEVaDO3Vj:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879017, "uuid": "67122ed9-6160-43a3-a86f-21c35ef88b23", "value": 6935097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879017, "uuid": "18e65dc5-3c4e-4342-9364-ab1c7fc0c2a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879017, "uuid": "4338fda8-3420-4e6f-bf93-135b64244ec5", "value": "hold.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da66f25f-6be1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781875320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875320, "uuid": "febce46d-62a3-4808-a18b-71adde35e308", "comment": "Malware payload", "value": "3954bc46c234deb78453ce27b49ce53f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875320, "uuid": "6dd5907c-8897-4386-b8ba-e6cd82dacee4", "comment": "Malware payload", "value": "118f4e201466783ec9abf4c27eb76396e351bf2932dcd28fb4f4973140928184", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875320, "uuid": "18904a0f-fc21-4a10-b984-352f52a350e1", "comment": "Malware payload", "value": "b23b5eca4cd24ba49265167f9d3563052b522af5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875320, "uuid": "ecb5be59-8bf9-4a06-a521-1f6041273ec0", "comment": "Malware payload", "value": "c4e22e9a2a684c3a127fcddadc2cdfd4fa507631fcfbf25145a641d5af0b55db0f9104e6bb7ec16ce92c004b6ca67086", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875320, "uuid": "10aee605-6f89-4922-90e0-019a2c812470", "value": "T1F7F73330B13579D9EA2FA37FA0A91FC5807074E0B31BD56F63787FB59A9124660B2843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875320, "uuid": "94c8dd1d-2f44-4219-99a8-9771bd6e68f2", "value": "1572864:FcdZNGFihaO0CKyjvaabkmbOv0ZOafxWnhPlpp54VYt7qJhPYFmMZ:oGFzOXomCAOaGVlppFt+JFpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875320, "uuid": "d3a1a094-c370-4c51-9016-f5672ff2e1e7", "value": 72144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875320, "uuid": "fbeb1dce-badc-4ba2-ae87-ad35d3f46126", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875320, "uuid": "2aff90c3-3cda-4d2d-9e5a-2abda5b30447", "value": "LetsVPN.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7a9a60-6c24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781903994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903994, "uuid": "2a024402-1b69-4a9f-bc9e-68ea22d70b14", "comment": "Malware payload (Mirai)", "value": "ee405d06bc22e12583ce0d1e3a3e1fa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903994, "uuid": "313c6e6b-ba49-45fe-b6f1-087e07117495", "comment": "Malware payload (Mirai)", "value": "1252eea1dfabc38919505b5cadec23c8cfd04a365cf09ed9675c2a9c8e8b9f3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903994, "uuid": "bd3d9d16-5509-40d1-9e4e-78b38a40dc92", "comment": "Malware payload (Mirai)", "value": "7be2ac8223c437ee32cdbad02b5b37b11665a4ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903994, "uuid": "790ce759-ef0b-4e13-882b-19a1f9a80247", "comment": "Malware payload (Mirai)", "value": "4fc2a8bc3316dff0014111309a2b86786ae9440aae8b2a3072fbafc4c2703351ea8ccacd65d14635d5cd333e4db5c32f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903994, "uuid": "5fd2639c-c594-4ddf-a33d-b3f98181e2a2", "value": "T1A9245B06731C0947D1672EF02A3F27E0D3EF9AA124F4B645755FAB899272D321486ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903994, "uuid": "1bceeb08-4cb0-457d-9966-bc2a4eb5e8a7", "value": "3072:wFPGtCaxVOstZdkVtZ3ckqsKwz6sAKMKxfVZBwyvmbIYeBrEVqf:Qs521bLMKxfVZBwkm7KEUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781903994, "uuid": "47226eb3-121a-4044-a814-4ec87343d0d8", "value": 213648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781903994, "uuid": "b9f8b3db-076e-4fe2-90b3-55e897b8cde1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903994, "uuid": "8cdf7146-1956-455f-8100-3efa0b4fbcb4", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae83cecb-6b75-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1781828860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781828860, "uuid": "714f9b41-207f-4228-a65e-a0419a9f736a", "comment": "Malware payload (Phorpiex)", "value": "6df4ad5603990ef5fe27f0f912e2a08e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781828860, "uuid": "a4ea6311-9814-46fc-85e5-9262b2281c54", "comment": "Malware payload (Phorpiex)", "value": "1274c4f4785104479457deb4366a31a31aa68e2264b5814e7440600decd9adfa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781828860, "uuid": "36c0fe34-cdeb-4b1a-bc3b-baec569dde25", "comment": "Malware payload (Phorpiex)", "value": "d85dd5e88a082fa1dbc21412bbfb2e0b544aa8d2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781828860, "uuid": "5f2c655b-d6e4-4920-bdf8-0bb086424809", "comment": "Malware payload (Phorpiex)", "value": "e9f617b1b6bd5ebf3fd77d46f9789ee7bad5ee4ee16016fa4d5d81d90da0c520d78a5aa355333804ca77e17068b5b05f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781828860, "uuid": "1ffc234a-324a-4bcc-a951-f5e1d2eb2b98", "value": "T1C5824B0FB8464726C1E100B49636877BDAB9A87137C404DBF79489EE1AA86D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781828860, "uuid": "d3386155-7d62-41ef-b3ec-7cfc2da882e4", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781828860, "uuid": "2644de38-1371-4f12-9a0e-9695f3dd67e8", "value": "192:UWKaqCngTtXWAwjryNjtEyDCMDjlvlgZKP2vKUSiu9zw+ghSoCgbO5qmEdBF92GB:Uw0WPyNQMNvSZ7u9JgwQc6av8U9c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781828860, "uuid": "418cbd9d-9acb-4160-bf3e-899836c2dac3", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781828860, "uuid": "3416afa2-984f-4e8b-bb35-aed253bd132b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781828860, "uuid": "efe682e2-c65b-4422-b227-ac737316abd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a7f40c-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "0b273ad8-382e-4ab7-b7b0-8ea2936b39b7", "comment": "Malware payload (Mirai)", "value": "9106ba96bd29c2f22e202d0fa50ea2dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "87af8189-6160-44ef-b099-446a892ec9d9", "comment": "Malware payload (Mirai)", "value": "1334157d07b2ab4ed7d538a68384ece424e1f47969c5f8283281cf348e6017f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "41f5a22a-138d-47d1-b949-f6448c26b089", "comment": "Malware payload (Mirai)", "value": "8ad25f4c8b8876fe523898f1c9976928550314f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875907, "uuid": "87042164-a291-437c-bce9-7d396ae4e3c2", "comment": "Malware payload (Mirai)", "value": "f1c4cbe7b96cbd097113e657bad4693fd7861c2fefb81a05c5ea2e859b297f66cb1912a8571ba2ea9e005abbec4bc1da", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875907, "uuid": "524ab4c5-7cfd-49d9-8ace-0de0b7a3cbf0", "value": "T1CEA2E19420EB4D35E4358831DBBEC14653CF69FDC2ED60DA2854270496836E7A2FD2EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875907, "uuid": "0cb31a79-4d8b-423b-b41a-20d8f922584d", "value": "384:cONUS7juMPW9fOr/jjL4/0I/x8/7t7Rd8eb7fhymdGUop5hvd0:1OauVebITZ07Rnjs3Uozdd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875907, "uuid": "df408834-983d-44ff-916f-d5c80667a50b", "value": 21264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875907, "uuid": "f7888259-e8c5-493d-9f0c-97532119ef20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875907, "uuid": "86015f74-c4f4-4e57-ae31-a1992ba500ee", "value": "morormcey", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2ec5e0-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781880990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "6aee5d4d-c87c-40a8-8590-3e758c1ced6d", "comment": "Malware payload (Mirai)", "value": "1c298db29521d63c19209bd2b0684f5c", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "104387e3-957b-48fa-af80-c12d7416038e", "comment": "Malware payload (Mirai)", "value": "13c5c94775f264cf9407e1aec42b51a55e2a7d7db611e02e3abb39f357eb8102", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "4476b9ef-86cb-4168-8305-b75eae313d37", "comment": "Malware payload (Mirai)", "value": "efdb2333d701025a50b10813fc187cfc27167719", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880990, "uuid": "b0267094-cea9-4e9a-b3d4-4b3a3c4c523c", "comment": "Malware payload (Mirai)", "value": "743a177ac6fceb578a9cc2057d7d1ceeaa9fa762dbd05caf106559ab6bc8d0156ab62fc05f4b7ae22a2c3b4b8d51a96f", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880990, "uuid": "e5f5b6fe-2ba6-4730-8e42-81d6ece3c037", "value": "T121430194ED9251F9DA756C3228EFC1C5FE186EE008EE981891E782B11D43C759EF92C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880990, "uuid": "7842cfdf-431f-489f-97bb-f352f6d69ece", "value": "1536:geVuxdmRGkULpfhC1UKIfMRdjIAayH6jE4M/7y:3JR1ULcUnYhXKE4M/7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880990, "uuid": "8589c4dd-55bd-4b21-9cb8-2061ea497fb8", "value": 60204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880990, "uuid": "461c99e0-0f60-4e99-9a95-98e11c09a04d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880990, "uuid": "ca875f0c-10e4-43ac-b96d-66ec49dfa76d", "value": "monero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7affbe42-6bdf-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1781874301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781874301, "uuid": "409f399a-504b-4041-a868-b0e222bb00f0", "comment": "Malware payload (NetSupport)", "value": "a6822123bfa87bdd1038e9d02fe1b591", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "softwaredesing-x10-mx", "colour": "#51C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781874301, "uuid": "75d8c67c-8ad9-491e-87fd-36267cc86289", "comment": "Malware payload (NetSupport)", "value": "13c9977ddd34eed2bad7c3a8fc385efb802a5f7fbae62636dc9257229eb1a55f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "softwaredesing-x10-mx", "colour": "#51C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781874301, "uuid": "35c0e8f4-972a-4ede-93fa-e2fe9810a0bd", "comment": "Malware payload (NetSupport)", "value": "699737d9fc4f80d721e1b6cb29fba1a63419d346", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "softwaredesing-x10-mx", "colour": "#51C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781874301, "uuid": "70fe5116-3d21-41f5-a348-5e003f1414a9", "comment": "Malware payload (NetSupport)", "value": "a81a03ef28afef07ef2bbaf60d8589cfe482eb2b1f5073e12313072ee3d571d59d0503c9de09b1d4a0c1ee1e62a56175", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "softwaredesing-x10-mx", "colour": "#51C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781874301, "uuid": "335b1cee-7baa-40b1-b069-2d1158db3177", "value": "T183760220F296C13AD5BD41701A6DDB6F91357E630B3280EB73E83A6E1DB28C15635F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781874301, "uuid": "6d3708e9-4c5d-4243-a5d8-9cd589874134", "value": "98304:I2Ys1+vzMltY+QXPOApNa3RguzGIwNpf+zCPtp/1Vf6biuSHBdrcVn3NzwgU4:IitHQzNah0IwP2zC1tKDS+3Nbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781874301, "uuid": "33847d18-e4c8-4304-ad53-edc2585393d0", "value": 7177728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781874301, "uuid": "8caa9a6d-63bc-477a-a73a-918517e81c45", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781874301, "uuid": "56138367-f45b-4433-93f6-7be948c8ff7e", "value": "13c9977ddd34eed2bad7c3a8fc385efb802a5f7fbae62636dc9257229eb1a55f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3fd7aa-6bfe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781887563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887563, "uuid": "67d2672d-e4fa-4235-a659-ba1bba2d366d", "comment": "Malware payload", "value": "7af3bfc2f7ae6bdc8e62fd7519cd2094", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887563, "uuid": "6f2dce5f-f40a-48b3-99fb-cb5470181f44", "comment": "Malware payload", "value": "143446d8970397dc4a5f94c9e72151716aca43aa853023f9244bd6edfb149563", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887563, "uuid": "d4076dd1-c4c2-489d-ad3b-e67ce8d326e1", "comment": "Malware payload", "value": "ea02ba0307aeba5de9bfce440428858925d8e6f4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887563, "uuid": "8e55e021-e392-41a6-a409-c6b04598a0f6", "comment": "Malware payload", "value": "9827821debca4dcfd8a8643c2b413dd2d189f6239665a34232e2cabb1535324f908c12f9fa4effaedfc0e36208bf344e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887563, "uuid": "90503d84-b789-466c-9861-517d921498ac", "value": "T106825B0FB8424726D0E210B49676977BDABA6872338414DBF7D44AE90B686D5FC3311F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887563, "uuid": "a9b37eeb-442b-465d-b299-599592e906af", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887563, "uuid": "4a6ccdc9-ed43-44b7-8528-20eb1034bfc0", "value": "384:CIqQlV6lvV+v0CvBu9JgwHcOv4av8U9cPF:Yg0IE9b4a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781887563, "uuid": "853a536c-74d9-4713-8ad5-afcbb332603c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781887563, "uuid": "0cb70361-eba3-4eb3-a12b-f0201d7f913f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887563, "uuid": "8271ff48-1484-4ee8-9210-95bf70ec873b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f987cc0-6bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781852028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852028, "uuid": "bccaddf2-e387-43a8-9d2a-b5c8b2adbb83", "comment": "Malware payload (Mirai)", "value": "6984a4e6fbea7b92a5ff97d42f6ac7e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852028, "uuid": "3c5da7e1-1a12-4d93-b909-e35877f56ed0", "comment": "Malware payload (Mirai)", "value": "1668d6b2098807ae46c2406968d1fa81943c6818193c77d3810c3ed2f503cffd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852028, "uuid": "f2eec6dd-ee8d-4434-926e-d4cf5443d6a1", "comment": "Malware payload (Mirai)", "value": "3be235f5dab5a56eea006c92e7b8b6e521c1966d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852028, "uuid": "d5d2c77c-de3b-498c-a826-1b48ee6e4210", "comment": "Malware payload (Mirai)", "value": "5c5c7bce26ce77cbb4314e9f6c96dc7c522ff7ff77a15fae308865b6a9bf0b50140151173c9255f139fe49688615fd04", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852028, "uuid": "c2725cd1-1fab-46e6-aede-6a71b44732f2", "value": "T13E41C0C671E24670ACE1992B32699408B5DBE5CB15CE6FE5ACDC3CE5418DF047805BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852028, "uuid": "604dea4e-771f-4195-ac13-85953a2ea5b7", "value": "48:vjNjxjp4kjdbj5j1jG+jxjxj5tJjRjljVjtj4bCoR:vjNjxjp4kjdbj5j1jljxjxj57jRjljVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781852028, "uuid": "2fa1e0eb-3c56-4ef3-8c3c-2b0460f544da", "value": 1926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781852028, "uuid": "9d55f5f6-d74a-4a02-971d-680d2a1bf8f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852028, "uuid": "b2f5002f-90ee-4a45-a071-7922e7deeeb7", "value": "painbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada1d938-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886841, "uuid": "bcae1fe5-e789-4e10-bc43-ceb285d3e1d9", "comment": "Malware payload (Mirai)", "value": "9c8c272e6119a320a47d6ac768219c26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886841, "uuid": "4b5777af-0813-486f-89b4-0e725a207a3d", "comment": "Malware payload (Mirai)", "value": "171fe135113ba4b82b8a92a65d3a7c7ffc5672fdf3ccab0e994c99257ac48076", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886841, "uuid": "51afa8f5-a40c-4891-8204-2975142ef2df", "comment": "Malware payload (Mirai)", "value": "14485b69a204a50d33c832906f8a3ad020105bd2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886841, "uuid": "d9b9bed6-eb5e-4cf8-890d-fa3b633e861a", "comment": "Malware payload (Mirai)", "value": "8602aed2593a3b421edff3c3fd42d8e6e758fe37e2b68c95414faea66dd63013168527060ccb3116f97b86431d01b7e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886841, "uuid": "ebbb42c8-ba3a-4425-8b21-c5b124cc96b9", "value": "T1566302D2C1963ADA8E5A28392FC2D372669ECB4817F6C9A153D237741C72733526CEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886841, "uuid": "9594e39d-5e9c-4fed-b3fe-bb27615683fe", "value": "1536:rh7ktctJM0Ecishnuoq4NZliRHRBQzfllh5zf6DZswABA4u+qgw09ym:rKeKshnNWr+fcbaA4u+qgwJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886841, "uuid": "1c80eda6-1f26-4b22-b3f8-e127c9f63b1e", "value": 71812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886841, "uuid": "68d014e7-3e8e-435f-99cd-418314886651", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886841, "uuid": "321b07da-1288-45f2-babb-839f1fc48f8f", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75866ab1-6be4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781876439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876439, "uuid": "2c7eb35b-087b-4d62-8002-5b4784dce044", "comment": "Malware payload", "value": "80233be869438f26cc5e000cb7c7dcf2", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "uac-bypass", "colour": "#2B0447", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876439, "uuid": "f14719a3-3d52-479b-b8c4-855801438173", "comment": "Malware payload", "value": "17896b573959e20184d6cfa4f02347344cc6bfdcd2a7f0b9153b7347ca1384f8", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "uac-bypass", "colour": "#2B0447", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876439, "uuid": "fb120ce6-e4eb-4b37-abf5-879e7ff17762", "comment": "Malware payload", "value": "6103df3220aa7b9486e4f62117d45a1ab31dd394", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "uac-bypass", "colour": "#2B0447", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876439, "uuid": "ed43651c-cb6c-41c0-91c8-ab285008e9b0", "comment": "Malware payload", "value": "286b861950c3abcc7d121fc8aa5710ab1992a0351bec9ba8f6ddeed169357b2610c8dcd2a22cf8e9c8c550281772315c", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "uac-bypass", "colour": "#2B0447", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876439, "uuid": "8ffded1d-b360-41aa-83ec-5d17503cbd37", "value": "T106F1C65A2917E1B080B367506CD3A41DF99006339631BC697ECCA7D44F34B7EA3CA19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876439, "uuid": "3092634a-007b-4a4d-94bc-ecf75138f513", "value": "192:jzjLrfFZrsY4pqmthrdMr8NovDcb/E/c7Bpe:TnFerbNo4hre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876439, "uuid": "095a3701-1fc9-4012-ace1-7c94047b2dd1", "value": 8104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876439, "uuid": "72cfbe70-fb9f-43a1-99b6-9c8701da7114", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876439, "uuid": "4a4b7cb9-d8b2-4154-8770-7d6f29d9645c", "value": "Nota fiscal.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe7f05a-6bad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781852935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852935, "uuid": "20dc6957-4adc-48be-a06c-0c71e69dc93c", "comment": "Malware payload (Mirai)", "value": "9608081a1d231e2649d60c4a696bc425", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852935, "uuid": "aea1c031-2bc4-4cd4-bed7-3d7523192cf4", "comment": "Malware payload (Mirai)", "value": "18e7ebf23c30c0841bd2fccffefd4d6a5d0a15283e5d118ba2117ee05e89489c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852935, "uuid": "6a208c22-9fd3-4d2b-84fc-8249ede48498", "comment": "Malware payload (Mirai)", "value": "ac1b5c42d3ccb272c4d0894a58118356059d89cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852935, "uuid": "a45be27c-37c2-43f6-9f82-94addc0fe7ef", "comment": "Malware payload (Mirai)", "value": "b67617abd4f55b39bfd082e23d6131ad03c7ab9cbd6b2e17fae5e74f11ac4f90846681b61f8fb819a667579523f553d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852935, "uuid": "3073b917-45e8-4ef7-9530-9bc61cb7b762", "value": "T1CAF38CC0F743D0F1E85B41B020A7E7368B76A539202BEA57D76DEE36AC52601D61B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852935, "uuid": "06c769b0-9ad3-470c-bce0-d40e3fa8d1fb", "value": "3072:kqQrrGebst/nwGYNJuHdtvsbqBq8LCS+Iaq0vXhVUGCTOyOF+lGLGF:1QrrGebi/nxY34dtvsbqBFLCS+IW0Oda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781852935, "uuid": "12edd7a0-902b-47d9-b5e6-5b5a18e37dbd", "value": 163016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781852935, "uuid": "a5e45385-b4f0-4b19-9cd8-a9a26f13f333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852935, "uuid": "36559a1f-a8a6-4b91-8d58-61e01c3663e7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daef8d68-6b86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781836236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781836236, "uuid": "1a9377e2-930a-4e63-8993-4711c48f9451", "comment": "Malware payload (Mirai)", "value": "576bfc32e31c898cb2cfadf6ca1b09c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781836236, "uuid": "5f9b5a8a-ede5-4cd0-9c78-5e29dc73c5ec", "comment": "Malware payload (Mirai)", "value": "19477ee450732008d98e8ce55d7604ccb2184c684336f0af1685f3773377fab2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781836236, "uuid": "66f5de69-a900-43c8-8753-8cbd86abe070", "comment": "Malware payload (Mirai)", "value": "beaff4aab417113b3c81732780a614a828f573eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781836236, "uuid": "8a454416-2f0f-404c-9cc3-9a21d600770e", "comment": "Malware payload (Mirai)", "value": "ec1fb68f13cfce6c520832cb9c84c81953258b5b546137e5e6cb8b3ebcff5b68f877cdd208334a1e39b3a87c6ab89f46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781836236, "uuid": "881b95b5-a78a-40b8-b630-43e0c18838df", "value": "T156316CDF50241A396212D9ED73733948A00CD4FB299BDBE48C484FAD868858CB261FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781836236, "uuid": "685512bc-2508-4fd0-a81e-8c8daea2db8d", "value": "12:Uh6AlGD6Z5P6966oGp46pZynDbL6b1eaLBiaXI36G6376G6/p5O6khlk6RyE+t6o:sUfo2pUKp/SXVtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781836236, "uuid": "1a698b1e-9fbb-4c19-8f78-220b86cb9883", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781836236, "uuid": "311c488f-3bf6-40c5-9797-a5f981764e7a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781836236, "uuid": "f2c934f2-5989-4321-bf19-ece4cbb835d3", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e45cbb3-6b8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781838040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781838040, "uuid": "5244b256-ccf9-40a2-ae62-d2e0e90760e2", "comment": "Malware payload (Mirai)", "value": "fcca5df0ec70d03a61c82f9e3b4c7ede", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781838040, "uuid": "bceee74e-5edb-47a2-8eb9-160faa7f40a0", "comment": "Malware payload (Mirai)", "value": "1a9fee3f75298b4fcfe3a85b241b0abfcfa93153a1c5a78e5056f46bf060ec57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781838040, "uuid": "fde97f84-b413-4814-aa1e-3eac9d31f1b3", "comment": "Malware payload (Mirai)", "value": "5ba3ab2e3448b4a43df2d4059f4b259d6d2ca99e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781838040, "uuid": "04d36f79-7e64-44e7-b556-c3eb56180918", "comment": "Malware payload (Mirai)", "value": "c95d70efeaf022064dcccb2c9eb8bbd8e25f11536fc3f6a5c5b9e727608f663b5e1acfdca9758d9ade9268a801df4f4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781838040, "uuid": "68d8c25a-db24-4535-9b66-ceffe5af263b", "value": "T1E8E44A46F8809FA1C6C536BAF74D42A873074B79C3EB72069A155B3537DB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781838040, "uuid": "b33ce2e5-26c0-4237-bcaa-8e5f583d807f", "value": "12288:zut3L+Sj9wf0yKMcupI8R08rrZEscO9mstHHF559nw22phsNL18g1X8pEk+HQ:O3aSjSf0yKMcus8xJr97tnF559w2LM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781838040, "uuid": "8840db8e-a188-49cb-84ab-e0fafa776161", "value": 702896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781838040, "uuid": "58e5e010-45d6-449a-a0c5-06a74d8ba1a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781838040, "uuid": "4252cf2e-641b-4901-a77b-f8cbb85e6845", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae547592-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886842, "uuid": "f95e26cc-7902-4a6c-ada8-45a3ec685a7b", "comment": "Malware payload (Mirai)", "value": "041d21bebcf2927b0d35f5f5e4dc79be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886842, "uuid": "da2d7113-9276-40d9-92dd-19b54bbed49c", "comment": "Malware payload (Mirai)", "value": "1b680196d794b31488e00280334d08a8fa0b3c44f8ba73f10b4c18d2d1679ecc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886842, "uuid": "4917ff16-306c-45e6-baf0-515af6e8826c", "comment": "Malware payload (Mirai)", "value": "6886aa00c3c8fea77474478736238d64a4ef5e4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886842, "uuid": "6955af9a-7432-4ceb-9719-49afaca4435d", "comment": "Malware payload (Mirai)", "value": "213d46e58102073ac66f395025b6df8e71baccb0ffd07c23772c15c3a3be61d24afc387e399a9f9d042204bcb0aed0f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886842, "uuid": "b7f16ee0-65ea-4ded-97a1-be154c157906", "value": "T10663021263BBE9B9C65715B0AB641308E9F9F0925AB2438F4554B4ACECBCD4376B0DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886842, "uuid": "bc3e2071-e580-4f59-9bb2-412d970fcb63", "value": "1536:qKotf4OFUx6whyAqZo5se0fEzgQ4OYTOz2QruAGeDLF95UgC+KQe+IE:uf4SUxfyAEo6eDzGtTOzIJCKgC+KQehE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886842, "uuid": "6b88c606-b766-490b-855d-e5a4e092f9cd", "value": 71900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886842, "uuid": "07ffdbe2-687b-4103-8a07-2c8549817ced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886842, "uuid": "03b14404-1086-4b5b-b9b7-7b18d2b97c1b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab70c8e5-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781886837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "65c24100-a69d-427e-a22f-3e5001aa1b77", "comment": "Malware payload", "value": "ed1c50eb0153b370f166b0fc90bb25a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "8d022231-4538-4fe0-a5b5-f5f582193cd1", "comment": "Malware payload", "value": "1c8aec8f95cb04da98761647648f1574733b5af3b043fa3243059b6acd614c76", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "4f06c1c0-bc49-4c8a-9a5e-f894524db992", "comment": "Malware payload", "value": "b20cb76b9b1c6ed4294aa32f43ff78f196a42707", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "b8e213ad-20aa-48ae-afb0-cf08bcaf038a", "comment": "Malware payload", "value": "6c85f77a95b7efdd4537c4c41eb907b67ada7a23550b2dd4701457f406abcedf11416acedb087710f92bf2f91929115e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886837, "uuid": "8ff11e42-e3c5-4234-8732-ae5d88f42258", "value": "T18A215082F8862E52CF35CE381B1687301F72E816C1CBFBCB831574711DDBA056AA52C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886837, "uuid": "2122dc5d-ec5d-430e-948f-e48fad357720", "value": "24:uoln49BVZtp0jE47zeuhD1olZ1bATg7m1ANfjG:uolnKTtp0A4Peuh1olZv72AN7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886837, "uuid": "b6ad8b21-4c7c-4c63-a074-3a8df1138eb9", "value": 1132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886837, "uuid": "4e9f0fb4-4230-461b-81cd-83b2dae2c8ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886837, "uuid": "6edf4c0a-c3df-4a6e-9fd7-9289e5adc761", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4610f18b-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886238, "uuid": "4ff438cb-7a25-4ce9-87ed-ba7661c49e11", "comment": "Malware payload (Mirai)", "value": "c7fbae149db5029cb9bd8de7af513ad9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886238, "uuid": "307e160f-e49a-43ea-86b9-0cfefcb50684", "comment": "Malware payload (Mirai)", "value": "1d4ce6cad71313ed65fa1fbc6d0cb130ae890ff178527e1187f71d47e1e0d48e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886238, "uuid": "42b06613-828d-49d2-a18f-1de326291e06", "comment": "Malware payload (Mirai)", "value": "f1c535ed4b74ef34484403fd7cee4fec66d556a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886238, "uuid": "db1c2bc2-6fd5-4b6d-936e-a49ad749b9ee", "comment": "Malware payload (Mirai)", "value": "e43e544832484aa75231a3b1e9a141527b00f8f59c187730142c3e1cf79c54e6bc58231e70e36fa73f9760ca9aee7127", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886238, "uuid": "aa3b7dc5-8029-4647-938c-85e4b9cc09bc", "value": "T19B932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886238, "uuid": "c80ac423-1e06-4dc0-80ab-4d6f995294b7", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2d:AGUJtkyYEETn0T32TDBf0nsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886238, "uuid": "87f52c4e-b6c9-4974-a556-c1a1f5b9f5bb", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886238, "uuid": "e74fcb1e-e751-4b48-8a07-6e32b5978c58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886238, "uuid": "ab740717-e4a4-4913-8d64-959037c3efff", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8d5c15-6c1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781901495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901495, "uuid": "43689aeb-3e0c-4506-b8be-2a76581f183b", "comment": "Malware payload", "value": "bf5ca2d250f57305feb88ee7a4d10a86", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901495, "uuid": "29de68e2-2f89-4ccd-ad00-e4e203e0a516", "comment": "Malware payload", "value": "1d9224a72e64bb2aad289edc81ea0720c764511c3e2b5beb5d0d5ce82a719abd", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901495, "uuid": "4ffeecb9-7fb7-493d-9dc8-5f67e04b2b38", "comment": "Malware payload", "value": "63912da5ece4f839fc2eda701eb30f00a2b7280c", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901495, "uuid": "b3ef2e9a-afb2-469c-b164-0f744574b5c8", "comment": "Malware payload", "value": "b61b0c5dbd61a17eff46d4e94898c57c0f1813c80de469643d962e3318acd3277fbe367dc00e5ee2efeb36d0ddd966a5", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781901495, "uuid": "94bd0ec6-0fd2-4735-8938-54399ee8feb8", "value": "T1D5625BE2863855C6EE5AAC7043CDE5433C7C63D21B9085A69299F8840ED37DAEB2406F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781901495, "uuid": "3d8c798a-1a69-4765-8b47-251c71416d9f", "value": "7282cc9e51cb73de8f89c7740b0e69fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781901495, "uuid": "9acbe057-0d05-491c-a7a5-bf9bc5ccb8c9", "value": "192:5ekbHsnWNafdW7/lyKFFWQFe1hNUbV46X01k9z3At3kT3pUOk:5vbMEkiZFRAJUFR9zcA9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781901495, "uuid": "7a255388-aad1-4b1f-b278-84b46f5f536a", "value": 14936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781901495, "uuid": "258bd589-e139-40bc-b000-ff448532f993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781901495, "uuid": "0633e29e-a779-4f6a-a7a6-f0b4d932548e", "value": "844ljfpvz.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e91da6-6c26-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781904865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904865, "uuid": "ecbc8b88-75cf-4aff-85fd-65d01bfa3302", "comment": "Malware payload (Mirai)", "value": "a228a4fb5b1fcd0340ddf83b02b2da9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904865, "uuid": "f0f5205d-4d17-4395-a62a-70f5939ed997", "comment": "Malware payload (Mirai)", "value": "1ed43ea33b33afb9661d83c984a572a529e126dedd506f085bfe71a07fa44b8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904865, "uuid": "304c5e29-d807-4e8d-ac04-f4faa44f5eb8", "comment": "Malware payload (Mirai)", "value": "6644ad3a61e3e98ac7a649c7591f66a8ce56a3cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904865, "uuid": "3c4dac44-3ace-4e46-bae1-0eb75ef78fd0", "comment": "Malware payload (Mirai)", "value": "b4f53653bd5d2f0ced483f21f71ae8f4a56d1693c8c03b927e3fce88154bdf8920834548b0c8a834e89b9145cb13361c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904865, "uuid": "f0aa82bd-db2f-4cdd-9eb6-e8170a98d8b9", "value": "T10DB33B4AF8D0EA22C6D4667AFA5D029C331317B8D3DA7102DD14AF3533EB55E0B7A606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904865, "uuid": "438b58b2-f6b9-4568-8fb8-f04531d657ca", "value": "1536:IV0Qw+ULLIBuQTzn06Zl+hcENn8FDx0aCYOuiNhw2V2d/EwWOzwQIBQS1SxcX+ya:IKN+ULs8QTz0OWctWTwoOBzwQXWXv09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781904865, "uuid": "26792654-ba95-4b6b-b474-ce7f442e1956", "value": 111940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781904865, "uuid": "4005eef8-7ab8-4bbd-836f-77bfa32b7d09", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904865, "uuid": "8d887550-0e39-47b0-a8f7-216174df234f", "value": "monero.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7269ec86-6c25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781904351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904351, "uuid": "932cbaac-5581-4c3e-8518-cc6fb314ec06", "comment": "Malware payload (Mirai)", "value": "540f8eb0e726d8ec2a8267a2b7286fb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904351, "uuid": "1be78e59-d7ab-4b06-9c73-4c98442f05fe", "comment": "Malware payload (Mirai)", "value": "1fefacc37f5496de0e4e138351fbdb6670ece4c061c9b4dc1cdc42042cf7fdd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904351, "uuid": "8ededa95-ad60-476a-8bc7-143b0782f23f", "comment": "Malware payload (Mirai)", "value": "faa81c23c7fcb96428c87b1f915f4bb28bb47e2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904351, "uuid": "26513ddd-95d6-4a04-9c2b-c5cd3735afbf", "comment": "Malware payload (Mirai)", "value": "2d0fb6ce6c462927a61b0afe8da6c0215eae1b0fac21278b3d2ba3236cce94ffbec36366ceb1a6243782f4a7b5784fb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904351, "uuid": "c59a7a99-316b-4e67-b31e-15e30b847bc0", "value": "T19C8302E2191081D7EE6BE0FD46E4DB4C5DF20A66EF416C239592C4F9CD49C375E822E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904351, "uuid": "2df10f42-4b75-4437-a0aa-525c4a541f97", "value": "1536:+XpbwpIbUdRkOYQbE6q1ad05lt8vjC5CrUpOtGd5sUXxiQsa5PTIxg/DGHhiOVJY:4uIQRJq138ei+oU5j4QrTlD4zVQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781904351, "uuid": "037cd750-a4d1-4947-b02c-eb0cff6bbd48", "value": 88148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781904351, "uuid": "88cc34db-9de7-4d5a-a1a9-a023b1bf14c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904351, "uuid": "5f181fe7-ed31-4b60-a135-f2240f4af977", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9a805b-6c24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781903937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903937, "uuid": "b6328e87-98b1-49e6-8540-7e5a9a11ef40", "comment": "Malware payload (Mirai)", "value": "17e022c3a0679c87b57398a2b76e45e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903937, "uuid": "ff77e5e8-ee52-47d8-bbb9-b52dddbe807e", "comment": "Malware payload (Mirai)", "value": "1ff2f467c436105f31af458e58422c484991c08ef031f892fe39dedd05c86c49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903937, "uuid": "27125093-533d-43e3-80ed-345ff8e0e85d", "comment": "Malware payload (Mirai)", "value": "a72ecbd23cf737d080f2ca14a7bcaec8e9a3afa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903937, "uuid": "b01e184f-33b1-48ac-83e8-58b9b436de97", "comment": "Malware payload (Mirai)", "value": "872da764a0828310f9cb1d8ae875ddca42d0e1e84874e9b31e02dd5d8f3970a2a5902c58d5349390a3f7aae0f31b0d06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903937, "uuid": "755e9e3a-b326-4ba7-87a9-84976a39fdcf", "value": "T1AB7302059B9459DFEF5FDE36CD51E3C08363EEDBB898E623B0404B72891E61A71819C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903937, "uuid": "34caefe5-81d1-410b-acd0-5479bd767833", "value": "1536:+7kwOZ3kbepEh/qAguaOmxDm4yWgU858lwNTowEDZ/jgXeWjPaFMr4u+qgw09u:+gwORkbef7xd4UzwhowEDZbgXCF64u+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781903937, "uuid": "7526fb69-979c-456d-8223-dedd1a308a99", "value": 80628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781903937, "uuid": "eb454ff3-c94d-41d7-ba54-fa81cfaf1584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903937, "uuid": "df88efe7-d9ec-4f49-9cb6-b1aa13efec51", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31a825d-6c04-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781890393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781890393, "uuid": "c2647f87-157d-4008-b948-b1117ce85c9a", "comment": "Malware payload (ValleyRAT)", "value": "98a7f905b18359626152c22ba906b3b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781890393, "uuid": "56d8bd37-8cde-4286-abbb-65e4e9b0bf2e", "comment": "Malware payload (ValleyRAT)", "value": "200d9f5d041c870e69f73da32c753a69096742c33e2dab65299767ac31578267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781890393, "uuid": "4f7f75a4-a154-438f-bf15-d19ec556c602", "comment": "Malware payload (ValleyRAT)", "value": "d7e894fd2e0bb23b361749ee6939e4576d95220e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781890393, "uuid": "030543bb-75e2-42e0-b7b0-3935638aab13", "comment": "Malware payload (ValleyRAT)", "value": "de9c29cd651642d6afb4bb93a4e677229ea9dea3f20eb2dae7986ffcb0206d8a418a87b86028690ee9b018d87a2d28f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781890393, "uuid": "a7ec0324-adff-441f-8f71-ded62d379264", "value": "T19608F816B7468DDAF4299334889B4F50B372E8B157B1871323B423289FEF38C5FA6654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781890393, "uuid": "dc32b14a-46f2-40a8-8a89-ad82afe2f1cc", "value": "380560563ebacca1589d8d38ac610187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781890393, "uuid": "880fd4f6-f490-44ee-a812-58422396d98d", "value": "196608:zNnmx+fMeDrR91QJBqtiEPFNPy9iRlQTn2VMrqNU8kQmHZspvUEF:pvfRba9i4BrqNhvU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781890393, "uuid": "8550090a-9887-4918-9894-a213064799a3", "value": 77527552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781890393, "uuid": "6850009a-3050-4856-a053-00f7cb99aa82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781890393, "uuid": "8de4d392-8f23-4b2d-9cbb-210ff672f173", "value": "ainstaller-86533005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b454f989-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913051, "uuid": "380db18d-2a15-4ba1-a355-af3ef505b221", "comment": "Malware payload (Mirai)", "value": "d50c26683c632c2e82e32459b96036ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913051, "uuid": "4053770a-babd-4cf6-8408-75a6afb94cf1", "comment": "Malware payload (Mirai)", "value": "20d2fa16db188bc3b9a5b1a8758859238150e2692ae68ddeb2e3937e55efeadd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913051, "uuid": "8169b628-23a8-4fc1-8073-6fad29ac394f", "comment": "Malware payload (Mirai)", "value": "daf709e0ba85dcd6e20ebb11e59571751438b693", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913051, "uuid": "eae4b17f-8bd7-4ecf-addb-3421318bb608", "comment": "Malware payload (Mirai)", "value": "9b54ffea441bc691941600ad316ca911da2c26603b64c8ff62eefc48ce232c5c70616bc91edfe8773875c455c139e873", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913051, "uuid": "59c35dd8-963d-4216-939c-e8b2ad7d069d", "value": "T1BBE31916B9519F12D4C321FAFB9E918933136FB8E3F97102ED206F54278A99B0E77502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913051, "uuid": "68e0db4e-e6d2-42cf-9f7a-4e90a88c0fdf", "value": "3072:000Tmg3H4KMNC9jkag8dLfYLKnbaav1QdP1BcPVr9ivIOcp6GxfO:0NmkYKMNCJksgLcaav1QdP1BiVr9TOWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913051, "uuid": "ecbfffeb-e899-4a15-971d-1f74a14bc234", "value": 146760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913051, "uuid": "f2ae1d7c-4f28-46ed-8fd6-30453e368892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913051, "uuid": "4650b55e-552a-4b58-9e97-1a8409b35995", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de0f590-6c08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781891834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781891834, "uuid": "8c1cb94d-f2f5-4073-85db-d1e49963d6bd", "comment": "Malware payload", "value": "d043ad471c5c5d9eb55878078395061e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781891834, "uuid": "55418615-19b3-42ff-97b4-23577eddd82c", "comment": "Malware payload", "value": "20d6f27f35e504aeb85eb5935817e28449968e8e2383d5c4d81344fb505c9ada", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781891834, "uuid": "8dd21ab8-3c0b-4e03-9283-a75d3cd4efce", "comment": "Malware payload", "value": "549091b7c23f7835e6fae1e5c3d803f2250e7882", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781891834, "uuid": "37e183e3-81a3-40c7-936f-cb0c1ef0c97a", "comment": "Malware payload", "value": "06df86b4a2d0b6688af76cb593767332ac1e8c3057a6ed9adf347bf77e81abfa27832bad3745802281607a9858762d91", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781891834, "uuid": "337e6af7-a0df-4867-a288-a24c5c20856f", "value": "T14932D7B2BA69997539ACC21C499E92113A9B3DFB3614347874AE75043FEC70C01F1B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781891834, "uuid": "116e68a2-e66f-45ee-97e9-ee24295e6909", "value": "192:L8XDhEkqYGbgBLGLe1pZp2ofnRitGel+Zo5PH03PHNGpdggGod:4EkYYnfiLao5PUkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781891834, "uuid": "bd40e23b-eb83-4613-ba51-e5ffa996484a", "value": 11223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781891834, "uuid": "40901959-66b0-4ed1-83f1-4c2e939cb84a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781891834, "uuid": "fd648432-4d5f-4f2b-bfb2-3ca10b542606", "value": "deploy_softwaretech.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564b1e22-6bbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781860066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860066, "uuid": "d688129f-8057-4ee8-936a-243cfcae3dd5", "comment": "Malware payload", "value": "40e0e35cbfff20835e859fce48a54353", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860066, "uuid": "90e79b9e-4bfb-485d-b56a-b2029812853c", "comment": "Malware payload", "value": "20ea0bb5d211ebd39c76d3b6c905921d4aae19b35b647a920b23bd1cbdaa9b56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860066, "uuid": "dbe54577-dd83-4bea-a802-273b2b3250c5", "comment": "Malware payload", "value": "d3a8238d8345b5e3b91a0c682f86ceca1d643a4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860066, "uuid": "8dcc4f6b-34ff-4dda-b89e-83a8543b26b0", "comment": "Malware payload", "value": "1aa9325b31b2c3b1ee58a2c4bd34897994770e9a6a3049f6c73580a64333dc27d042e503eed950024ce09ce7f149f719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860066, "uuid": "0947da10-f734-4463-b840-c3fa990f86aa", "value": "T193A3C80F7F61ABACF3B8863497B34A709A8832D126D5C184F5ACD7083D7424E591F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860066, "uuid": "eeb1f4aa-3f08-4a1e-ad06-d7ac92b2c529", "value": "1536:hSf6NIYdBcoqXbF2xDUNkZfHKj25CuXwgIWL2mwfrmt7Tjs1UPw8kaXJaf4tdt99:JIYtdnP7T2szIfoB9gIZnN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781860066, "uuid": "7dfe1199-c2a4-48f4-b930-6e18cdbb4ecc", "value": 101436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781860066, "uuid": "83dc1358-9d37-4765-a77b-fe8b674a834d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860066, "uuid": "d523320d-bd50-4354-b14f-93dc3865efd7", "value": "6Peh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77163b60-6c27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781905218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781905218, "uuid": "38431a6d-9446-4b30-9bf0-3c5eaa1c9fe9", "comment": "Malware payload (Mirai)", "value": "ba71996b79d877ff07a1791a09b0d36c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781905218, "uuid": "a3653cd8-fc89-4e0c-8770-e07f9f830791", "comment": "Malware payload (Mirai)", "value": "215d4b6f3f7ce52f41e5ca8807eba23ba0199bfff9225f6be1f7ea0333c05814", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781905218, "uuid": "0b5a12c3-494d-4444-97cc-9108a148ee5a", "comment": "Malware payload (Mirai)", "value": "59d51422d93bd2592004f8969d86e526e270af4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781905218, "uuid": "3085a7a6-5f6f-43c4-b4a8-b95e05908539", "comment": "Malware payload (Mirai)", "value": "39f4ed1844cab4e74fbfce631ea1c294dbfb72bb0508137fd921e4f7eb09e0812467d9e3f508d9c7ce638dbc39d6fa38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781905218, "uuid": "40baf6f4-9747-40cd-99c5-0c09a0af4d63", "value": "T16BA312E5C18FD6F2CDA674A2ACB8E6494839F7D4B5FC117B1311AE240878A87C274673", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781905218, "uuid": "f50b9f78-a470-44a5-bd7f-0f0e8943cbdb", "value": "3072:iqWoXw3yhVzHf/S/5/8GYCa9XV6LtSXG2vkgOJuFERm8N:rWoXwGVbCdtYCml6LtCG2vkzJCEcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781905218, "uuid": "9a112ee6-6211-47e3-b882-1446023d5748", "value": 106084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781905218, "uuid": "920f3c6d-0e72-40aa-9d5d-aafc0576b76c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781905218, "uuid": "f5c77c60-12d1-41ec-9834-29815a3e43e1", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a97dbe-6bec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781880093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880093, "uuid": "996aa218-0896-42c0-9c15-e38b71a32ad5", "comment": "Malware payload", "value": "f5bc414e0201d56967a4380524e6c6ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880093, "uuid": "336a06a6-4dc3-463e-9bf2-224348d74787", "comment": "Malware payload", "value": "21d540bd2d78b44c60915f81f42490dad986b557b287a2b81c38ce1f04c1afaf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880093, "uuid": "1f459320-8e62-46f7-860c-db2c6df3065d", "comment": "Malware payload", "value": "8e6915eecbe7c914625f8448bb8ba9548556307d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880093, "uuid": "01a56cdc-1f60-45a5-a015-6879679debb9", "comment": "Malware payload", "value": "09b76d91759ee3a08fbb07be6c9219036b10489ff649c1eea52c9192fb6c9cdb539760299ef10756ff581e3665440fbf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880093, "uuid": "4a3eccf6-a4c2-4337-835d-45551fecad73", "value": "T1E0019043F57B5A6FCD5572895120535CE9829FD2250396777A9D4C0C4703D1753874CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880093, "uuid": "f9dbdcfd-a813-42d2-96fb-4d97c6ff3ba4", "value": "24:ynDmOMGv8l0Q0MGv5f80KhRzp5mH5uTLmOD5uwXecT0VZ/qajWf:ki48xH45sft56vODhiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880093, "uuid": "668edb78-f41c-4a3d-a8a5-b364958a04ef", "value": 790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880093, "uuid": "43b733bd-c0f3-464a-87e1-743275c87f25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880093, "uuid": "317ef3f5-ac23-48a4-80ad-8565d4473ef4", "value": "System5.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3db1c2-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781880988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880988, "uuid": "c6e8befd-d431-42d8-8fdd-db3c5f850167", "comment": "Malware payload (Mirai)", "value": "2977b4a016be8e5d6e4b5e97ed75a7f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880988, "uuid": "05deb014-2d25-41c1-b407-1fd5264e1eb6", "comment": "Malware payload (Mirai)", "value": "2243b85457a3b5d566d4c1aa3c6578d73b0a1418e0f46ba2346bd89bcbb7c591", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880988, "uuid": "9495c0e9-6304-423f-84ee-a7de4d3f6bf8", "comment": "Malware payload (Mirai)", "value": "1a2a2a0101af7203ebd4b3c69bdd48f2a2c26392", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880988, "uuid": "27fce389-fe71-42d0-aafc-44194815eb91", "comment": "Malware payload (Mirai)", "value": "1640925debc529e94e57f78461c3cde7c8c045d0df95439fb35e425c5f9bc562cd3b947595a599232ee464c7135294ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880988, "uuid": "a09e708f-fc60-4d9f-96a5-ed01fbf6d0c0", "value": "T1A9B37CD8B24D3D6ED1A32D3E865A471B6F1C4E60B8434D0280A5FA8757F70AA1F364CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880988, "uuid": "296ef4e3-14e3-48e9-bb26-f7b54b5ba6e0", "value": "3072:WXpetHuohVIwh1WZf0EsVUJHRNqSXvAc/Yoc:MCuUZDWZfbsVUJxNvAidc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880988, "uuid": "97e48a70-c08d-4a21-a2f8-11aa7424624b", "value": 117284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880988, "uuid": "386fa614-838a-4e5d-9034-771f4b932581", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880988, "uuid": "90668f94-0800-4161-b78d-85819f0c2b9f", "value": "monero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf7fc0d-6bc9-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781864937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864937, "uuid": "9d9db778-1e28-4b75-8dd1-0fa4ebee4c2a", "comment": "Malware payload (CoinMiner)", "value": "5ea04d9d8865d5089af3ce6dbc7daa73", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864937, "uuid": "d881a0b6-4f46-4b54-9a4c-a4f31bede24e", "comment": "Malware payload (CoinMiner)", "value": "237e6ff6b83166d19edabf4cade3cec3ceb4b9665b70c52d4b0e79b9670d8846", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864937, "uuid": "3f4de317-8815-4638-aef4-64c460d4d9e0", "comment": "Malware payload (CoinMiner)", "value": "5339fcfe4e1059f3b0207de13fdf72b0774eeca7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864937, "uuid": "a9d7cb30-1a8b-49ca-a783-2859d48fd017", "comment": "Malware payload (CoinMiner)", "value": "b4fd7c7d636b87fff7bef32320c6322ab380d80d255a4b06839499eb6b3d0d27d1fd6eb642b022b7b6e059d4b68db078", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864937, "uuid": "9df9854b-942d-4229-82a5-b2731a436c1d", "value": "T149C523A3FA446DF9E126C435474581732872B48A0B39B3FF179402306E79AFB6F68719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864937, "uuid": "eacc2373-33d5-424b-8bc6-c6c2f8bf2e58", "value": "088677779e5c66c1ad4fb67f6207c321", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864937, "uuid": "db59467c-a277-49d3-8e4c-337d157a194f", "value": "49152:oqwiBoa9cQKzGCh3buPMbh3Fr7fSvU1u0M2N6lyyOn0ACw5lBYtJHQdN8AF3/5:h6a9cQKzGCZqPMbhVfNuPxO0AC6Qtg6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781864937, "uuid": "f6b2e951-8ef4-453a-8e2a-374bb3a025d7", "value": 2721792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781864937, "uuid": "7ccb6d52-4e0c-4e0c-b845-0347d4df2760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864937, "uuid": "b31d567a-a64d-4a84-92c7-c15c3c8555a3", "value": "SecuriteInfo.com.Heur.Mint.Phil.57.53113593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989b557a-6c24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781903986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903986, "uuid": "5b64f9fd-4ae8-44be-8aa0-df9b29cf908f", "comment": "Malware payload (Mirai)", "value": "ba1cbe816b9eddacaa67f7f253b023ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903986, "uuid": "92ac2885-0c48-4827-ba90-eb5799d5f577", "comment": "Malware payload (Mirai)", "value": "2442e192ac15d6948ac4b393962633f4052ec7e1c02067fb371c8577fd859b77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903986, "uuid": "410c6a93-c4f0-42ac-b01d-4ff0fe20f12d", "comment": "Malware payload (Mirai)", "value": "e2e1a2b5f536413c53190dfd0f2ddcf970e01c5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903986, "uuid": "576b0174-d85c-4147-b495-9d71e2ff93c7", "comment": "Malware payload (Mirai)", "value": "d7796b831a1a011869d5e5bc1b4d8fd90c2625f237bb8b8baf6afae88cc2befc5f18bba49ca5de72f52bfdfd4110ae15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903986, "uuid": "14f2aab1-8bfc-4e2b-9570-e863294ab143", "value": "T13F54080AAB210FFBE8AFCD3742E90B15258C545722A83F397974D918F54A68F06E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903986, "uuid": "079940f4-88fd-4dc9-b007-802fcd1c9ad1", "value": "3072:tD/pNJq+cr+HmbNGl64Owploz6gc/mBKn0qi/DxFbH0PWq:1XiggNK6spltO8n0ZzT0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781903986, "uuid": "234944f6-bdf3-4909-b993-cc1daaf6abd1", "value": 284136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781903986, "uuid": "0ac3536d-05d8-4013-927a-b7c29317273d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903986, "uuid": "5d1941ea-b25c-4f20-a093-755e71c4e7d7", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68420ee-6bc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781862026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862026, "uuid": "b82555a2-24ac-4a02-8e8b-92e7c21eff71", "comment": "Malware payload (Mirai)", "value": "5938dbd5288465d9939e145d3caf99f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862026, "uuid": "88d99fed-503b-4dee-acdf-33af721b970a", "comment": "Malware payload (Mirai)", "value": "24628457f68bd31f9087e79c64ad93746945e3453330bf76b25794c32930af9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862026, "uuid": "2d065abd-7a8f-4423-a0b2-208d26d6811b", "comment": "Malware payload (Mirai)", "value": "6cea5214d7165fcea5f5ad942fd8b4064be5b691", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862026, "uuid": "66dfc7bb-1251-49b6-af77-8fa413e71af2", "comment": "Malware payload (Mirai)", "value": "31f9ae1ea353a0465c8e286cb925ae474cc3aa5b6741677ce668d1b95c5aa6f0435ddcf2bc1ff7688f3563d12a5c2dc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862026, "uuid": "360c6cd3-dce3-494a-a0dd-73232e8bb101", "value": "T145C3E60ABF110FFBE85FCD3B06A9170125CC595622E97B767674C928FA4B20B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862026, "uuid": "e36c7a68-9ade-4083-a495-bed78dc5fc7f", "value": "1536:TVvDdyzjP2dLGKcFJ9oda//OX6aiFdXQEsinoWGZ9G3b9V+9NRn+zSv7:TVvDdyzjOzc7EVdWGcYyzSv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781862026, "uuid": "afe3345c-6bbf-402d-8ad0-6628803e2e49", "value": 125236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781862026, "uuid": "45a0f9e2-059b-45fb-93b8-85d5b376e685", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862026, "uuid": "a398e682-4cd7-424f-ab68-2bb39bd086ca", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185edbfa-6ba2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781847936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781847936, "uuid": "19c4282b-b80c-4801-bcc0-02868888c7ee", "comment": "Malware payload", "value": "cdd5fac679a85e4d1de22dca7ad29999", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781847936, "uuid": "b552f50a-8634-4911-ae1e-696ea15bb58c", "comment": "Malware payload", "value": "24bb09dc880015c33e9ab4255bca47870d6e527da52e14963b438a3e321253b9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781847936, "uuid": "f0d72b32-7eb9-4c80-9118-753e3217110c", "comment": "Malware payload", "value": "74c1897c81da67bde47bb88457fe5dcc93b4b22b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781847936, "uuid": "8747db18-6db5-4f69-ba9a-b4398902eaa7", "comment": "Malware payload", "value": "ee6999b71238d08b99516be71ea938b6f7f9f0053ba59ff7275293ad0048a0b24cf6e82b650fe32141359f5965fdef80", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781847936, "uuid": "ca0d5be7-f38d-40da-9862-ee81c4c23ca9", "value": "T116916B8E61F05A99C6BEC4B4CAC7837F721D470CD43725CA79F48BE71480B1B85247A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781847936, "uuid": "5cd7f9bc-f2ad-4be9-a470-a64b9ed3d208", "value": "96:6TdHaLTgQZjbrQ6xmsW9rIVrA9FQKNxAjNZS7750FRfP02RorfiMJZWdWsC:6TdHsTNN8F8V9KY4GH0A0iKZWdWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781847936, "uuid": "a2e4e880-65ad-4938-9214-034c275fe02f", "value": 4311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781847936, "uuid": "beb58726-eef2-47f8-80da-3cb94eaf45cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781847936, "uuid": "2d0ae60d-e8ae-4107-b5d8-18b5539ae8b4", "value": "photo-523534430.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a97a5c8-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886353, "uuid": "61b969a9-c87a-484b-9c65-e2cdef631b99", "comment": "Malware payload (Mirai)", "value": "33993539cd4816c4b17c0e45ebd75617", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886353, "uuid": "6f6910e6-405f-40c3-93b9-caaa1a880d8a", "comment": "Malware payload (Mirai)", "value": "24f7a00c92e55f8a2879bcd3fb4586b29ffac0cb0d6ca5293574e7d3c5af3fc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886353, "uuid": "be8cade3-d3ea-47d8-a3bd-fdf92322707c", "comment": "Malware payload (Mirai)", "value": "6b52f491b553da302ddd350b66478d1af78115e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886353, "uuid": "f448db96-72f3-41ae-9124-a9cc749a0d1b", "comment": "Malware payload (Mirai)", "value": "ee199b9713a924943a766dcc123e6b2046596cb4c58201b8f16faf325bcded0305fb5ed35ccaf770c6e91fd8ca553d94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886353, "uuid": "83af4993-8b52-4d73-b8da-cf4629f266f0", "value": "T1C3F31885FC518B13CAD266BBFB5E428C37271768D3EB71029D255F20378B86B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886353, "uuid": "f1825ca3-ca59-4280-935c-17d7f0d48aa0", "value": "3072:l8ySFTr86F75vXT+mHtkl9S2T4O29mLLPddB:y9FTr86F75vXT+SevFT4396TddB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886353, "uuid": "f085a9e8-2f6a-4a44-8c70-45e6ec61c302", "value": 172412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886353, "uuid": "118d2a92-d390-497a-867d-f393f4c81983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886353, "uuid": "dccfb85e-b9e7-4fe5-8fd1-f3dbf2b74e36", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3feb2fa7-6bcf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781867329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781867329, "uuid": "6c1be718-282e-4dca-9ba6-a2edad00ca11", "comment": "Malware payload", "value": "840225afbf38bcdc2d4187d678fb1962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781867329, "uuid": "292520a6-85f1-44e0-949d-69704f1aeaf8", "comment": "Malware payload", "value": "251723ad1245e1c87c3d8a656727691a5bb2c7003ae4a952c0941933b2103011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781867329, "uuid": "9895e0a2-e693-4fa0-8eef-dde15b610ec4", "comment": "Malware payload", "value": "a40a3ffc2991b6b842535d02661fe303097db56c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781867329, "uuid": "bf355d2f-d5fb-4805-9e62-32ac70df21b8", "comment": "Malware payload", "value": "86da3d1a5c69a8b4785495bf1a348ee28518b24df516f77475b941e437ce6d98602648efe6b9537eea4d4ca78b92bc2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781867329, "uuid": "2fcc921f-fe69-4d01-842b-5744be977d6d", "value": "T1A308330E046DCC46C57FDBF97A9274A6D200C8372D75E56E2F190B9CB5E2E1210BDA2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781867329, "uuid": "a4dd6de0-ff0d-4290-9adc-4386a127fe5b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781867329, "uuid": "17879719-4a6d-49dd-b83e-7ea211be671a", "value": "1572864:Zt9IKPg6/kRWYBJImKljUoEkB9dNDsMLXgiMZrIuEtBYaZSx7:ZUKlkRWqImKljUvOhLXMxIuAEx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781867329, "uuid": "aaa3d664-3a92-41dc-9886-6b806d19b7b7", "value": 77303803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781867329, "uuid": "421168e9-71f3-42d4-b5da-f4c6d37160e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781867329, "uuid": "438c43b7-5407-4eb5-97ed-6f17ba796cc7", "value": "coraline_4.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d84303a-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883619, "uuid": "94f362f3-7876-4f80-8332-4030bf9ad5fd", "comment": "Malware payload (Mirai)", "value": "be9ea898d59da6f4423ce989170409f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883619, "uuid": "35abb87c-9111-4829-af31-9822765ce8a8", "comment": "Malware payload (Mirai)", "value": "27392ed3727242da298176dde9ee699a2d20a61a403d330bb2390c600299ef20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883619, "uuid": "4d4049bf-7256-4a8d-9a8a-146e6d104151", "comment": "Malware payload (Mirai)", "value": "a8be8eafe08b523f6607b6947429f6f43da31027", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883619, "uuid": "fe2a5ecd-35fa-495f-8b5d-0caca541f3df", "comment": "Malware payload (Mirai)", "value": "7807c42e698c84e88cdd660e4f7bae68f841c6edfd7cf65f55cb0749dcd3404b81bb6ad3725a583dd063f9af2d271c6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883619, "uuid": "e42643c6-8e72-43de-ba2f-73556ae2ac9f", "value": "T1B8A34A03B1C584FCC48AC2744A7FA136E961F9AD12347A2A3BC4EF6D2E5EF101A6D754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883619, "uuid": "d8940971-1a61-49b2-8bd3-e94743e662ab", "value": "3072:tl7h4kQOONOrSAEXYCETu+qpUBGdLrlF0F/:tl7hFJrSVlrLpUBGJT0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883619, "uuid": "c6395c7e-481f-4639-9441-5f851cbd1b54", "value": 107080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883619, "uuid": "08213686-144e-4e0e-ad03-efd9c813cfac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883619, "uuid": "49b0df8e-b941-4635-815b-c7bec27de9d7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c065c8-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875909, "uuid": "dfe2f142-bd91-4e56-867a-0a9287f4d677", "comment": "Malware payload (Mirai)", "value": "da0033234922da2a540966b54c714710", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875909, "uuid": "23870487-6857-42f9-8080-c79906e4b874", "comment": "Malware payload (Mirai)", "value": "27854d042e0f7eadb9ada596099bfd5c4467fa6d1e0e3e0e27d737621c15c2c9", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875909, "uuid": "ed8360f5-b265-465a-ad3e-101921c9e870", "comment": "Malware payload (Mirai)", "value": "77db4bbb2736fa9a1fa086815a833618b17a5dfc", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875909, "uuid": "71da2a34-0acf-4887-b31f-5c571d439f8c", "comment": "Malware payload (Mirai)", "value": "996dc71f3a9d8c20cfa5a2d9373e429bf4176a139d934ee67583baf0d688f1a62edff3fa23b0ab010a31a509c2acdf76", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875909, "uuid": "b7779369-f70e-49dd-ac3a-9d7921ff2867", "value": "T1DFF2E172248B4DB0F7705A3596ADCDEBEF612B6BC0F421976698C052C3421E3B67CAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875909, "uuid": "4bb83f03-abff-4200-b358-425d528d1391", "value": "768:gGILEwd4kDtT/mAo1vA6APPnnMUxGK/dngQsks3Uozw:gXEwBRzaBinMUxddgQsBzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875909, "uuid": "6607ae78-f2bd-4a65-ac10-eb5e20a48a37", "value": 37076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875909, "uuid": "338754de-8748-46cb-ab9f-ae1d0d20c5b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875909, "uuid": "5ea936b2-bf30-4f40-88bc-21d58c0640c8", "value": "simjxtksv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c51ee8-6b95-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781842512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781842512, "uuid": "e51d0c44-3b94-449d-8a19-5573f15e97ee", "comment": "Malware payload (WannaCry)", "value": "6013e386450fc1e86c3163aa3beb5fbe", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781842512, "uuid": "8c0b35c4-764c-4266-8ab2-96d81a9ca412", "comment": "Malware payload (WannaCry)", "value": "27a60835e9cac833ed550ab42cfc2e84c48a4fc641f29a57dd4cf5b6dd0ca00a", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781842512, "uuid": "cc2b8140-ccb8-4690-982c-f8cc0c6f3bd9", "comment": "Malware payload (WannaCry)", "value": "6fb597bb7274316934192dcca56b9b4f20c2944c", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781842512, "uuid": "8d4ce94d-6c6b-41fe-973a-85f4f74203a5", "comment": "Malware payload (WannaCry)", "value": "b5b8a9bd9e847efcb4e0eb6dc477bcc3971cf51348d2df7cfc63ec2e12c191e594cbad3a7a85017475726ac61040bf29", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781842512, "uuid": "59809db9-2d9a-44e8-b535-0d15f4058f35", "value": "T1FA051219326C81BCC117523494B34E36E7B3BC9A527D970F4B948B6A0E13790BB79B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781842512, "uuid": "6ece269e-aad0-4442-b3a5-12d8dca0f530", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781842512, "uuid": "edef3ba8-8c2c-4953-8f21-00fe492c37b8", "value": "12288:jbLgmvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+1:jbLgWbLgddQhfdmMSirYbcMNgef00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781842512, "uuid": "5ca544de-c43d-4218-8582-040a0c81cdb6", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781842512, "uuid": "fbad858c-9c4f-4318-b656-80df14e5a1f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781842512, "uuid": "365c20a1-a93d-4965-ba68-54c8263d22c6", "value": "27a60835e9cac833ed550ab42cfc2e84c48a4fc641f29a57dd4cf5b6dd0ca00a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394e7848-6be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781876338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "40947efe-5069-41c9-aaeb-7913fda71a54", "comment": "Malware payload (Mirai)", "value": "f230c1766b5e2ab3cc4a1df916afc3e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "23a94d0e-a738-44e8-a1fd-da90f5a0e792", "comment": "Malware payload (Mirai)", "value": "27f3c66027063c29483f1757718ac2ff205620912fa0e4d711f07800db1dc346", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "223b7e12-0512-4525-96c2-dbe662e77ee7", "comment": "Malware payload (Mirai)", "value": "9cb846fc3927afcab9c10670876442782edd75f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "611b5698-9fc7-4340-b298-c965b4a2b643", "comment": "Malware payload (Mirai)", "value": "01d25bc8cff402ba72907c5866c6f3fee8e645284fcbea07039ea7b0fa889026adc05e91cdeac30e75a44d98d5eea7c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876338, "uuid": "b25d8b9e-7629-4e15-90c5-f40b85e37614", "value": "T189154B06AF406FEBC8AECD71496EC31711DDE8C746C1A62971FC4B8CBA9931A4ED3548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876338, "uuid": "1fcdfa18-a3af-417c-a88c-101bd3ebceaa", "value": "24576:WWSwXZuo/SWpcSab7jtThSewCq4/cgqn+Deqh+:WPcsWEjjVkow+De", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876338, "uuid": "0760c625-d9be-426c-8c2d-a52dc55c9e65", "value": 949216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876338, "uuid": "7858965d-0141-4dd6-8835-84025d46ae0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876338, "uuid": "43485d16-3e07-4d4a-a1a5-e6fb2667186f", "value": "bot_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474de87e-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781882804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882804, "uuid": "852148ea-686b-4378-8a3c-7dcd314af555", "comment": "Malware payload", "value": "85ca21a73eeb2b8d3ceed352f99aa78d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882804, "uuid": "b4ee73a7-4490-4b89-b271-a3af4f3bb499", "comment": "Malware payload", "value": "2852e5d57719fe19b042b0bec295fb4c81b19f803fbc48cbe483d7aea9dc980d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882804, "uuid": "69b20c8a-4090-45c0-b8ee-2d4fcf50923a", "comment": "Malware payload", "value": "c340a4b99a66a7aeab448dde471c73154aab001b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882804, "uuid": "50e5a5ae-89b7-429b-aa4b-57c1ad29bc18", "comment": "Malware payload", "value": "449f8c2485e21ea567a4a6c1fe65ed68e46d7b437af02c7d57decff8dd4b1cd890719eca844c440f9b4f473664a12cb2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882804, "uuid": "96fc8d24-0791-4f34-b7a7-5147bd02a0f2", "value": "T110F49E2BB2B2B2BDD017C03047DBCA715132F0752A322D7B26C4DA343E96DE5176AB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882804, "uuid": "fa191818-98e2-4286-871b-a97693c59ad3", "value": "12288:MfLfwT7CdFH/fNgCQBRpoVxXVGieay2BnDHXPTD6H4t3/sh:88TKNgF3uHXVGmnD6Yt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882804, "uuid": "c5258170-7c7a-481c-961d-1e2c88dc1585", "value": 785696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882804, "uuid": "1480bcbc-ce9d-4d15-9190-437a5101d979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882804, "uuid": "54247046-00ab-431f-b7d0-7f540287ab8c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fbb9d0-6ba8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781850720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850720, "uuid": "c45a9ed8-586b-4d4e-8531-f8cb8960a6ac", "comment": "Malware payload", "value": "e8046912641e239eb89e8c54ffb19b84", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850720, "uuid": "e9122e3e-ae40-4f02-9d68-39733f558c57", "comment": "Malware payload", "value": "290887c66356b0d17dbd3752b1ec1ffb8f7585d4f09f8531b5a59abbf294e84f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850720, "uuid": "60835fec-01e9-4fcc-9c88-ab2263575871", "comment": "Malware payload", "value": "fb4db3e464dff0dcaf719fe40fcededa4ab9cb5e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850720, "uuid": "ac09699d-9fb5-4243-a07c-761b114931ac", "comment": "Malware payload", "value": "9725cd8999f7b1bfe2bb6bb11171fd56159d13772267485a56123c36240e09955be8ab3bc0c761201ec61fe743d1c65e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850720, "uuid": "af4399c6-61ad-4016-b8ff-8754c6292f59", "value": "T1C03152EE10102E365713CAEE7BA23949F00C91E7399BC7E4C9580EE882985ED7355BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850720, "uuid": "91f8c705-8a01-4b46-b5a3-f5b1459d6de2", "value": "12:UZ56ZrXNh6nEajDNo6NID5Pdr6PCwM6scaBfUF6fUouzaG/6txT6J557NIr6gSw+:c0zMEajQD4ChlCaBy5YlvfgCjruFRNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850720, "uuid": "db0663c4-a05b-4593-89f3-54f6c2d2d37b", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850720, "uuid": "6fe414ee-5643-4b32-8c99-a68503c94964", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850720, "uuid": "5749e5f2-4d89-46f0-a7ec-3efa7aebf164", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385a1f0d-6be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781876336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876336, "uuid": "2d81ee9e-7b10-479b-a16e-6de44b166daf", "comment": "Malware payload (Mirai)", "value": "1c9acea2e9920f7ff8f5e2104a14477e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876336, "uuid": "38c0f15d-886b-441b-a44c-aa3d488425ca", "comment": "Malware payload (Mirai)", "value": "291070aea062e82d230e4d27232cb4a7f8e89ea2f72331fc85d632ad33b57e2e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876336, "uuid": "ab3e8725-e804-4643-9312-b4869bae830c", "comment": "Malware payload (Mirai)", "value": "01261938a4da0a705e864d276f59e787944b17ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876336, "uuid": "40748590-413e-4cf3-8c7b-118b6a250588", "comment": "Malware payload (Mirai)", "value": "88b7bc33a797ef949bbcbd36003e716d67512b9fe9787bc0ab8e2c893f836ae10fa0262f003dcc7ef4ac19911c70fc6a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876336, "uuid": "1e1ebc6b-6b94-4a5c-8b5b-4eac473e3ef6", "value": "T159158D57FE5E3C53D2DAE33E9B8AC3B0622B7190D31341677682032CD5C6A9C8FA1A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876336, "uuid": "af11422a-cf82-4bef-ba28-acacd70ab455", "value": "12288:HO/6bsQ4fHBnjkwfSRzATdTgqUoD1T1uP6JJTHS9P6b3RalUZ5as+3ZKuJZ650KX:HO/6bSpDrdTgqUP6L0yaA8F40KNpdyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876336, "uuid": "3b71f231-927b-49e5-ae92-4005ffc9f2d1", "value": 943328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876336, "uuid": "1190a6f1-bb8b-4cea-82fc-ef7f2a0fc223", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876336, "uuid": "22a349a4-14d3-499f-a6ba-0db11d119234", "value": "bot_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ccb0a7-6c23-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781903472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903472, "uuid": "79c0e926-6406-4fa6-8a1e-c7c59e1256a6", "comment": "Malware payload (Mirai)", "value": "352ee1846fa49561312dcc0ab4313ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903472, "uuid": "d7b8df88-524e-4994-a56a-67571737fc63", "comment": "Malware payload (Mirai)", "value": "291dc3475aa7564ec9de09fd1c1bfe44023b07dc55f8bc1888f82ae3d9ed4ec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903472, "uuid": "5d74b2ef-cb1a-430e-bfd5-2e5e922dab68", "comment": "Malware payload (Mirai)", "value": "0bf20b04d6401ca18aa93810f36179a63a47bf97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903472, "uuid": "edf4a649-81ce-4f13-9059-a65f56a5cbc0", "comment": "Malware payload (Mirai)", "value": "2d36cac75ed502c2363f32f1648d83a030040d260df109f51f5e9ff77cba1a31ecdca039477eb4ba9db67af2bdd63493", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903472, "uuid": "8314c235-f97b-4a38-8fa6-9b7ae47497b4", "value": "T1D624231152ABFC31A2014EF7E8014342F74EEE38618544B715B1E82A59AF4BFAEED353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903472, "uuid": "511d114c-721a-4121-a486-322a23042150", "value": "3072:2bbf6UVnS4fcR5NivEc8JmkbIV1AwOhnlkuNmLUdOd8auwGg6N1rceW3FBYq:2ff/NcMvz2vhhnKUdObObXgeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781903472, "uuid": "ea4cf4c6-2375-4eba-b64f-1623f3cf02e1", "value": 226552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781903472, "uuid": "5f40b4a3-201a-4a8c-a41f-2451732ccf12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903472, "uuid": "bbdef789-b583-44d5-ab70-dd4ad26d3b59", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73b2f22-6bb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781857705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857705, "uuid": "689f6e59-a7fa-480f-bfb1-e8bed0f8f097", "comment": "Malware payload (Mirai)", "value": "92dce7b61a1787beef7d88e1e363f125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857705, "uuid": "d5934858-fe70-4248-bc42-bdcd66cc4d8a", "comment": "Malware payload (Mirai)", "value": "293fac5f438e15e38b8211567cca7a32f5f7908a47b0120a7c51b7612479bd98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857705, "uuid": "93065534-6665-4275-8bdb-8b2552ed4ab1", "comment": "Malware payload (Mirai)", "value": "0d09a43cf337add2b33097d65d4de5a5e4306152", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857705, "uuid": "884c8e3a-3ece-485a-8a48-22b3f097f8fe", "comment": "Malware payload (Mirai)", "value": "b325a88a70af655814b88e7fce00c8c1cb329135fecfc522aec4f4d8e4c4ff19d1afbbcf91bbfbccd3538d232013b2da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781857705, "uuid": "0553936a-cf41-4b40-9041-e227534e7577", "value": "T111C35C2275351E2BC0C9A47A12F74731F6F19BD929A5460EBE721D8E7F226C03A07B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781857705, "uuid": "9281e059-4140-4655-a576-9cd5ef455698", "value": "3072:YhpkrqCMN30JPxil8GEtrmkI8Yp/Jhbw0W1Qe:apkrqzNmGEtrmv8E/Jhbw0W1Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781857705, "uuid": "63e099d5-9981-4279-a695-b8ad8085cb9a", "value": 124095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781857705, "uuid": "6abff254-d8da-46ae-a9a3-c3ce625f0f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781857705, "uuid": "10009d50-c473-4ba8-967a-4ca14b1e6952", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163e9190-6bb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781853945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853945, "uuid": "205a6832-0a2d-4cec-9e90-869ed7c6ddef", "comment": "Malware payload (Mirai)", "value": "4247bd282365d8c82d0dc0b979c85b54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853945, "uuid": "425284a8-ac9e-42bc-82df-b3c8a1e654ce", "comment": "Malware payload (Mirai)", "value": "29437845b00a41c26f1e6750df33d9937cfd67e63e28a63502867e577856f5a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853945, "uuid": "fec9b87c-69ac-459f-9946-4bc858f7586a", "comment": "Malware payload (Mirai)", "value": "9dc0be619675b129524828d15cad9060958e650e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853945, "uuid": "0482c975-2971-40c1-b034-08f0e4c7c7ed", "comment": "Malware payload (Mirai)", "value": "6606722ee33544457bf1b1d6039340625b8ff7de66a2f32523921c3b4dcae4c777d1e460392fbe382774c15c003594f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853945, "uuid": "1defc859-e5e1-4fba-8296-29e5994dbe19", "value": "T17C84D723C8154995D1614CF32267338AAD0787BF8AE732D3DE2A59B0BF6051F52BADC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853945, "uuid": "c6552c95-da2a-4520-bf19-d7909b672f2d", "value": "6144:5ccaq7jZGMRp5QuNwjo8nfcRM/9FGmvDwlG750Nu:Wcaq7jZGMiOwjrkW/nGmvDkG750Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853945, "uuid": "310120cc-5394-40b3-9e5a-9d1c968b107f", "value": 405859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853945, "uuid": "90c9d98f-b03d-4eee-bf86-b8788aced3b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853945, "uuid": "8f3dbbb0-d03f-4540-8cc1-67899e6ce2df", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1ff395-6b8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781839354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839354, "uuid": "da049f7d-f862-4752-b7c0-84808d85e1d3", "comment": "Malware payload (Mirai)", "value": "9f04a9d58f865ba5e360aa8dece9b67b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839354, "uuid": "dd804edf-b1f3-457d-a9da-423c8b221d9f", "comment": "Malware payload (Mirai)", "value": "295ea7ed46cd9a15ecb19fa95b80885e203c450ba4eac4a6843a281b35997653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839354, "uuid": "c8d11439-efe4-44f4-93ca-1f4114b84aea", "comment": "Malware payload (Mirai)", "value": "11cf9cde1584484ac52417264f129e9d3ef49349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839354, "uuid": "974aa13c-99be-4178-b780-fb8ac5ac61c1", "comment": "Malware payload (Mirai)", "value": "561fa8f417b3cc21dc3478abff391d744d5b779bab58dcd78030906f874ee1a06e4c7246c6125d8ed4f9d4ecddb3ddc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839354, "uuid": "cbad0f90-6697-45b7-bfd5-2e987fda3e0d", "value": "T1CC242A46B8819F15D6D016BEFE1D118D332717B8E1DE7212DD206F647B8A86F0E3BA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839354, "uuid": "942d4f6a-127e-475b-8a4d-713ef38b940a", "value": "3072:Zl52mEDfC4Wm1jC6/pA8+saqhJywU2CyrrXu+WqGPaG1gokkvNyHYDNplyyrF:ZOHCYJCDqbp1rXLWRPapwvN9DNpl3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781839354, "uuid": "022ef65f-d214-4446-b710-861e833e93a6", "value": 225308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781839354, "uuid": "96873625-fe55-4a84-b1ec-97962e5667f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839354, "uuid": "cf8b2ff0-0568-4994-9d25-3a27a3d1e15a", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce36ced-6be5-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781876988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876988, "uuid": "68f70b75-a22f-4f34-9b02-8547e2fe7b16", "comment": "Malware payload (ConnectWise)", "value": "e250d243c62ca9db7a2518c63fd5edfa", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876988, "uuid": "3f8fee97-ac0e-4208-8524-0b76aafc9592", "comment": "Malware payload (ConnectWise)", "value": "29811ab858e516b34e82820c8754b1eb513d652290c0fd1d8ee8a43564fe3361", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876988, "uuid": "a79a3c71-4cb1-45d0-aa85-8c5896db357d", "comment": "Malware payload (ConnectWise)", "value": "f4dd28f3a6bd68a5e4e71fff2a8e630811663263", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876988, "uuid": "4a6dabfa-3ac4-4ab7-9fe5-5d98d4aaed54", "comment": "Malware payload (ConnectWise)", "value": "37f85b547a3f6bd3ae616e04a0dedc9e3aae3eec3fd5027ddd01845bb20300d46567d81ccc66f54e334cd13afe7fb66a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876988, "uuid": "c971bc81-76b5-4d13-8bb7-3e10ef8e4514", "value": "T128646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876988, "uuid": "6ba65de2-4671-4160-8e5c-a926b756f6e7", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876988, "uuid": "872c017a-aee4-48c9-83f3-70a7e538295e", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:J1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876988, "uuid": "860f4a42-1106-47dc-a21a-b7c1bb6a927d", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876988, "uuid": "86832418-717e-4b0d-885a-2e641a82062c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876988, "uuid": "d772131c-2f09-484e-a356-5f6ad86c73d4", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f6b115-6c1a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781899552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781899552, "uuid": "409f0bd4-ca21-476f-909d-52da7b95dd2f", "comment": "Malware payload", "value": "9cc0ca4df139c483ad8e16743592348e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781899552, "uuid": "e34fbe7a-e450-4298-a701-4857e5322c85", "comment": "Malware payload", "value": "29ac58957618bbc48df84d64dd46eb1d17ffa864d8506e461a5c069dcd075e77", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781899552, "uuid": "5dfbea3e-5557-4bd7-8b81-b52af7bac5fc", "comment": "Malware payload", "value": "abdf37b078cef089af1faec2092db4d645ee92e0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781899552, "uuid": "b15182ac-f213-4bea-a3fe-89fe8f992ab6", "comment": "Malware payload", "value": "73a0694bf09a7b69a497f9871972b67676d133084cb6bff49644922559b3242bd9c4436366501438107a31850dfa8cdc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781899552, "uuid": "8a25cd4d-9fce-48ad-ab59-cb62478f8bc1", "value": "T14FF57D07ECD549E9C56AA23189B29581BB35BC081F3A27E72F60B3756FB2BD09D34314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781899552, "uuid": "abed9bea-427d-4aae-819d-da9e6835b0b1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781899552, "uuid": "2e4cb823-84be-4460-a0e7-c0b93e2def26", "value": "49152:RCmYt1eCuu/WozOsh1jYpulD+QD3J+Ffr82C:RmSOHkpu1+AM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781899552, "uuid": "08a1d812-84b4-44ef-93e2-5637093e8e0b", "value": 3335512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781899552, "uuid": "489e5963-fcab-4764-8b56-f9d79f7db075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781899552, "uuid": "a3e321d1-5456-4ae3-96ed-e33ed5fa21f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29710af-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913049, "uuid": "c768aa60-9b6d-4076-aee8-3a0b985cbaaa", "comment": "Malware payload (Mirai)", "value": "6eb00be9d68b067d0e75a5ca6c9f43e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913049, "uuid": "7c38917f-633c-4202-9454-0caf1acec889", "comment": "Malware payload (Mirai)", "value": "29b8b83c9e590e371ab4e20b6d274ca42090971783fc6bfc0e2dd1f53f47aaf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913049, "uuid": "349d965f-0cff-437d-a586-61fbe57140fa", "comment": "Malware payload (Mirai)", "value": "f8e5f411f4b23dd2fa89d040ed4fd5ec0ef6deb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913049, "uuid": "e45ef432-3ba3-46ce-b3e0-9f1dd2d662b6", "comment": "Malware payload (Mirai)", "value": "404bf23c14108a489cff008fecb373b90bc4523c27b1c48c0656b2808595498396ddcae33e168b92cb520ca9452de55a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913049, "uuid": "00bf2af4-d943-4fa0-ad3e-e6270c7f5ad2", "value": "T179C30A52BE419B13C5C321F6FBAE42583B136B79D7EA3102ED247F51278B8DA0E27611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913049, "uuid": "826d3a6c-5565-4e78-aa12-c10b45face1f", "value": "3072:mQs5PYp0M8hVW0rhwnrl6K6p2vTzmJgS:YYRwVHhwnr8KK2v+JgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913049, "uuid": "a2fc8382-bc95-4a3e-bbbc-269c55af5f71", "value": 120872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913049, "uuid": "13565e95-bfca-4aec-a2df-45acfa84df49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913049, "uuid": "e8e37dd9-1c16-4e8f-ad35-3528b0410325", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c397708-6beb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781879322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879322, "uuid": "95eff75f-4ef3-4e70-a0fa-22af240066ea", "comment": "Malware payload", "value": "12b6c59c08aec1c4240b0b1ee37f9078", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879322, "uuid": "5e9428a8-b2bd-42ae-b4a4-c8f0fbba7210", "comment": "Malware payload", "value": "2e79d9e29de2e654d1eeeb640250f618beb5573c9889067ae173138e5ee00d3f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879322, "uuid": "87312e12-f2f4-48df-9c11-3648e29d4f2c", "comment": "Malware payload", "value": "516c15aad4695bdeef4fba3d69c939a95c3df5ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879322, "uuid": "522edf89-2eea-4d75-85c6-d30e4484183a", "comment": "Malware payload", "value": "8ba06b04dedc13fd4ad2914f7cc84a48b41b40bebaa9bf44d79351172fa1d1d181d7537c5c83255faed9308f55d7710d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879322, "uuid": "09ddc50f-ab26-4f3f-985e-236fc0703ae0", "value": "T152F5E12B6D8119942725477B3BAFF00A4BBF0CA60FC5AC519BCB5D0A69F170F0A751B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879322, "uuid": "c07f0abd-3eca-4897-98ed-c3e8a18ffd4f", "value": "24576:FnNGujTPZbv8ngjsjd3t+MaWPdq0ll/aQDuSU6tCOh62kveNKwAluaeOUotcCPUI:hl10laWjdDIVtaGtcCpwQ1+OUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879322, "uuid": "18d98939-208f-4b57-a377-8c9910cec4bc", "value": 3445530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879322, "uuid": "0ffe73f4-d4cd-4f1e-a4b3-3b1352db5e76", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879322, "uuid": "0fc807f7-4dc1-4b23-a0bd-37c7b62da082", "value": "hold.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9416a9c-6b9c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkVNC)", "timestamp": 1781845656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781845656, "uuid": "7764b302-6bc6-493f-ad86-eff8e46a4666", "comment": "Malware payload (DarkVNC)", "value": "20e5488a5d349258460f88805c30a197", "object_relation": "md5", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781845656, "uuid": "d68f1c8d-c488-40fb-9e74-6b949dc5c029", "comment": "Malware payload (DarkVNC)", "value": "2fcf553b9656523b3207c08cdf16f7be9a25e55cf8c29f5caf933151c9214367", "object_relation": "sha256", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781845656, "uuid": "89805751-8bae-47f9-87f0-c8f71678b54e", "comment": "Malware payload (DarkVNC)", "value": "1cb90f0b5a4f19cb8b0adfb33a9e4813c74c4e54", "object_relation": "sha1", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781845656, "uuid": "2f15196c-1e50-47af-9a8d-8e2e95e9b362", "comment": "Malware payload (DarkVNC)", "value": "0f4ce65c8eb109d77dda67a215af7b5159cea2d89cfc85dac5602175c888aa73c6692e3fa63cc8a33ca27a92748dac4b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781845656, "uuid": "bfa5e5a6-b206-4df8-bd98-43cda570aeb7", "value": "T131147C15B61401AEEA33C075CE974726EA73380817301AEFA468FAB56F367D1B73A345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781845656, "uuid": "16056f4f-7d6e-4dd7-af4d-c3bdfa67d4ae", "value": "9c1fcc83d521f2064313e6ea92574ccb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781845656, "uuid": "1d3020d2-6012-493e-a89c-075bba2b3b33", "value": "3072:fLeqaMRJJDCgRKK350jI8yiAcKjuKqOI1s0BRlE:fLeSJJegRK850jI8KjuKDIpBRlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781845656, "uuid": "624b67eb-feec-4a31-b6ed-0705a8d4a195", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781845656, "uuid": "18f2305f-559b-47a3-98aa-ea7ff3b45eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781845656, "uuid": "1124e883-22f2-44a2-aefc-808597ee0cd0", "value": "2fcf553b9656523b3207c08cdf16f7be9a25e55cf8c29f5caf933151c9214367.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ebb35a-6bca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781865271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781865271, "uuid": "1938cade-aa9b-4dab-bdcc-b09acf9a58d2", "comment": "Malware payload", "value": "60179ae44ccfe8b72e6a9c913e8eebea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781865271, "uuid": "b95f95ba-87ae-40ca-8423-5b7b1191787c", "comment": "Malware payload", "value": "3004e4f5304d10bb378d53fcedb28921f19dd5869c23fce6227703a0faa90a57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781865271, "uuid": "7a1145e2-5afc-43f1-9a78-38f24def9a66", "comment": "Malware payload", "value": "c0d89106732eec602665c3d054443222b9d19e00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781865271, "uuid": "b0ce5db0-97a8-4513-877b-095d82222728", "comment": "Malware payload", "value": "a29654472d6d19da2c4f1eacb1d7c74a734090bc9e980997a7fd7d804696dd6116a5136e2c3cd66e4ca57b5c6b59a0c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781865271, "uuid": "9c815331-2402-4673-ba56-ac52029fc2f3", "value": "T16CF73318402285A1DBEB74F166B7EB25BC349E7A6EF1007EF98EB8C53176594002C7BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781865271, "uuid": "4b2052d1-fa10-4c22-9a14-c9d923b2abf3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781865271, "uuid": "cc9367c1-fc1c-47cc-bfd2-ceef7b58b3df", "value": "1572864:Yt9IKPNfbvbRWYKrrtU1GfPiw0P9myNR24Vkb/3UwW22QOn+j2VqPR7:YUKJbzRWFr5U1Gfm99R24VkbvXWkoYPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781865271, "uuid": "9612dc01-30b2-4a89-be18-eb1d919d429d", "value": 77001422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781865271, "uuid": "f6c9ee88-b7bb-40c6-81fc-4dfb2b10d735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781865271, "uuid": "bd614cb3-61ab-4946-817b-0c36a3f7416b", "value": "ABOY_Win1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e37c32-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "51982f9a-d6e6-4ff1-ae06-033784fc1029", "comment": "Malware payload (Mirai)", "value": "f025fdfba7533f76a1c4c568aa5d98bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "a834b0ac-fd84-4c99-adec-813135c9c016", "comment": "Malware payload (Mirai)", "value": "308ed319d6a97c99c60403e1e877dc246ee912a221864d8495f8f0cc6e95e1ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "613e2372-5ecd-4aa0-8ba1-1d000c972532", "comment": "Malware payload (Mirai)", "value": "8c6acd89eb94c2cc02dd18d2300b5293d3cb5974", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "0297e30a-cfbb-4a93-8740-49f211f2641d", "comment": "Malware payload (Mirai)", "value": "b249a89e35adb27cfa179a119d966de65105299dfcc53c58cc62fb41cd15a8403f627ac42aad634a35ea98a656b70803", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "70092c41-d812-48de-822d-cb090601adea", "value": "T130A35D97F401EE7DF80BD5BA04670A0AF630E3E51B930B366397BD67ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "7dd6466a-80d2-43ec-b928-a6a6d7b4f408", "value": "1536:iPhR5NhZp+huOzP6DxHd8P9foRRfZAuDbAV3GNPt8Qkka:ip3PSVWxHcqRhzhNPt8Qkka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882800, "uuid": "f6d2ab07-046a-4a5c-9584-4590b19625af", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882800, "uuid": "72bfe532-4caa-4999-afef-1c6d7e302eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "b2090613-ccd7-4428-b8b0-4400b8058b85", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661b70e6-6c21-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781902612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902612, "uuid": "a63f6589-2b58-4a1b-aeed-9a234343a31f", "comment": "Malware payload (Mirai)", "value": "096aaa4fa791f8c51f03520e1c59cc72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902612, "uuid": "835fdc44-e380-4cfc-ae68-751838f0baea", "comment": "Malware payload (Mirai)", "value": "3170b114956dcf57d281d9ad57b5e74c1d37c679eeda31b5ad610fc873aa73fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902612, "uuid": "51bd19a2-c2fd-4f56-b40d-59103ae94ac8", "comment": "Malware payload (Mirai)", "value": "ec876f4a222557aa620f536094996a520ee08216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902612, "uuid": "79356330-c613-4ecb-a4b6-ebcb6f955b0d", "comment": "Malware payload (Mirai)", "value": "70d95194c028232626c2811251a412105d468eed3d0d87915f4cb92bc4b5d6999e6a31433039f8a2a20e950fb97f9300", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902612, "uuid": "95fb9b24-09b9-41af-8792-080815318e4d", "value": "T14F8313B27A1FBA7174B809EF86F6C1C5BD2E4E78C1A931E207A64305394190693FD5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902612, "uuid": "18ace7d5-4f90-4556-b043-3697350ff90d", "value": "1536:2fpklkDUXeMuzmlLfljB24vp0UnUxLRp/qinm7EF2zFtDSosKiC1FzocLV:2RjYXMzmlLflg4PnGt5VnzF2ZtDS4iAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781902612, "uuid": "3f600735-cc90-4d79-86df-e4f94c7da6ce", "value": 85568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781902612, "uuid": "3d4b6ee7-d73a-4f6d-9ee2-d88a584c7023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902612, "uuid": "943bc9d5-0d04-4a50-b2e3-dd5731f4d5b2", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b3a0f4-6c09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781892458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892458, "uuid": "0d4d3b71-3394-4d6c-95db-b3265fb582e6", "comment": "Malware payload", "value": "2b5833628a2ab0188ec2bbc08ae34c89", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892458, "uuid": "381b8802-7558-4fdc-91d4-a3549d41c266", "comment": "Malware payload", "value": "3182eb161ea364d30f6e8ea27fbc8b2a3de9be6b4448df34f04ca0183f28eabb", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892458, "uuid": "3f8f7332-8e3c-4595-9102-53d6385b0a64", "comment": "Malware payload", "value": "89e1577855a7528d45cc5afcec97bfafc753cc51", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892458, "uuid": "0972b41a-ce0b-4601-ad8c-0c742437be00", "comment": "Malware payload", "value": "d8fc9cb4ea01d636d9bce61548d356ca1cbf4eee750531bc2ab830302a2a42af7c669d1ca4c209127f0802a4bdbeeb7b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781892458, "uuid": "3c2e5899-a185-41cb-9816-9ea17106e412", "value": "T13DE57C03FC9609EAC169A37689B69592BB35FC8A1B2213D32F50B3782F727D46C35714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781892458, "uuid": "b5028a7b-4e22-4965-8600-46253cbf4b29", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781892458, "uuid": "661cd919-a23f-49a6-9a5a-0c3d11dcd2d3", "value": "49152:zN3udKr0wLGEosK4jp2pr+QHBpsSxPgyFlm84:zgT4irBpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781892458, "uuid": "ab58b56b-016f-4c90-8110-19ae5e361d56", "value": 3307880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781892458, "uuid": "df66a12d-cb25-4685-acac-179a10f25472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781892458, "uuid": "25175c86-20e7-46be-a5b8-2d0af68dca90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5794b577-6bbe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781860068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860068, "uuid": "36749843-383a-4b16-add1-eef2765df3eb", "comment": "Malware payload (Mirai)", "value": "703d587c00b03baf045a46418b2f341c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860068, "uuid": "5aa24ba1-a6cb-4af9-9f0b-2832e80c74e0", "comment": "Malware payload (Mirai)", "value": "3268eb4ac742030e00512124e1f5ba6c69a19650249b7384dc9454c4f55ca141", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860068, "uuid": "47ed8928-81c3-4676-81f2-a9a96aa89512", "comment": "Malware payload (Mirai)", "value": "2b18af55a3fdc2e319c5f97bbcbdd2dea0f12337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860068, "uuid": "6b96b021-c580-43cc-aca1-37760ff84e4f", "comment": "Malware payload (Mirai)", "value": "d89d4964f4315764b1dd7811f657659cf05199a02ee763688c90201f71cc6fe43b08bf2e37018a474ee96acbae7fda8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860068, "uuid": "0f68e4c5-9ac6-49b5-b990-ae7dda856f7f", "value": "T13A84853799159A69E0248CB213B73B519D4746FB88E223D3EA2D9964BF3041F51BEFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860068, "uuid": "4bf9f0b2-5e36-421f-b5e5-04acfdedbdc0", "value": "6144:B7cwX/3xg/4HwjoGyQLUmr0h+afjUHJMNb:BaQHwjthLUmr0h+afjUHJMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781860068, "uuid": "edc7f844-fd49-48f6-b665-c49f6bb94c35", "value": 386929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781860068, "uuid": "2f1f9b34-ace8-4ae8-9957-1e0e475fbbb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860068, "uuid": "eec91ca0-42f4-4e81-b7c1-a9f1cf2f47cc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc69caa-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781880989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880989, "uuid": "7d2b5b0f-2bb8-49f8-a808-cc5ac406dc5c", "comment": "Malware payload (Mirai)", "value": "fa0732fba85a2fe55048dc82bb92decb", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880989, "uuid": "595c808a-a152-4962-927b-5e5fb0288519", "comment": "Malware payload (Mirai)", "value": "331e472f4295c9c2f3d1bea540e82d39a3407c2d93527cde7d4d9494581c98fa", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880989, "uuid": "2dfc051e-9949-43bd-b785-ef07824f1af7", "comment": "Malware payload (Mirai)", "value": "17f6eacbd7e931ca1b6d903bd0d5f40f27abc1c6", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880989, "uuid": "c1030fc7-861c-4610-9bc5-aa4babd68ad1", "comment": "Malware payload (Mirai)", "value": "ba99bde8b2701e2a9a0b190137e9e4a21225b4e85bcb95053bda3e45eb4129a7f851ca1ecc88f514c5937307eec42cd6", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880989, "uuid": "d8ff6bc7-1a51-40d0-934d-8b0ea555d85e", "value": "T144831268E26DC97DE07CEF3C2AA94FDA22008D0A851B3C4F7574AC9473FD816979614D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880989, "uuid": "616abfe2-ab3c-4406-ab70-ac1e324d41c2", "value": "1536:UXqOwcCPPOJEGr0txPmHWC4mqJBQGsFYyVoTQN2vcp4YT4pxO12S8TVJ:UXlFEGKx+HwmqJBQGsCyVopUp/4G1FcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880989, "uuid": "8f3a25a2-62cb-47ee-9d3a-3dfc431df07d", "value": 85548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880989, "uuid": "03bbce7a-8a2c-4196-87b2-712a42d745b8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880989, "uuid": "ae55ebe9-fefc-43a3-a4b2-3bd3c099495a", "value": "monero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e05fdd-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883627, "uuid": "fa089fb1-b4d1-41df-984c-2f3e2b3bf384", "comment": "Malware payload (Mirai)", "value": "bf87fa112540d72fe20b08c004c7c70d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883627, "uuid": "3bd0943f-fa6e-4ba5-adc8-50313f094627", "comment": "Malware payload (Mirai)", "value": "33c17d8894c2312e9be34fe364f9825abbb619cfc58575b6c9852f5f759cefa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883627, "uuid": "2a8dab58-2b01-43f0-9e37-c41abfedfeec", "comment": "Malware payload (Mirai)", "value": "163a2f988cd385e1273717162ee4aa073d47538b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883627, "uuid": "73b25d7c-ef58-4f5e-af4d-0ea2067dcdc7", "comment": "Malware payload (Mirai)", "value": "d682500c489ea52db24464d50f582cea4e1f7ccfce2cafdc587208aa9c43d876ccc33337b9bebcb09802c762f7faaa5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883627, "uuid": "a5f1a3b5-b212-4c75-8a27-571c592b322b", "value": "T13DF31A07B952CA53C1C31779BA9F955933236BB4D3973302E9187FBC2F8369A0E2A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883627, "uuid": "369473c9-67bf-44de-beef-ee33881fc747", "value": "3072:qa0rlY9jbgKAdaF40i2JMFUyQK2CQlZ62qSkyHGYm0WQcmB++t:qa0rlY9jDAdaF4P2JlKrw62qxYm0WQc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883627, "uuid": "c323a315-d43e-4bc7-b4bc-6c26377457e1", "value": 163124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883627, "uuid": "9a34a99f-2917-4239-820f-b2ad77ecd773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883627, "uuid": "c9ed01d3-5b5a-43e1-b5ac-8a12cc8063ba", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b7a8ba-6ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781851290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851290, "uuid": "4e0fb315-adb5-4791-863f-2f56eb502904", "comment": "Malware payload (njrat)", "value": "262f126535860e88536905a7990b6d1b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851290, "uuid": "8b0a4e57-dadd-400b-ae1e-adfd7a75f940", "comment": "Malware payload (njrat)", "value": "34dde45caa3d04b39c4ac7ce87ee2387049f36280a3d926c0fdaeee70020f4b5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851290, "uuid": "67f2ef6c-87fb-46e0-bcbb-158fd8d0e419", "comment": "Malware payload (njrat)", "value": "80889e21b8b7e945fdc7e2c0e17dcd3a20aaeb0d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851290, "uuid": "c78c94d9-7eb9-4e60-b297-991d51f1c4be", "comment": "Malware payload (njrat)", "value": "964dc5c9401361f51322dd57a46b165772ab85b9068b89030f9abf92514649c965214eecd918ea33721d56f3cb0867db", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851290, "uuid": "e4cceeac-2ff9-4b89-b5e6-3cc86f75ee43", "value": "T100A56AF663CA7868467036F5AC4DC8A8F3B1E8158FEFA9B9AC52BCC300915457631C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851290, "uuid": "5badd784-4ed1-4d2a-be76-8fa6e48741b1", "value": "3072:JG+lXjXfgA+lNls9JySGtj6IKj7DVVcImZJlEo+RclYhyGf:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781851290, "uuid": "2bd474f7-7c5d-4c7f-a506-18963d4e6173", "value": 2190220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781851290, "uuid": "9760d634-0295-48ea-9daa-78f35ed0abfc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851290, "uuid": "d2722e7b-b41d-4f45-abd2-6573c186489d", "value": "PO023012026ATA.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f22e5e7-6bd9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781871704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871704, "uuid": "1bae2e76-759c-4231-8b30-dd351d868e35", "comment": "Malware payload (LummaStealer)", "value": "f6ac08c3f60ebb43b089fbd05c582ece", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871704, "uuid": "190629cd-5c8e-4188-b89f-01d49fc7b182", "comment": "Malware payload (LummaStealer)", "value": "34edcaeb64151e66cd556efb4c6a9b636410ddcb92b5d64664ad0d6b11f6bbf5", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871704, "uuid": "d6775f7e-880e-4300-805b-a9c1a23871d4", "comment": "Malware payload (LummaStealer)", "value": "d839179932397d55d6b5acb4eedee473d2770179", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871704, "uuid": "d79e018e-c3d8-40c5-b90c-76644a260bee", "comment": "Malware payload (LummaStealer)", "value": "898c7bfd6f76844dbff055950ef8ff6988ca89c14e64a83ad31fbbcf2da6bc5d918c8bbb50e2ed36d06ebf727fbc5e1d", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871704, "uuid": "b71fe6b8-20ed-4d79-bdc1-f10f2a4f83f2", "value": "T1B62733686110ED06FA331934B6A1198CC5EB8D6FE4CEDCE7AF2337B190272E55B5E085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871704, "uuid": "8aeafc11-b16e-45fb-b82a-43cd5a2f8d3f", "value": "393216:xWo4umadIAWU6YlY4rzUSZNT9iDUmtMk3ERL1N/w1ILiis2lxi8:IjadIAhlY4ES/EEVP/OIFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781871704, "uuid": "d7ae7ebe-4f4a-4dfc-b693-4c1ff412a086", "value": 20795004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781871704, "uuid": "3cab493e-e5ad-4e98-8d7e-5a81fa75fdde", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871704, "uuid": "90f479dd-863f-4128-a2dc-32ab90c1a35b", "value": "microelectronic circuits 8th edition pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153724cf-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781881002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881002, "uuid": "f43dc7e4-7ecf-4cfa-a723-04831383aeab", "comment": "Malware payload", "value": "f13a5dbf4fce7b8d5dbf4925b0491129", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881002, "uuid": "07a4a7c7-c8aa-47c1-b418-347f84400f6d", "comment": "Malware payload", "value": "356bb44f53395ece9799a89f4e62ddea6d6fde1f7704eef2b0b00b559bbefcc0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881002, "uuid": "66d7feea-9701-4497-8e14-ffa974ea5784", "comment": "Malware payload", "value": "7fed6a0eeadb3b04500bcf650df6eb0651a42b4d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881002, "uuid": "383771a9-3e16-4c07-8bf5-45b8d2d722eb", "comment": "Malware payload", "value": "2f0be16a5edbe2b68b92afd7e52c26fed1fd9041536dd2e37b208a3a2a0d34bf44f2d3809877cce82da5d37a7c679fd0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881002, "uuid": "3ea35b35-8a7f-4761-a5c8-755580df6a15", "value": "T17E51FDD6F9E2283335AA082E7655A04DE68759330A1D7845B09DB430BF781BEF13A729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881002, "uuid": "0c2bbc70-1f70-47cd-b3bf-ec47777aace2", "value": "48:FLRIdlW+5P1MEH8snsf6SIhsRrPO2L8xAgFV5pAFVY8AFVIsoKFVZFVIlxAgFVXl:FLRULvskhsRrPO2LGWUiRe1ijL9iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881002, "uuid": "bb4d4116-1d82-43df-be0b-30fe4781ebcf", "value": 2768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881002, "uuid": "95f7ca09-5158-439d-b8f5-48b860df51d9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881002, "uuid": "dcdc2d1d-0e17-49fa-a429-435e68d6fd21", "value": "dl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9519ceaf-6ba6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849863, "uuid": "b030e3c2-2519-4889-b73d-c7562e0be152", "comment": "Malware payload (Mirai)", "value": "9126b08c32faf6ff800e917609bbfd6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849863, "uuid": "ccce9e2f-5138-4f4e-b242-651378d52410", "comment": "Malware payload (Mirai)", "value": "36cc22c942f7544ed029c96bc181a17251986ce066e99c9ed411051095c96cf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849863, "uuid": "0039d153-9b45-4971-8707-c855b2dbff42", "comment": "Malware payload (Mirai)", "value": "de53e23c13cf86f259074076a0ff318468291892", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849863, "uuid": "ad4506eb-6842-40b5-911e-bbea8bdc2e33", "comment": "Malware payload (Mirai)", "value": "bfa029be941e289bed5d9d9583818db05308d299357a5ee2697cdfc8d3ad7b2527d4d76c1eb81cba0374454e0dab47c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849863, "uuid": "a763ef71-c34d-4f0e-ba44-10d7fe91ed2b", "value": "T1B3A33A46FC815A21D5D512BEFA1E318E331357B8E2DE32229E149F3173866EB0E7B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849863, "uuid": "4c29fed4-140f-4f77-b767-be74aca00f2e", "value": "1536:cAnMdGV/7cr3457VQYTgIQ42Rx3kryzFajYbuXCQDrRinvkhlXcr7mt5BYWvR:k8SLnz2yzFajC/vkhlXUitHLvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849863, "uuid": "943e77ff-a2f4-4ab2-afee-769c1272e6a1", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849863, "uuid": "ff003b97-e6be-4e86-a5ff-87e39c57007a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849863, "uuid": "0df323f8-5c25-405c-a9de-6297309eebcf", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555f00ca-6bbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781860064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860064, "uuid": "1717279b-707f-40f0-a03a-6ca362267ac4", "comment": "Malware payload", "value": "7d11c9e2fd95a079bfd7b4b8b84613ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860064, "uuid": "448b3ab5-b5e3-4e5b-96d7-41e436a4dbc7", "comment": "Malware payload", "value": "37d2790ebd143789c55af0e6d14b53a16e4bc665d1d880973dd440f53a365dff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860064, "uuid": "1261cbcf-7635-4749-9a21-2a1a58547084", "comment": "Malware payload", "value": "a10c2dad6f898fbdeadf1dcf43ad948c9a0bb939", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860064, "uuid": "b89dab02-dee6-4860-a35c-859bfe8378cb", "comment": "Malware payload", "value": "67dde7efb20a74e1bd777cdf7cc694411020441c2eb1a95afc80e99bb2b75d635366ee257d8d10e92f43aed3c94e3b9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860064, "uuid": "f63bdb4e-a71c-4b85-8207-618002923a09", "value": "T17A831959BD81AF05D5D525BAFE4E534D33532BACE3EE7202FA141B6C368A52B0E3B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860064, "uuid": "0caf28cb-23ba-4716-b9bf-6f214e2ef3d2", "value": "1536:Nrn6J+6CW8GLaPxGS0AKW9qyJh4ijeOhMI9lY3iaQbU1Ak0e:EJqQYGS0AKW9qyJh4ijeOYbQbIAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781860064, "uuid": "dbf35b63-27a5-4a68-9415-09ec01546b4f", "value": 87856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781860064, "uuid": "4031d19b-7ad0-4ae6-a131-57b6feca6143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860064, "uuid": "c93f5b30-2fac-4ee0-81a9-9090a876a3aa", "value": "MEdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1678d0-6c1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781901441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901441, "uuid": "4d362a7f-045e-4b51-a488-f5cdfa5dd69b", "comment": "Malware payload (Mirai)", "value": "9875126a635bd20f65b4070e18705532", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901441, "uuid": "d0b42905-96f0-4c9c-981f-fb845199d655", "comment": "Malware payload (Mirai)", "value": "38a168dacb5dd821496c5e964d7710d53193c3f75c4ba9e18e3c09dd20866e9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901441, "uuid": "8d686883-24f2-4907-8367-79ae5511cfd3", "comment": "Malware payload (Mirai)", "value": "069131e23bd7cab97e5209eefaf39c96d08aee73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901441, "uuid": "ecd317ed-69c7-4331-b65d-1d05ab28f978", "comment": "Malware payload (Mirai)", "value": "8086a070d23fcad7ad7b05d23b21c3e17bf4a408c29f5705179a0a52a4eb68024d2ff54d3dd06989e1819126bcfb477d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781901441, "uuid": "f0b732ab-c0f2-436c-9ef4-740f230f8fdc", "value": "T1A363F2C359E1C6D4DA7A123A46F6F18DB974A39E2DC118FE7EC8B6761C807870C041D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781901441, "uuid": "105987e0-28e7-4abe-916d-0afd28f860b6", "value": "1536:32GKb0mpan4pEVR/LcEKg8SwAnV0ajH7mqZGjJRBYXHD0bnouy8ryH:mGd4CVRVjVVNjbmqUjJDY3DooutY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781901441, "uuid": "a49686e1-346c-47cf-b57c-ca5afd8af02a", "value": 68716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781901441, "uuid": "79720454-1941-4b80-b269-29355f96f88f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781901441, "uuid": "6ce4ad8f-9273-4d0d-b2a7-b0d387f55774", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393cf864-6be4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781876338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "f40930d3-d0cf-4370-a770-0103ec4411be", "comment": "Malware payload", "value": "b41cf61b126c956614789752a49a1501", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "ff9ecd1a-f93b-4315-b48f-8a674e06790a", "comment": "Malware payload", "value": "397652af20fa2e38a9092643cca01bc20bdeefe63ae586f81b71e9356a07cc29", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "5157ce5f-b9fd-4b25-a53c-271272cf58cc", "comment": "Malware payload", "value": "9f9c80c59a21630ddfa69a16e41cb5f880575e0e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "9cf91781-f36b-44c5-abc4-fbfb7c0a75a1", "comment": "Malware payload", "value": "e4c8fbbd4b02944d17bdac8495c03090a2496408aa82b9ea231cb4b16e4d4035a863e12e09ae84b9ef685003e007f323", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876338, "uuid": "d6dcb2c8-70b5-4311-a14b-286ab099eaf2", "value": "T18CE02BE6F9A7E0327B6D8415B32D63E1184B149B54603B19E9633C126F6C0047384129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876338, "uuid": "744f5f2a-68ae-4714-9dac-18f16175aa05", "value": "12:83WjBE3g5fW9j22AMYvS3r1zFne3rE4zrOzM4+cR5:fjzWOM9F/QjcR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876338, "uuid": "333af1e3-9ed8-4e27-8581-5d31065532e1", "value": 401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876338, "uuid": "d4f0dc20-8883-4b5b-b405-8349f81fb1ba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876338, "uuid": "975114e8-6d1f-4960-87bd-f0db5f790268", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2450c3e1-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883604, "uuid": "0ed13a60-c115-430b-bbe0-6f64a9b6c0d6", "comment": "Malware payload (Mirai)", "value": "dbdceb0974f689bb294655458f119355", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883604, "uuid": "7f91b997-0f57-4733-b95e-8769aaa5305a", "comment": "Malware payload (Mirai)", "value": "3b9891cc64b34fc70bc736015bac1650f9cc241abeaeefd90abc6cfb44fe85fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883604, "uuid": "34956630-21be-4c76-bba6-93bc6db2d9e8", "comment": "Malware payload (Mirai)", "value": "a4cae79d9fca027d35e2c4528ea44d5917131abf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883604, "uuid": "bc27c743-b686-47f5-8168-626460d75183", "comment": "Malware payload (Mirai)", "value": "766607f605f3d1739222d174287a90878e9eafab2c5ef7c298e1bc747e815bacd642a4cb60efc7b494b2ea624a15808b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883604, "uuid": "d7206e95-1518-45b0-b132-ffb84f48df93", "value": "T1D5C35BC7B801EDBCF80A973644570D15F530A7616B924A3272A2BB6FD8770D9092BF47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883604, "uuid": "7fa682f3-398f-4165-a40c-0995f9b558bf", "value": "3072:xDyqzisfRpsdju+22tIfQ4Qy1q8KgsZo/UMdOOUzDZnoeF:lpI3AKy1/KgsZAUboeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883604, "uuid": "0b6698e6-010a-41df-ae92-c434961e5037", "value": 126364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883604, "uuid": "c22a7ea2-5320-451b-8bb9-b20cff84cb2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883604, "uuid": "b9935853-cc66-41e6-a39e-604a239ab669", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0be957f-6b9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781846447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846447, "uuid": "5b56e537-9680-4ddf-a912-2912ea0c7baf", "comment": "Malware payload (Mirai)", "value": "98cf63b94d124a090468bd96c4993a8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846447, "uuid": "3fbc1233-7e46-4928-807e-b327b488d94a", "comment": "Malware payload (Mirai)", "value": "3baf3262cc5002faab6e68940b0effdd00e9b6ca02136a61c7d4fe888f1393d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846447, "uuid": "84be7ef8-5159-4f57-8708-33d25a04193e", "comment": "Malware payload (Mirai)", "value": "38c6aa8444a922d787e2c1fccf23da258c5a5932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846447, "uuid": "a9c876fc-b4db-4572-9606-ad0007504e82", "comment": "Malware payload (Mirai)", "value": "d6e11cccf3c2ab6a1f45870eff443b51b018c6468f426bffbcd78e7b48621ae616768e49a9c45880aadd8f0307c90088", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781846447, "uuid": "d9fca52a-1399-4ba3-bc35-07003e2a9bc9", "value": "T1E0833A47B980D0FEC89AC134877F7137D923B47E1239729A63C8AE266D49EE01B5D742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781846447, "uuid": "3ffbbafc-d769-4071-b6b8-8385fb8f3e97", "value": "1536:BNHnQNKwuc+MLnUK4fNl+CZTqRoqUJmbavLAybJd:BNHQqc+MLnUK4n+CYRombavLjJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781846447, "uuid": "47e44350-480f-47a4-818a-c003eb3a6efd", "value": 85872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781846447, "uuid": "0baff7e7-e79c-4255-b5df-58784f244bbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781846447, "uuid": "071af527-b161-4fb7-b23a-6736f511c6ca", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a639433-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883614, "uuid": "f43b1a3a-14e4-4cf4-8e57-0a0d0200cfbb", "comment": "Malware payload (Mirai)", "value": "23a73cacb6c794b81934a11788c724ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883614, "uuid": "e3605e24-7dcc-4297-a8a4-4a18094b7758", "comment": "Malware payload (Mirai)", "value": "3ca71c5ddf3941a72345bd86e0913a384050e1a5e66a77ae984690dbe0b63a06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883614, "uuid": "4855a43e-3c3f-44cc-8da9-c023d363a71b", "comment": "Malware payload (Mirai)", "value": "b2e4c44114127d387b68b52e1c803012f6bbac16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883614, "uuid": "6c957b8a-1274-4f70-8f61-4d19fc1c0abf", "comment": "Malware payload (Mirai)", "value": "f21c09d7ac134e5224253b4600816476656551889334fc047ee52966cb8c352a6caf557d7ee04fbebfd52b5d8e596486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883614, "uuid": "a2927302-df61-403a-94d9-9400b79e278f", "value": "T164E3F70ABF714EF7D8AFCD3702B84702209C5A1622A96BB67A74C61CFB4654F06D3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883614, "uuid": "c9c8e278-cf56-4c20-ba8c-fab437c209f9", "value": "1536:CNfUM4nb9jUXTUNTvAAq2qoflbpmFSytreReEu0aDDZD0BZEpRA9gu+WHJQpkqce:CpS6UNdq4bpmEeECDSBN+WH7CxGlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883614, "uuid": "649a3398-c432-4f10-890a-108c2b728757", "value": 147668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883614, "uuid": "ef75c7fb-36e3-4130-9072-a5d0a6f1cab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883614, "uuid": "1bea6490-82ff-4cc2-a68c-f0062fd26ff0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23637178-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883603, "uuid": "82cefa71-da12-4a4c-8a73-ae4a1b9603e5", "comment": "Malware payload (Mirai)", "value": "a5ce92ed7f0c3d12e8207664094726a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883603, "uuid": "a2e7d77b-bce3-4a67-afcb-2dbde5e02ac5", "comment": "Malware payload (Mirai)", "value": "3d8ba7c44f0614c7767cdb49545480058f54affdffa5b589957de8d498ac4e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883603, "uuid": "37aae5f4-920b-460c-aae3-34bd03e1ddda", "comment": "Malware payload (Mirai)", "value": "410fa50e3a39b424c472f9a0420c42d0f684541d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883603, "uuid": "9f85a84b-53e9-4cca-bd8c-26f8a9b14ccf", "comment": "Malware payload (Mirai)", "value": "5ea9abebcb0a75d94e2c2dfc8632bffba829b71300e3ed4d34d64ca8cb49b4034814e79e3183e4f469fa2702bd9f0eef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883603, "uuid": "28e0d020-7b99-41da-bd3a-391ccb98a1fd", "value": "T19FB34B46BC928616C6C761BAFB5E828C331617E8D3EB3203ED156B7C378755A0E3B584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883603, "uuid": "4d0b210d-f08f-4af4-8316-ff3e8bf8c11d", "value": "3072:pTwpyAOX9qbNeurxSzJaGG6P4oNF4ppL3w67jlw:JqbQurxqJjG6PnNF4pFgyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883603, "uuid": "6760f5d5-20bb-41fa-a2d2-dc5d1b81cd0c", "value": 112132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883603, "uuid": "bd505e5c-0884-4575-8ff6-87bdd8a12e99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883603, "uuid": "5452f027-801f-497e-a9ce-0254cd2b6628", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30118771-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781881047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881047, "uuid": "05f4e8a4-5719-459c-8a8c-abbb4adde447", "comment": "Malware payload (Mirai)", "value": "3489330efbdc10c17dc653e0069939b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881047, "uuid": "eb49a56c-bcb7-4593-8cea-20b170dfb33b", "comment": "Malware payload (Mirai)", "value": "3e3884e028a3310adc92631423e7403901ecc5a196a942616c405e8b35992b22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881047, "uuid": "559698a5-bc68-409a-970f-ca5b3ea9963f", "comment": "Malware payload (Mirai)", "value": "abebf1d03589fa443487e64f5681f4b8cc5934e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881047, "uuid": "e9f2115a-d58a-4bd0-bfdd-c578f7fcf55a", "comment": "Malware payload (Mirai)", "value": "aebed95fad2a974217813c1b3b3edb45e4281afeea2831236c584a1f678289f33b6729533af132de0e5ac30615df1774", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881047, "uuid": "5c916ef4-18ac-43a0-80c2-371fdf6c1bd9", "value": "T15FB39E9CAE0FAC81C3DAD37E99098FA2B137747843648270BD01535DD9BE997D8F2522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881047, "uuid": "0d1b8e97-7ffb-43d9-be03-de4c875fdf2f", "value": "3072:mVz9bLJVTr2Q4dB4U8QGwfjEsvyTlgiSHZZa2EzKph:+z9bjTryB5V+lgHZ1+Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881047, "uuid": "b9388821-ce35-4dbf-9fc7-98b353718fbc", "value": 116464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881047, "uuid": "eb38be19-5314-46ad-8d22-7a5d6c51b35b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881047, "uuid": "0b211dcb-6410-432a-b78f-17555b1cc618", "value": "monero.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f67f27-6ba6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849678, "uuid": "9ec3bfe0-6514-48be-9b8d-2b37f6d14ce7", "comment": "Malware payload (Mirai)", "value": "1a9ab97b712d3da5795f86f5e0186b2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849678, "uuid": "0cdd9539-c252-42f0-893b-837c94201286", "comment": "Malware payload (Mirai)", "value": "3e404a0ab97927b8b179e01d7ca0b1f20af0b35a8356103fb308b38fa9ac1b3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849678, "uuid": "592cb371-750e-4161-aedb-8756f20f2880", "comment": "Malware payload (Mirai)", "value": "51cf9f88609a851d87cf31e074cabbd05101fa20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849678, "uuid": "2f1afaf0-137b-4c5d-b9fc-581e4861b91b", "comment": "Malware payload (Mirai)", "value": "a509a94801661f092a7728a78a466ba6377698f2fd53dd1963eb9609f9c901dd411af836f6517ae749040feb293766df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849678, "uuid": "ac1ada19-3fdf-4de2-a5ee-2c325b647554", "value": "T184737CC5EA83D4F5EC2709350072BB7799B3E53E2169DB83C3A4A576EC025C2DA1639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849678, "uuid": "48f3ad78-1350-4f1b-818f-d1e57e76f2a5", "value": "1536:UhThkuuBIIQatPIMv/UUQwGQZEFch3KaccS7Z+A:UhTf7Mv8UWQOM3CZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849678, "uuid": "22c2938e-46d3-4f07-b5fc-dab2b0879177", "value": 79380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849678, "uuid": "a13a1bcd-feb9-4229-b9bd-810b79a96529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849678, "uuid": "55af318c-b5ba-4d73-a830-c0e1bafd4cfa", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b5e409-6b9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781845433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781845433, "uuid": "8a30a35b-ef21-4485-920f-7182c248ffea", "comment": "Malware payload", "value": "4bb7e8f16a95c923a9bb1bf5fd5bebd0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781845433, "uuid": "c1555943-9e8e-4353-afa2-f7d6f6bc0177", "comment": "Malware payload", "value": "3e4748230fb13db23696117efea3b5db43b95d1d6da5c2e08078531ed61cac21", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781845433, "uuid": "2bcd6aa7-036c-40a5-afaf-101ddf03ef1a", "comment": "Malware payload", "value": "6e094fb13d521fad3bd25efd73203df752c6eae7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781845433, "uuid": "b254828b-4fdf-4bef-a2a1-60587cc3c4ad", "comment": "Malware payload", "value": "6e8e09b3d7ae316535bfbe5ae162865d298fd5226fae6f0ed78258dfeea33b1add4496a4576a7e396202feb0360aee6f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781845433, "uuid": "36589527-e668-4ebe-9221-d5742858d692", "value": "T172314FEA4414163A1203CEDE73B33958715CE2EB289BC795DC480EAE8A8C1DCB192F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781845433, "uuid": "8b4c59d6-4c41-422e-874b-fa5c94e448a6", "value": "12:Uwr6Xwv6LRi6RNIGiMQRFL6RFjFSYFDsz6s3BgR6gGUHk6itUmFB96AfIRMiRllx:bkBR7IF2FjFSYFI33DmmFtkRliU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781845433, "uuid": "d59b4e33-1313-466f-ae04-a66806daf4dd", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781845433, "uuid": "443cd5e9-d99d-4bce-b25f-e255fbd2c170", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781845433, "uuid": "ec8b7c5e-2d1b-4034-8172-4c1afd0f02ab", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76d9eca-6b8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781840150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840150, "uuid": "72a742fa-007c-4763-9637-35ed62dd8353", "comment": "Malware payload (Mirai)", "value": "1eee0ebc58679611f65d5d36268c167e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840150, "uuid": "ed9bbe18-aa20-4a07-b76f-aede38e46725", "comment": "Malware payload (Mirai)", "value": "3f8ae1560a9f02dab2687e3caf56ce5c03b7e928aeb47b8927f1917f57d21c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840150, "uuid": "afbc9303-0910-4dd3-94cc-edfed6e708b3", "comment": "Malware payload (Mirai)", "value": "b9cc14e5d080f48763d24352f9ef74ffd63a76c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840150, "uuid": "21b316ec-c948-45cd-ac3d-608ba9be9c01", "comment": "Malware payload (Mirai)", "value": "fd0c95af14815710be946459bbc7f7291a57aae09cfa55a6ce8ea0afab8b35d099f2a01e84b827c6a5afc13c532027dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840150, "uuid": "a2422a7f-d6cb-4b2e-8c56-1040a2ffad24", "value": "T1EC44D71F6E228F7DF36987B447B78E34975933D626E1D580E1ACC1105E6038E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840150, "uuid": "87b68ec3-a5a2-4c25-ad2a-bc5576792842", "value": "6144:tFVh9RBJ2TDOxM4eTN5K8CGMLlrN1Rzjw8opKY:tT6tlT1uL48opj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781840150, "uuid": "95e02588-71c5-436d-b522-f8dbef977026", "value": 278584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781840150, "uuid": "f421be38-0708-4735-bc1d-28081dc4b8b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840150, "uuid": "d954bf90-c1ce-4c73-8e9b-d4b396dcc9c9", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9fc1fd-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850117, "uuid": "97ed86f5-d731-4ad4-abe3-7fdfa899b256", "comment": "Malware payload (Mirai)", "value": "6a240dc4d00214f9698b5445f4b21fba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850117, "uuid": "7401822c-ca85-4981-964c-fe1d5d72ab58", "comment": "Malware payload (Mirai)", "value": "3f8e6f4e0cd3a4d29b913a524688b6c7b6b72f3f65f6ae14c7f0605604ad1304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850117, "uuid": "673daf2e-9ba6-4ef1-848f-78a0c2c86374", "comment": "Malware payload (Mirai)", "value": "dcd471d273e64b40a1836c5ba9ba833dec430a9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850117, "uuid": "1ec4999c-7416-47b1-b833-22010111a4c2", "comment": "Malware payload (Mirai)", "value": "cb1b03ea0c1f691f1773f2905d73b5bcc56fcd046a69d9f7920efad0e5fdfc2a14048fe35b075239cb0df1e6ffe4caab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850117, "uuid": "61b2ed6b-23a7-49a9-8afd-94e4a3790430", "value": "T1BFF2E07DF106FC8FD9ED2DFA098B23A28890B0E0606A0FECD3A05D99DC562056DDD1E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850117, "uuid": "46726565-ccdc-45b3-ba7e-78f39091d119", "value": "768:qcic7wjLhgqHJ3nHglnNwmZYpGYsDob+D/MRPoWmHAE0:tqb9HGwIYokaDkygE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850117, "uuid": "abd8869e-ada5-44b8-abc5-505ba3902687", "value": 37412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850117, "uuid": "e1a59610-a8a7-43b6-ba7e-0811d574a7c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850117, "uuid": "8c328c4a-e2e5-4dda-a9d6-d5c09d461d65", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94ae4b7-6beb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781879613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879613, "uuid": "e9a9d94a-9a3b-4ebb-9b1f-d0ad2fd2c555", "comment": "Malware payload", "value": "4e0746f5a517fab5e0579e54d4b663db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879613, "uuid": "74f2016e-36ad-4195-863e-b64fad1630d3", "comment": "Malware payload", "value": "3fc4b44fdddb35fc904b4aa619de1cacfe1f73490633e22fd163007fe59b2353", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879613, "uuid": "8567143c-8e5c-4f9e-9a7c-fd45bc6f0be5", "comment": "Malware payload", "value": "09cb0d6eab91a4c90084ebd75eb5f05f67cb94a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879613, "uuid": "dd232521-85de-4e41-8943-b841a371e56a", "comment": "Malware payload", "value": "8d55c92d25a18e7e0a6aaa8b423ab99b2c9e443468e3492e5d624f5ba2c3759b05103e125c7269029f8f23083cc1cf99", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879613, "uuid": "0950b00a-24ab-45b4-a424-67ce2b258f26", "value": "T1C2252901ECB7E8207A6ACE1171BF5D72D76725FF2E0C9B18C701016BA345AB95AD4EB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879613, "uuid": "9f1a5f86-5067-42e4-b6c1-c3f1015f2608", "value": "192:aRCJQwBLVw60ZaglfUZjO96f2GmWDjz1P1R1401QT1I1XV1:ADlfumImWDjz1P1R171QT1I1F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879613, "uuid": "9c6f7854-0d83-4423-bb75-bbb4d818ab6e", "value": 1031536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879613, "uuid": "dfb166d3-3348-4a3f-a50f-8ae3d2243612", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879613, "uuid": "4387dad8-e337-415e-9e46-c7a0c5304b84", "value": "proceso.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b3bc89-6be5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781876676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876676, "uuid": "a1b2b009-82bc-457e-9217-a20d5a937b04", "comment": "Malware payload", "value": "7b7729f29602e1eb8ddb5caab4da00f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876676, "uuid": "f78adb76-f2b1-4f90-aef8-a743fa487747", "comment": "Malware payload", "value": "406081999a160002755fafc5436db348284d1f902ccd5280bd67ca2dc0c46457", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876676, "uuid": "367868c0-88a0-4ad2-8d5a-a22a1ef961af", "comment": "Malware payload", "value": "25ad56d0e777257a85e548c824e0c5745f23bb47", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876676, "uuid": "9d753a12-8906-40ab-a247-b9357a399d3a", "comment": "Malware payload", "value": "5a1865fd9c9f02c5b3501f13a52018abe28000f155380d2f0484af7e5badf1b587f17811fd8c208939df3a7cc2cd3df6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876676, "uuid": "b743f52c-4651-44f8-a0ab-4d86350d3d35", "value": "T10631E3CA924147716EF6DDAA71A78C44B8D8B05BECC19F0485D838FD845DF087F49A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876676, "uuid": "e7adebd4-632d-42f1-8892-4d2c19eece07", "value": "24:vyRgR9ROSyRbRWIOSyRybR9woOSyR4RfpOSyRtRXOSyRcbREGOSyRrRjOSyRpRiE:vjRiRXDRBpR0RwGReRCRTR2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876676, "uuid": "ae676bfc-408c-4532-a58f-aedb2f420f5a", "value": 1763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876676, "uuid": "df85cc79-5b05-47a5-a916-d69cea001775", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876676, "uuid": "58b3fc13-d109-470a-be96-a801f860f37b", "value": "pay", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b95941-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875906, "uuid": "be49d27b-5e8d-41d1-ab24-332697560e91", "comment": "Malware payload (Mirai)", "value": "f75465cf9a3b0de58286f17f970a7042", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875906, "uuid": "679a153e-d52d-44a4-8922-7316763cf3d7", "comment": "Malware payload (Mirai)", "value": "4066f531e5d8d1135eb2e26632f3cd6bb8428eac11f8e53eb09f29b40d5b5479", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875906, "uuid": "61fda9b0-7258-44f2-b62f-61525d834b63", "comment": "Malware payload (Mirai)", "value": "5b0c57a76100126ecbeb458db5d3dc075227d437", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875906, "uuid": "472dc058-482a-45d0-aedd-b1edefaf81a6", "comment": "Malware payload (Mirai)", "value": "1561615d05561da90e9fb6413c97ac63452007593111dc5a7417a983fb85474c339bb2a7f0cdd376245a4dee7e4dc63b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875906, "uuid": "d5003b05-a0f1-4ef7-99ff-3f608c565504", "value": "T1F8F2F19FD56B0744D65E383B0E6E200E0A98E44B5794D34B9F84F1488CF4FD2AA7A4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875906, "uuid": "b48664fa-75cd-43e9-9c2d-12edcd5ec728", "value": "768:0hFpoG+zuN07uUaXpJ24C47+lYa9AkCmDCofHJnbcuyD7UGQRj5v:cFGtaN0aUaJ24x7GYscofHJnouy8GyNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875906, "uuid": "9f990fbc-4d5e-45ea-86bf-b52bfbccee0e", "value": 37396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875906, "uuid": "dec2540d-d8c2-4520-8f6e-27628c968e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875906, "uuid": "00a80674-38d9-42bc-85ab-e74530303e3a", "value": "evpyuqbis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c54ec50-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883618, "uuid": "735749fb-0e28-43bd-8eed-67a955088bdd", "comment": "Malware payload (Mirai)", "value": "4eee1091314eaf3ee613d6a5775ba6be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883618, "uuid": "c3ee34dd-73ee-4679-8449-868070c39f58", "comment": "Malware payload (Mirai)", "value": "40a803463027ee84e64ef511b40ca9a4fbc3681a689787e3bfd38fd50ac0ef01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883618, "uuid": "63fca055-42d6-41a4-9251-2bc16720f50f", "comment": "Malware payload (Mirai)", "value": "c1e52390ee7ead1714b61590f727ffb72a94f468", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883618, "uuid": "cfb7a45c-46cb-4466-aaf5-7c667369db61", "comment": "Malware payload (Mirai)", "value": "879ffec4ac04a761fd4cf88e125919ce75b315f06bdb33b7df12b0c50a6c7d9da1cb1bf39189ffeabfbd4748ebfc140a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883618, "uuid": "e365f892-0c76-4408-90e0-e101a15b5119", "value": "T101048C8BB3165C93C89106FA4B9B679C47B351418FABC7D63D0C673D0EA29CE9D0A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883618, "uuid": "62b9b71e-20a6-4ecd-95fc-2b3aaeb67cac", "value": "3072:wkEpGQsw1qn4Z6LofQg9ljgqQrUGbamtdFTZk:wkEpXqtqmqtmtdFTZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883618, "uuid": "669130fe-24f7-452c-974e-9a4b30b5c146", "value": 181692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883618, "uuid": "e3cbce7c-308c-45c6-ab7e-15ad1009f45d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883618, "uuid": "23584412-20a7-4a1a-908d-3a0cae28c5b4", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa17ef6-6bf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781881556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881556, "uuid": "5518c8a4-a450-48ed-a3c2-4a57c3cd8c08", "comment": "Malware payload", "value": "9d812b647faef693e3cbcb82eb6203f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881556, "uuid": "9792d505-4f78-486f-887e-8672ff601562", "comment": "Malware payload", "value": "41539fb5adc034c9387c5d93e1f9098decacbc83dae4aa95fefb1b07b8377e6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881556, "uuid": "7abe0496-d116-4b38-927b-199da92b634e", "comment": "Malware payload", "value": "46260cf9d5f6f520c645eabead6f3b35d91686c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881556, "uuid": "55b315a0-25ec-43b3-ab6e-5ea34b4deeba", "comment": "Malware payload", "value": "87da075acabd4d6586f3d4449ceca8b5b746cfb8017ca3f7673980105e9081ed55f7eb2f122477fa196766403eef459a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881556, "uuid": "6ff2c77e-be55-4425-bf27-9843b96460de", "value": "T1F4863917ECA545F8C0AED1348A729663BA717C884B3027D73B50F7282F76BD0AA79714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881556, "uuid": "77e71bc3-dc89-4e8e-a526-7d52ed970595", "value": "98304:8+YepTx+m+kT807z6QM7ZWEmd7h4eCbY:5pTcmjT8owAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881556, "uuid": "f157f938-2114-4450-97ca-3a0c45ff97a2", "value": 8089600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881556, "uuid": "57b7406d-2c2a-408f-b7d4-c79e9842b6b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881556, "uuid": "45376020-a7a0-4c9f-a512-88a36303621c", "value": "gsd-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b226fc-6ba9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850956, "uuid": "20111064-0513-4d45-bcb8-f6168a9b419f", "comment": "Malware payload (Mirai)", "value": "8bfadf7a40d6fbbc90a03d72473b4c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850956, "uuid": "a1c636cc-0688-4cb5-85c8-d21c5e0a9973", "comment": "Malware payload (Mirai)", "value": "416cb81120c61d0727cd1920a83513c3c46b5e36dac19db7b2137a5024730bc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850956, "uuid": "a90eaa9b-add7-475b-8735-69f907aaa809", "comment": "Malware payload (Mirai)", "value": "a876385dc5f030fcc68e8df1ca18940b56b77027", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850956, "uuid": "28e64f9b-eb33-4e44-b2f9-9597d3127bc3", "comment": "Malware payload (Mirai)", "value": "141e932a5b86d9f3dc70573565a4fcfedf9be3ceac0dc9373513689d5c79513904c32f3260b03526066c42503b04b5a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850956, "uuid": "cd69badb-04bf-4003-8e85-ccd35656356d", "value": "T12513E18DFDD8E4C9E8EE587E005E87A940046081326E87A77731AE27FC14BCB65694F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850956, "uuid": "b394a76f-73d5-4214-a6f6-10fc7eb7ee91", "value": "768:AK8IXfKFYWGcNzspQ0Tm3QLj3D2H3zrFgowHW2jL6FxuQHsYLpNHTTvsMrxyNGEo:qWKSpWaPLf2H3PEHrv6FSYdZTTvv8sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850956, "uuid": "24835bc7-d94c-4a45-b7bf-2c285c8589ec", "value": 44532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850956, "uuid": "0308c1ac-8191-472a-9766-682244b13723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850956, "uuid": "7d6000f1-1883-41ee-a941-d60a7c7ce8ee", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b101fc5e-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913046, "uuid": "3d2f5d93-37f5-413c-bdd6-627bcc9d88b5", "comment": "Malware payload (Mirai)", "value": "921a7b502efcafa5027d2571f6960446", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913046, "uuid": "dc7fd766-4d2c-4453-b062-5ae10e8f6ca3", "comment": "Malware payload (Mirai)", "value": "4270bdd59a4694a07e025653026dacf8ec3a47be39d5c84252fb40717534fcb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913046, "uuid": "16dac409-4a40-490e-907d-f65bfad5036c", "comment": "Malware payload (Mirai)", "value": "8cdf3553f854c96ade9fa53b151f72aba398727e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913046, "uuid": "9339a26e-537e-417d-915d-f0ba114857da", "comment": "Malware payload (Mirai)", "value": "835c73af4ec9113962028475a670ce3096091dab03b2f26bd1fe4a5500c952d14af5892e0c45d30c8368afd28e034e61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913046, "uuid": "6b43be94-8c6b-479a-9d77-2930e7f3f8aa", "value": "T1D6F3854A6E228F7EF369877047B38E31975977D626E1C680E1ACE5401F602CE641FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913046, "uuid": "5371f815-e19c-438a-a0c9-130791822ce5", "value": "3072:Q8CwkCaMAu1nclr9Lo5/mWExl5ls7m8omIMrVaTH:FCwkC1Au9clrC/m9/KK8YyVaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913046, "uuid": "02f7a5a7-0a4f-4379-8545-773739093642", "value": 161948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913046, "uuid": "1d6cf46d-32c0-488e-9b7f-34de856bc5d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913046, "uuid": "472cb1b4-10a5-4273-9add-a44c25a98461", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467b975b-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886238, "uuid": "63eded6b-b89c-40c4-ba3d-f5ec87254fe3", "comment": "Malware payload (Mirai)", "value": "ad624758874a8312a0796a9670109245", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886238, "uuid": "a4559d9d-9e91-47cf-af81-6957a1a3ff55", "comment": "Malware payload (Mirai)", "value": "4349ae32cc67fa321965858ad0d17c36c68ed14d8163954f4fcda49c538282e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886238, "uuid": "97e29e25-095d-4381-bb58-19a41bd5a309", "comment": "Malware payload (Mirai)", "value": "c4174c858f691e1a33d55595fade30007afc8734", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886238, "uuid": "5d49fdb9-badb-4d87-819e-afc94faee3fc", "comment": "Malware payload (Mirai)", "value": "d0ee4d3e327fb0f3852225f0c6db49757498ee2c03f094027cf7228fc51da2ceff91d957e28a84c7d93aa610d418ba89", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886238, "uuid": "7e3cb097-de3c-43aa-9e80-d059fbbfbe52", "value": "T194B33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886238, "uuid": "a512a06d-ca89-4119-937d-b4f02014a12e", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJn:4azwz102cPPaRl+AS97Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886238, "uuid": "3226741d-e984-4e39-97e2-120d116df38e", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886238, "uuid": "bf3befda-0321-485d-bd94-19f9571fd760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886238, "uuid": "da98351c-7941-4845-a20f-cee6e551aab0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9df8b43-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913061, "uuid": "6444f00b-2433-438a-813a-73aca3c591fd", "comment": "Malware payload (Mirai)", "value": "f093df997b45ab780edf0f8479f79f41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913061, "uuid": "fb3b7de0-9baa-4c19-9397-619259c0c525", "comment": "Malware payload (Mirai)", "value": "43742609f29bf9cbd099ab3e2f8fb734d1a492b114e805cfe4d1187e5d5869fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913061, "uuid": "9a557ccf-1a61-44c6-a236-a724f027341c", "comment": "Malware payload (Mirai)", "value": "87f5ce63d6350faac3691fd4ee1ab9d5d5afbe86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913061, "uuid": "104238b8-3004-4ef2-9872-3680ef681d18", "comment": "Malware payload (Mirai)", "value": "f134d98fa552954a2ebb3540ebf0d9acfafcecf859346eec11222fffe6b1c5cae9739804b7d9495b352d29feb5dc2bcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913061, "uuid": "fba18854-daeb-4679-b6e7-3882422d5d44", "value": "T12C158D9DE78AE0E1F26340F1025EDBF31634A12A5013F6F6EF85276374327616F1A25A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913061, "uuid": "5bc06678-f6e5-43e7-aff0-402c2f3cfa45", "value": "24576:n4Ogum/iho3h3lygApmOlHp8BVdNfKu3eR:xho3h1yiMG9dOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913061, "uuid": "0a36aaa4-b0c0-4196-9f49-de7219814d8d", "value": 902520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913061, "uuid": "aa908942-3ca1-4de2-93a7-fe842e739bf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913061, "uuid": "7a4415f2-574e-4b03-a4fa-5fc67bd71513", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2370bf25-6bb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781857403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857403, "uuid": "56092139-ac87-4613-b34e-9ffc423aa431", "comment": "Malware payload (Mirai)", "value": "6c82a036603b7bce154970b8f7b1c8d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857403, "uuid": "122e95c7-fbc2-4d1a-97da-4fd9c990d6f2", "comment": "Malware payload (Mirai)", "value": "43db02c1a3de1b78ee3958349df13afa9845afc83404c4a4b7374bd372774a93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857403, "uuid": "95797efb-2a14-456c-8ff9-1605cfe8417d", "comment": "Malware payload (Mirai)", "value": "0f101ed08ae0c643c1b11e3e996d9d9c228791db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781857403, "uuid": "c008aaf3-5b90-4215-95b8-1dd73921181a", "comment": "Malware payload (Mirai)", "value": "a9f7ca1db4de1011d77ad46386a291261b1da25559c679d80f01408c039006feaee54a511a6a39e6f6ca8f901dc72ab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781857403, "uuid": "04b1563f-8be7-44f9-a2b2-a3a5fd9166e5", "value": "T13B74A623C8154595E1614CF322673289AD0B87BF8AE733D3DE2A59A0BF6051F52BEDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781857403, "uuid": "a3c1ae78-54ed-4ef9-8850-a3361a246e58", "value": "6144:zCPafR+ggjDwjowXD+Paw73mIyQAzXKTNu:GatgHwjhaz3mIyDzXKTNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781857403, "uuid": "d4fcfeb5-6454-49f3-91f3-e5bbd86a8da4", "value": 366676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781857403, "uuid": "6c27f3e7-49e0-495c-82ac-41b8edcae7d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781857403, "uuid": "15f85219-a382-4477-b3e9-4cf5bd4b3e0a", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef60a992-6baf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781853880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853880, "uuid": "729aa25e-bbe9-4aca-9932-0349e9181953", "comment": "Malware payload (Mirai)", "value": "612b13ecf3b7f64e0f9dc0840c43dfb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853880, "uuid": "c5e40fa1-f3c4-42d7-8022-b85491135151", "comment": "Malware payload (Mirai)", "value": "44457889dc7544d83c8894239a0c9320d2b76125957da1a1234943fd317a3ffc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853880, "uuid": "c091ab40-ef5b-4b2c-9301-9003b7d92720", "comment": "Malware payload (Mirai)", "value": "a00bb1cec7f82949286b42f6a7a9480abce6e1ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853880, "uuid": "5ef77a16-478f-415e-9bbd-f0d7551f499f", "comment": "Malware payload (Mirai)", "value": "2dc588afe3b465cd2111009af964d4652f9e5e328b2a8d632ab763c1dd116b594518f8d32f7c58c1821c2f09b9e3db85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853880, "uuid": "46a26364-d1cf-4c1f-b027-65f59d64c28e", "value": "T15D242A45BC819E53C6D522BBFA5E428C372A17B8D2EA3103DD225F24378B96F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853880, "uuid": "d7de9d5c-54e4-454d-8599-f7f28748d86c", "value": "6144:lNlpNHlQVevhiQVML/16dJ4TN99gyqgo4L4:PlXFeevhiQVuAJ4XW6L4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853880, "uuid": "e1e7a8cf-b7c6-4785-a48e-98dc471a2d70", "value": 212800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853880, "uuid": "a74f3bfe-f771-4c8e-b251-85aee6d1c4b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853880, "uuid": "1f7d7280-50e2-4ad4-8992-c0393df9af55", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fcf5c1-6bf0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781881703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881703, "uuid": "14adb2de-b1b3-46af-9652-7cfd11415ca2", "comment": "Malware payload", "value": "ed279dbfdbdda31084d13eb43e7fd2e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881703, "uuid": "5da9e7b4-58d9-4c0d-8847-a182ba55cffc", "comment": "Malware payload", "value": "459daa809751e73f60fbbe4384a7d1653c36bb06945e4eb3635270924241100a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881703, "uuid": "3dfe2a98-26e3-42b4-abbd-6503b5585253", "comment": "Malware payload", "value": "e40dd11ed19e69acad21a0569854583ec8f97003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881703, "uuid": "47f460b8-e78b-4f88-8f95-6225fcd81084", "comment": "Malware payload", "value": "c4113ec38c7e344343d4879ca49ab89af16ef0f1c9eac6518a233f890233cf1dcd71ac443270c6e386f24eae9e26930e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881703, "uuid": "83b42912-274c-4d02-b73d-9d12651e13f6", "value": "T13CA50B8EC58203B5F392FB77822ADA225DF63505907A8A75CF553D358F02F34A0A4ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881703, "uuid": "b4af1a1b-6fc5-40c2-93d2-27bd50a34d79", "value": "12288:TX7wIHLanDX95ZYXeFeBrAKTejvtVD4qUNKS/G:gIunT9hiJpNr/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881703, "uuid": "da5dc63b-e79e-454d-b962-700e25d1ea72", "value": 2232338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881703, "uuid": "d972d32f-80b3-4e98-a566-2ca7d5f82c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881703, "uuid": "1a474a2a-8cf4-4e4b-8116-4d3ec8b55088", "value": "459daa809751e73f60fbbe4384a7d1653c36bb06945e4eb3635270924241100a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4881cb9d-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886242, "uuid": "d419b35e-43c1-4428-a9cf-15a6d3b74f35", "comment": "Malware payload (Mirai)", "value": "888769a60c016d87993fa4bd880ac243", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886242, "uuid": "c44272a4-2e00-4153-a5c0-2c20c9f0169a", "comment": "Malware payload (Mirai)", "value": "4666dbdb0e63d872e19f8d90df1f8a743f9545331ebb14f1aabe1d7c2556833c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886242, "uuid": "de5fed2f-2a65-42d3-b5b1-05c5bd02b916", "comment": "Malware payload (Mirai)", "value": "03e023cf951b006070b1b9e1c231e070225cd1b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886242, "uuid": "6cb6f11c-7655-4c7d-b1a9-6a6c713d6b58", "comment": "Malware payload (Mirai)", "value": "784ecb6aec63f4065bd4c39e0ad22c6f4b5241460ce0aff5902eab96efd1c42b8f87ff9fafc7e67c6cbee2a929a915f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886242, "uuid": "d8342fe1-3302-4903-910e-061f693a1d12", "value": "T1A083AD32EA292D44C0455570B0B98F395B73A5C083476FB666FAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886242, "uuid": "5b017303-2e74-4301-8727-0a727216812f", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7h:UeAsdukuhoNJVwbmuUqjLjwWih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886242, "uuid": "83cfa377-da4b-4768-9343-dd6e61a9927a", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886242, "uuid": "3d644651-6dd1-4ffc-8f4a-178bc66204c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886242, "uuid": "01bf906d-262b-4acb-a2f3-ec67f53064cd", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911bbe33-6bfe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781887652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887652, "uuid": "73b80aff-3424-4bac-ab4b-151eafd57df8", "comment": "Malware payload", "value": "6d4d35bc97f74470387df82f04b3d249", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887652, "uuid": "e98ad112-2d80-442b-8503-58995dea98d1", "comment": "Malware payload", "value": "47088023cf22c95f436e6fb08c208f172504668f3d620b6a558e19b0695bdb04", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887652, "uuid": "20ceac89-18f5-4ea2-831a-f24bf07671ba", "comment": "Malware payload", "value": "f4652ff0682011a7c3424036a36a30ef4fe620de", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887652, "uuid": "2b85a50d-21c5-40f2-a310-20ee1aa21c86", "comment": "Malware payload", "value": "84bbcd6733c2e17655d70134bbe311f3add961bdd1d231aceed3c3701fb66943bacd631aa94d35958bc230e4be94ba53", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887652, "uuid": "a92fb335-95c5-4743-b992-f895e5468f51", "value": "T1B4825A0FB8424726D0E210749276877BDABDA872338414DBFBD489A90A686D6FC3311F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887652, "uuid": "6e68f35b-a2a4-43bd-aa3a-bcd1cbe3230a", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887652, "uuid": "8d4696eb-49df-4f3b-b75b-c90dc6c06a05", "value": "384:BIqQ1VaFPBe/SZCvBu9JgwHcev4av8U9cvF:l8UIE9r4a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781887652, "uuid": "a956d19c-9c93-46b7-89f0-33e68e102e34", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781887652, "uuid": "1dcbf2ee-a781-4e04-ae37-9a4e33d1eb3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887652, "uuid": "6ebad6d4-d692-48d7-b3d6-761ae3be9d35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47551af6-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "b287f246-0daa-458a-a6bb-c7df782409dd", "comment": "Malware payload (Mirai)", "value": "a336ad667c722ea7871f00143d21178b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "211b9671-ed50-40fa-beaa-b17724bd5eb4", "comment": "Malware payload (Mirai)", "value": "47189b972777463b98247ec8ffbfc89aef080a4aba3bf5af6154f9f7f1b688b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "61632f98-2ae8-4f32-ac96-85d2f33df4a5", "comment": "Malware payload (Mirai)", "value": "8741f7350c4c028e7dc6f8f0764845d3e1bee607", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "358ccaf2-22cc-49af-b562-c25d6bddfc8a", "comment": "Malware payload (Mirai)", "value": "f4059bbb76926072302f904a5c9490a0c051779d08a9c81591110fbe71909b067bad7eb2ebf1184be471b23d34938554", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886240, "uuid": "c7e89008-d9d2-41a7-8e2c-888b777d71b3", "value": "T146733B81F94B80F1D847487090BBF33FCE31D6954175D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886240, "uuid": "7b146a3a-18d5-4b67-b556-ed5c9ee519e9", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AH6:uVFrPNQn+WVQ3EXVUk29jgxO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886240, "uuid": "91a7d6d0-7d80-4e4d-9763-6f05fda3840e", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886240, "uuid": "a2726a27-759c-4ce9-be4e-205b9ec398d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886240, "uuid": "6d8c258b-3667-406b-a9d3-0df9abfebe8d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2e7b62-6baa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781851464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851464, "uuid": "e180df70-d652-4eac-b1fb-75b3b35d6d30", "comment": "Malware payload (Mirai)", "value": "f5443e1894458c10a84e06a3cae1bb34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851464, "uuid": "7f2c0d11-9485-4b47-9ea5-019853aeea85", "comment": "Malware payload (Mirai)", "value": "473ceee3c1874e6fbe3645c9fe5732fc6ef5d87d98d4e94cf0b1826d5b130243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851464, "uuid": "7c708b75-95c6-4ef1-8b0f-1f6de6b66a4f", "comment": "Malware payload (Mirai)", "value": "2a2345c280438aaf26e7b2aaaf44076b184c4278", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851464, "uuid": "78bd0dbb-e222-46a0-b29b-06e598016835", "comment": "Malware payload (Mirai)", "value": "2691b127b6584b0470faf845e80dd8862580f7b82bdc77f2004e0ded5eb309dfd0f5980aebebfb4f74017b08588236fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851464, "uuid": "c031f10f-075f-47ca-ac2f-34073e0b42d3", "value": "T199834B02B3580D43D1671EB02A3F37E583EFE59121E4FB89650EDA4641B6EF2254AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851464, "uuid": "31dd7880-8d87-4bd5-bebd-79f6d3b981b1", "value": "1536:EFxekSPd5j1fqsGHh2XTRDNk890OPFC+wm6N/oCuNcbdxu:EFMkSPd5j1fqsGHh2jRDFPFYm6hbdxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781851464, "uuid": "0b806dcf-3a14-4a2b-85e4-5b55386da368", "value": 87656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781851464, "uuid": "7ae2efbd-63f3-4f70-b498-e112fd03ab7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851464, "uuid": "14d5a20f-949e-49a4-8c1f-b8abf897c9ac", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58a9639-6b8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781840066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840066, "uuid": "61888ae0-b8f2-4f56-94f7-8d7ea345fc67", "comment": "Malware payload (Mirai)", "value": "b553ac3882128259e40324360f94f811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840066, "uuid": "999ef645-2134-44c4-848a-61bdd5dc22d0", "comment": "Malware payload (Mirai)", "value": "476ac4f9d423610f0333442c82c885914d09f241a01be68427e436f7dad99717", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840066, "uuid": "93df8727-99bc-47aa-ba95-47b201e08f53", "comment": "Malware payload (Mirai)", "value": "38f0f61460c4209e3d971d0b352ffa9497ed56ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840066, "uuid": "6a226584-bf83-43fd-9463-c9f00ae8ff6a", "comment": "Malware payload (Mirai)", "value": "8f1f67502b337c07d1744aafd4dda69d5d9b4c14a556cb8711b7d6e7840ec810914e144339a9ef96af7b0dc99367964a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840066, "uuid": "cc46dea9-1d28-4c81-926f-e8bbde391b10", "value": "T1B19312D8D68776C9C6374076208D665544C702E6AA71058CDB81CCE8A78FCEFD8EC67E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840066, "uuid": "c2dd8b3f-8939-41cf-be0a-c2e3b1528c4c", "value": "1536:tab/gM0z0y+xgJtlGWdJXKzY8+qV2wHx+QA37Bv7Gok2L6LI9flpG6rT0MF6uGKf:Mb/gMksg3UEJazH+csQA3dvHkS3rI6rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781840066, "uuid": "6667bbfa-c4da-4231-9af6-6e65c733d83f", "value": 90864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781840066, "uuid": "738dc1f7-09ba-4052-bfd7-89284623bd7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840066, "uuid": "41bbf109-5cdf-4324-86d8-de8615c7cd0d", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f2f1b8-6c38-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781912685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781912685, "uuid": "cec662bc-5f3f-447e-a192-8e38728f16ef", "comment": "Malware payload (Mirai)", "value": "6bdf7e5243dee5a9904e9057226d283e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781912685, "uuid": "1cecbd46-b3ca-481b-8442-ad30df62bf8d", "comment": "Malware payload (Mirai)", "value": "4808052ba7d7f68fd8e74bfa6891581742983791f0be7454a85fc58c05ba4d8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781912685, "uuid": "df0b701d-7ca9-4f7b-84e1-048ce5b0bbdc", "comment": "Malware payload (Mirai)", "value": "23d9b16c0a56812c1df90f044f4bbae99c9b29c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781912685, "uuid": "07249d16-82fd-4797-b934-33ddaaec8818", "comment": "Malware payload (Mirai)", "value": "a42132283b72da52cc921f6250a65c0086cb7fb6906ebc6981eee5c5d42220a4c8e1d28a13b313addf29be36fd5df321", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781912685, "uuid": "b6320ffb-4125-4d47-b014-e8c5cdb60a03", "value": "T1E58302C3E1B7AAE1FFDD88BA53B14B78D3BD0AED650245721975C666210BBF4208160E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781912685, "uuid": "7096299e-b5e6-4f46-9dfa-84e2567bb877", "value": "1536:p4OBNXRQ+C8cFN3ixqc/05HPpDoKjNGULJ3TUJfqKHxGfnZ10Bo4u+qgw09o:pbQiQNQx/mHPNoKjNdLJ3TGiKHxM734W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781912685, "uuid": "db14ce2b-958f-4538-9d25-6fbb7c152d56", "value": 81080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781912685, "uuid": "b6ffdda2-0aca-4e93-bcd6-df4cd174328c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781912685, "uuid": "a15dbfd5-36e6-4ac9-9e82-f3ff93c8649a", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f016d4-6bf6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781884392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781884392, "uuid": "817b3d89-75b6-496a-b63f-92c98fa15e02", "comment": "Malware payload (Mirai)", "value": "559484b608677ec70fa71a690fc9cd1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781884392, "uuid": "7f055bfc-f180-41ce-9402-09df838b59ea", "comment": "Malware payload (Mirai)", "value": "488eca83789084f7cea7388507507ae2d7baf5822f8f8fb5d7897eced88e3d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781884392, "uuid": "06e7bc32-ac93-4b69-895a-d92b3cde54e1", "comment": "Malware payload (Mirai)", "value": "47765a1169b1661fb87105a6b34deb96d55ee3f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781884392, "uuid": "bcd39ddf-ca2c-4fc1-b795-54fd3ca7aca0", "comment": "Malware payload (Mirai)", "value": "e7f16e8fa83c751756e1650478cf5688cd767764d9d4eabd0806d716c2647ce4292bbf50018718d6f5fc04e289021e71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781884392, "uuid": "d46b55bb-43f7-43ad-954a-4b86a150a69f", "value": "T12DB30945FC508B17C6C652BBFB4E428D7B2A175CD3EE320399296F25379B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781884392, "uuid": "be07bc2d-1ae9-4059-ab20-da0b6f0a3846", "value": "1536:EVTl5ADM4JTdORxLWPAHSmS4VeURTYki0IwOwXGKKp4Jkklt+wywmjb25nzxNJGI:kJqDjBdOR5WPZ4DR8kFT9Ku3ZrFJIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781884392, "uuid": "1b3e41d3-7e59-447c-9895-08dd094ebb65", "value": 117536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781884392, "uuid": "59295005-9b2b-45d0-bf7f-d31104240146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781884392, "uuid": "c4d62097-2dcb-4c15-a324-9cc25a4b1beb", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b265e1-6bbd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781859612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859612, "uuid": "09a0b3d6-1c55-4aaf-9abd-d797e1edbbb4", "comment": "Malware payload (Mirai)", "value": "084a51718e37a92bb3b4e6852386d789", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859612, "uuid": "bae35313-cd02-448f-97ef-8d8f1699e1c9", "comment": "Malware payload (Mirai)", "value": "48bf232c5f36835470ecab9566aa9e834f99802644f7432b768ea6ead66595bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859612, "uuid": "11aba765-8c25-41e5-ad39-a25e8a07b8f5", "comment": "Malware payload (Mirai)", "value": "cd3b777bf82b9cc9ddf5fa5709f08de6e03a20ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859612, "uuid": "98891eda-2f28-4b41-b21a-4cec5fa0745c", "comment": "Malware payload (Mirai)", "value": "05d617bdf2783a08060ed26cdf931192574650a9f7f6d105fb6a514a7e74232c341dcd348c0bc527bbc9e7569473a1e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859612, "uuid": "1407ca52-f5ac-4aa6-a863-227155bb3567", "value": "T1F974973399194595E0158CF2227733D19D4B87BB88E722D3EE1A5D90FF3142B52BAEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859612, "uuid": "31d90802-a1c7-4a79-87d3-7d05e2f698f3", "value": "6144:K3UbCfLSMcvZf7wjoKt/mX/VcseRia0ANb:imvZf7wjZt/mX/VcseRia0ANb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781859612, "uuid": "624dad73-34ec-47e2-a246-2bd0c0a33674", "value": 343407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781859612, "uuid": "6d2ef994-edb0-4dc1-9e34-176c5d514a37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859612, "uuid": "64262044-4775-4305-b4b4-d35545639d9b", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa07522-6bc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781860986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860986, "uuid": "d14b6bd0-bf6d-4518-9773-3d66250ed063", "comment": "Malware payload", "value": "cff671afef6fd64c3c2a8b4aa840fc6c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860986, "uuid": "50954db6-33e4-44ec-9cb0-cc0c518a5df7", "comment": "Malware payload", "value": "4a17c6f3505aa9651660a5a37bab5fbd468803e1498abebe962470af7bc2d30d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860986, "uuid": "47ff47da-c064-4ff9-9f88-381271ae70e4", "comment": "Malware payload", "value": "a895428ad43aebe6bbd1f3cf6d3a9b6a8ef15bac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860986, "uuid": "5ede8c46-2dc1-4592-9a7f-8337c9c0ec27", "comment": "Malware payload", "value": "c8cef5ca7495214d73f732c69ecf2b8b0b7365511837688ac73200e03991510c9aab383c3595c0bb7780dc1570834119", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860986, "uuid": "134bd953-35a8-44f9-99b7-7edb0e8be593", "value": "T1B2137D6966913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C55A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860986, "uuid": "32869c69-aa70-49b5-80f2-0cc951f00e65", "value": "768:fXRWNGxVe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:Zlxlcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781860986, "uuid": "65a9a55a-f320-400e-9618-b382b3edb590", "value": 45200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781860986, "uuid": "d3b1fcdf-f4fe-45db-a021-dcef32d62ef8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860986, "uuid": "107115ba-f212-438f-a7c2-5e7a628dad1b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39346340-6be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781876338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "d9f52f23-f7a1-4a56-9b05-39141d748485", "comment": "Malware payload (Mirai)", "value": "9fd2cdd98de7a0e74a1a007c3648f0e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "994aeb56-73e0-4b1b-bd5c-57876789c25e", "comment": "Malware payload (Mirai)", "value": "4a8b504b1156232713eec3257c2e11b0a60738f2452ba4f51db1e9c032b5c738", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "ded2488f-b4f8-432f-986a-d185cdf68513", "comment": "Malware payload (Mirai)", "value": "1a36fa6047e09230626fa1aebf544764a116af9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876338, "uuid": "cf8175a1-0a38-44a0-97cf-af7e401cca2e", "comment": "Malware payload (Mirai)", "value": "41f7aceaf859aeeabe07f5ded3f49c28d46a05fd5524d804be7f793f6f3da5def30bfe31ebb3e425fbd3853726ed45c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876338, "uuid": "01a7eb56-08be-472a-b082-082af549d801", "value": "T142357D17B2B374FDC063C430879BD662A936B46552222E7F61C4CB302FA7E641B1DB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876338, "uuid": "43ca6850-7730-4a90-9ab6-81637ea7de39", "value": "24576:VgfD134k6Um8N28vsj5pNpZrrkrRUwQFQw+2oc:VgL134k6UjGLblraUvFQwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876338, "uuid": "93310851-1fa3-406f-9f83-15acf75aa26e", "value": 1085192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876338, "uuid": "81ba5612-5771-4b4a-bb1a-89097c1572ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876338, "uuid": "b5df8cd0-fe49-451f-b305-632ec5394dc0", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5b5256-6ba3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781848637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848637, "uuid": "479c045d-8e46-4266-a4df-19bb53d8d551", "comment": "Malware payload", "value": "0588b181781159bedd6bc7e6a80c978f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848637, "uuid": "5ee7063a-92f8-4c2a-9c2a-f8e4533e1eb7", "comment": "Malware payload", "value": "4b3b6da2e77a2ddfc408cd7013bd757ba38ce2dfc23e83e81a718535c98bd3b7", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848637, "uuid": "9b30f61d-62c0-4e1d-be20-f3eede15af8c", "comment": "Malware payload", "value": "2500f6e2b28cdd8ac51ae0b9e6be57197af415c6", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848637, "uuid": "70915703-8225-4fc4-a86f-57a97a7e8887", "comment": "Malware payload", "value": "a346c248d40b8fd15f858e10b4d65c0b45fe70997a5397ac71f01ecba8f71ffb369b09a2c055a2027eea867d2d7dd6f3", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848637, "uuid": "0effc7b8-e783-4f6a-8f64-76d193d8a5d2", "value": "T1B095232706D8D45BE27C077144B342B65420BC759AA501BB26D1BAAF3F33BE5BC3274A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848637, "uuid": "3636df6b-fa71-4610-801a-74a28c5d8c38", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848637, "uuid": "d31abd5b-296f-46ef-9dea-045fce86facf", "value": "49152:HHIBMAIRo2EuepaZQR9b5Ewl9ZMgNycn0ZDob+tcP:IBjIRND69FvZpNyvZeMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781848637, "uuid": "e154aadf-8c50-46d2-98c1-01b7fbae06d8", "value": 1978368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781848637, "uuid": "f3db7220-08d5-4ec4-9338-a5e882c24d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848637, "uuid": "24d94dc7-69b3-48d8-9e24-524f83ebf7ba", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d74f6e-6bc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781860984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860984, "uuid": "f4abebb4-bc2f-40a6-b39b-b19d42d3a3a6", "comment": "Malware payload (Mirai)", "value": "8eac143446e546ff6ed56a7570b3ebbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860984, "uuid": "d7c41fea-315c-4d6b-ba1a-bb07e1f5dbb5", "comment": "Malware payload (Mirai)", "value": "4ba5c453092cf73b07050f214779ef976bda872501742e3e97ddace41fe15a7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860984, "uuid": "5478cfd6-4228-4ff7-87f1-0f7210185c97", "comment": "Malware payload (Mirai)", "value": "e0c5e5e1f80a27663258d0578fec9afd86bdd26a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860984, "uuid": "0186da2f-789d-43eb-bcc9-d3042e8efd20", "comment": "Malware payload (Mirai)", "value": "b01321bf6971c54b0f6817d569b979002c2f532e96f3e279cf1f839384183fbe20907a6ebc78859bf41b9c6d2a28da93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860984, "uuid": "c54298fe-4b9e-40b1-a14d-88f7a6813405", "value": "T1AB648433D91684A1E0104CF312673686AC4797BF88A726D3EF5A5DA0FF3145B52BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860984, "uuid": "e474457e-32b2-42ae-b737-37b00942cf6a", "value": "6144:zQ8EHjwP6vfOxk3wjojNuM0mXFscMdxDa3aT:c8EHjwYwjeN6mXFscMdxDa3aT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781860984, "uuid": "b862e5eb-e327-4f81-a653-f830bc1202dd", "value": 326959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781860984, "uuid": "da529fa8-75ee-4338-a10b-98f90d44d6fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860984, "uuid": "d8525ad0-fdfd-4dfc-8a31-b79c3ac32f45", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5189fe34-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850179, "uuid": "90e78044-fb04-40c5-be1c-df5d3e4dcd7c", "comment": "Malware payload (Mirai)", "value": "89305516cde8e9662fb3b81553443554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850179, "uuid": "30f10130-3141-467b-ac27-5b825d2ba43b", "comment": "Malware payload (Mirai)", "value": "4bf41ed4f33a3e3bebb4e2842c2a9df3ed948a5509fabeeb9bbf7981236d31a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850179, "uuid": "c57b7667-ddd3-49cd-9ee4-8fd533895608", "comment": "Malware payload (Mirai)", "value": "2fcde44dd43e60fe99adf3042ad5afbfbaf0da55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850179, "uuid": "66da4a88-2877-46b3-abba-93ca7b6e6570", "comment": "Malware payload (Mirai)", "value": "c4f6599cd9b6d590b2ecf9eb1fbf40b61dec01c6300ff0856181b717ac79d4b0862be055031e59578f7f66f3a8ff2794", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850179, "uuid": "c481dcdf-5e3c-4941-96d4-b2c11d30b553", "value": "T1F193B81E6E218FBDF769873047B78A21A75833C627E1D685E25CD6002F6034D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850179, "uuid": "896081f3-ae62-4528-af00-977551199f47", "value": "1536:KloXJI3TfgvWTUTqX6gLAHw3AGh6zeglH08kYf:KkJIDovqUAPLH3AGka89f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850179, "uuid": "596facb7-779a-4bd2-b7c0-c81e8b259a0e", "value": 93352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850179, "uuid": "d0c56a9c-1779-40ab-8602-2acc24f8a7ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850179, "uuid": "e66bbaf4-5a75-4b6d-a814-7a9bae10174a", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f07f8f-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781886445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886445, "uuid": "16748ea3-7d66-4bda-ad9f-ad82e11a298d", "comment": "Malware payload (PhantomStealer)", "value": "80661f936c223b358b26502af4d50de6", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886445, "uuid": "0d75a2ce-a209-446f-a6c4-405c5648b65f", "comment": "Malware payload (PhantomStealer)", "value": "4cebf0ad3d6831e9a2ca006332d0b55c3e20c1b2f54dea59a3c4947b7a2eac9f", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886445, "uuid": "74f03023-78ad-43aa-9391-f8b48f9eaa9a", "comment": "Malware payload (PhantomStealer)", "value": "0f2a92ec5f0aa2ea763f88c14799e39776bfc9c6", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886445, "uuid": "3565beb4-be70-4425-b55c-9463d92f586b", "comment": "Malware payload (PhantomStealer)", "value": "f104d06d01c0c606daf6c3e2e3bef21eca23d58f4335fc4258f43539370da862f816bdea52209b41ea3f7230c9adf919", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886445, "uuid": "6279382c-793e-4ce8-ae60-2668267e5bd6", "value": "T17DF533326F747DF9B6AC822C30AF7F1B0BE55D842405A987B6E129C3466EB04416FD78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886445, "uuid": "529fafab-1c48-45e1-a7ad-d545a242b918", "value": "49152:7F5cl9t6TJqlV7GKFgfcQvWKajXpGAinkRserwS1zad:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886445, "uuid": "4efed3a3-2cb1-426a-94f2-6a68b6cf2ee7", "value": 3406378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886445, "uuid": "1608a61a-2e46-4f41-a2d3-1f1aa902d671", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886445, "uuid": "29d01767-6f37-4c7f-a054-38270f48b21b", "value": "XAKFTSD6.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e6e57a-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "f78b6408-4c6d-4b45-aa5c-2aa5c9914a91", "comment": "Malware payload (Mirai)", "value": "9fd6e84d1d69f3351cb3932ba24e545b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "9401c2ca-6f38-467e-ac6c-5bc6fae956bc", "comment": "Malware payload (Mirai)", "value": "4d2cef68df281095f2be1bf238bd267ae8edce57fe2b7d20a182bc02fdf81143", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "832d4166-18d8-4338-bee9-e9a9c24f8b2a", "comment": "Malware payload (Mirai)", "value": "9cb223651d8fdcfb31b08ad579d66c1fc1d47c84", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "980b2b86-c5b7-49cd-8490-b94d314850f3", "comment": "Malware payload (Mirai)", "value": "5fe0542e1a0a39aa1e50989fe08daf88efb92227ddc50c746ded0f720a3efe387c61d7fdb10e01d72557d3cd473a552c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "c346dff1-9ab4-43ff-8083-16d452aa1865", "value": "T115C3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "caf6ac73-5ded-43c9-a09e-60b6cafae4b9", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3L0j:IaOulLUUogcQ9BvMEWSWC2h3L0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882800, "uuid": "4f1081d6-0abe-45c2-a3e8-3d2bc435b849", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882800, "uuid": "90d70cee-9fb7-4ca1-8ae9-d0a3d894c4b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "2024c8fd-c9b6-4301-8a6a-565f1cdcf283", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91dfc466-6bd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781869185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781869185, "uuid": "ae75061f-a314-41f8-82c2-e50c574b76e8", "comment": "Malware payload", "value": "b58e1242932800afa3e1e464eb67f6d3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781869185, "uuid": "5bc4a36b-d630-48a7-ace2-9b0f4d48f199", "comment": "Malware payload", "value": "4d86d26720ce7526728a58ec710e36d4a6e6270a007664c45cb45d4ec033991b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781869185, "uuid": "679520a0-9ecd-4bea-8b23-2ed92d164b6b", "comment": "Malware payload", "value": "aaeb6005fc0c821009296af370404f6d84f924f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781869185, "uuid": "c71fe7e2-47f8-4e7d-bc33-9812b5120c5a", "comment": "Malware payload", "value": "12aac3736163dd2393c54460005a4ebc8ea7ef5bc84e67aefa9ae536f15a07f1b3796036432df6d37f70b7687420fc72", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781869185, "uuid": "514c39a8-9597-40d2-b8ad-67a5308c772b", "value": "T13B31DEECFAB060B0334DC53D705990D466223AAF28AA394A7CCD2B520F1D50E717CA79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781869185, "uuid": "00583d4c-ec3c-4855-a6f3-d8d2f757cac9", "value": "24:afrJGI3chcUcJT8NOS1eBUj4Zkz5AHIQa6h0tgQbtgQEtgQftgwcb3a7bZv:aFdwh1eBPkzYIQtqgogxgSgrqfZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781869185, "uuid": "6a31075e-3129-481b-a497-32c83ecff463", "value": 1587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781869185, "uuid": "fb766e74-4ac6-44b2-85ab-d2c29d6c73ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781869185, "uuid": "733f2ec8-5ae0-42b3-b07b-76622d7e27ce", "value": "u.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b98cd97-6bea-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1781879026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879026, "uuid": "e6cb58ab-d630-4a3e-955f-0ba91fe54b84", "comment": "Malware payload (DarkTortilla)", "value": "5ac646a17dcee0c649544a10f5493133", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879026, "uuid": "d705f79f-dc52-413d-81e6-0274660b3998", "comment": "Malware payload (DarkTortilla)", "value": "4e8f402951511d7d3b90b0aa4dac332f1c4df89a032cd773c30374cee5b9d8a0", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879026, "uuid": "3946bbe1-d558-4018-8153-b575986b0af9", "comment": "Malware payload (DarkTortilla)", "value": "08f1363ad668f29e81d3fe7550af5319047f757b", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879026, "uuid": "285ea3a7-76ba-4253-8ca4-acd1235b210c", "comment": "Malware payload (DarkTortilla)", "value": "85073c43d3799849c16b23dec6ea1d347519b3518a0df148a188026aef083d4aec048418fc463a157586ed4632c06827", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879026, "uuid": "6c6dc042-ed8c-4f34-87b0-289061218233", "value": "T16F15E1211E476B89D6AE4BB8C0664C6877F0C90792E3E3176FEC04F05EB3B95CE66446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879026, "uuid": "07bd3a63-4bdf-4e8f-95fb-96e7b6a0a718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879026, "uuid": "c1f00dd9-95bd-43e9-b8b8-dda8f467ffba", "value": "12288:vV8emrWfSO0EZvyDE1Szn6GXHYqHcvVnaXujgZ/CbmapHIuj0dK1lfwPHa05LxZk:vV6waZ/CK+HRj0dKLfhMNv7PSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879026, "uuid": "1a57c15c-1334-4365-a239-c0a5b39e5e4d", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879026, "uuid": "fdb8d166-4eb8-465d-9730-a2a2cc6a753f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879026, "uuid": "b9361e07-a106-4e5b-a2d1-3f12d7943792", "value": "factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab495ff9-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781886837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "8ba802f1-ab54-4bc3-9b57-d387088df131", "comment": "Malware payload", "value": "52972a60b350bd3c40c8976c91cb32b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "eabab81f-6c7e-491b-ae7a-96b8ffcb2117", "comment": "Malware payload", "value": "4ea2d6bf46ca8600ff2f2f04671797815a91f31f02175a28d0bebd68cfb9922b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "9e505075-2807-42ab-882e-e43249446ae6", "comment": "Malware payload", "value": "97d91f6429fdb62ecd8bc86873d8f1bf75fea40a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "ef929027-e9c2-4aae-bd78-a04a212c8c2b", "comment": "Malware payload", "value": "8fc324257366d7ae4d8c9b28b515c1e8034e1dd88f41b44f6e8f3793abb7a36b02d9115d5d9b806a59146c50615c100a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886837, "uuid": "fb3811c6-3f43-4d34-a481-4344fa6be7ba", "value": "T10241CDCFBB319AEDF26CC63C0A7F4A38E566A65242D41105E0FCE5021DE0348EA9B1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886837, "uuid": "a4747173-8cec-43c5-b0a5-5d5a848eae95", "value": "48:RaWgFUzaRVEtSEV7JFiELJUELJ6ZHJNqiELZoX5TPBcr9s9Ty:sB+DVJwELJUELJ6ZHJNBELZopAs9Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886837, "uuid": "5ca2ac2c-95c8-4126-9f03-ad6d34a7bb00", "value": 2108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886837, "uuid": "4f097517-8627-4e24-a1ed-cab53dcd16de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886837, "uuid": "e463ab3f-970b-4fdf-bc99-91bd115454a2", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fda4725-6be4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781876295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876295, "uuid": "17ce02ef-1dbb-44c8-a3aa-5cf064a4785a", "comment": "Malware payload", "value": "4e6aaf2225536cbe5c6da4cb7e37a8f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876295, "uuid": "6b90d78d-2e60-468d-a2c9-7f8074fe5751", "comment": "Malware payload", "value": "4ed23e6e4679fc32ece44484db23b5a5fc544da0ff5abea109b938f3e0c005f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876295, "uuid": "c2e3d3da-54c2-47d0-811e-bbc8ef8c14ae", "comment": "Malware payload", "value": "32a0231c36fc731c1e3dc8a9f60bef56ebedbbd4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876295, "uuid": "c210bcf8-b187-47e1-98ac-9af5d9602c06", "comment": "Malware payload", "value": "5d9899cc4882f455e9a786d15862ec473384d0e264828913586d959c144a6d425759a68bd7981eab004e8d6ca7974269", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876295, "uuid": "94ef1257-35a3-42df-b9bd-07e09a65059b", "value": "T12C631E9F86678FABE2742A86C40ED0D509BB7DE322D0378EF471548ABB18547D734862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876295, "uuid": "ceb23fb1-4b65-42e3-9fb2-9ec449c81ab5", "value": "768:+DP1ZP0Uw374AuaiXrSOGyRouKcAi07H24Q7VgakdxTf3wQHVA29o:E0FLvfSolAWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876295, "uuid": "9ceb9693-4f10-47f3-83e4-a19e3de2beae", "value": 73174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876295, "uuid": "e0b32afd-b637-4c58-80bf-33622f8dd3d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876295, "uuid": "d2bb3376-b4c7-44be-bf3b-efa568d257d8", "value": "Doc06192026-05435.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3868ba6c-6c35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781911126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781911126, "uuid": "1a0b98ae-6525-4622-ae23-0643f264848b", "comment": "Malware payload", "value": "47eb3099e6aea06f22c6037f7f1df663", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781911126, "uuid": "830f8330-e78c-4bea-bf0d-f38e6004d97d", "comment": "Malware payload", "value": "4ee3511d715d4177f36658adab6e8c5114d3e129a5a7b96c99cc469effab8616", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781911126, "uuid": "a989fcf0-a2d0-4314-9087-042aef30f125", "comment": "Malware payload", "value": "f821ca00c914443374f39704d157fccdeaf87775", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781911126, "uuid": "f0170080-d56d-438a-82d7-d11e0ffc1ebb", "comment": "Malware payload", "value": "a23fd0452ca88b9d78f8ad021fef99457324ca56a646eb4116bf89d2de48d6511b5de628a0585bbff4c9c61f6b845e29", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781911126, "uuid": "16a87cee-e567-41ab-a527-41b62e6ff935", "value": "T14E447C4763E525F9E0B78238C9A54B46E771F8221330ABDF07A0865E1F237D1AD39B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781911126, "uuid": "78a19945-41b3-4062-b754-a3b07085306e", "value": "ca192ca89afa647048bfa1f1c72dae0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781911126, "uuid": "86233931-468c-46a2-b63b-e3640c9ca5c6", "value": "6144:lmpTEguy4gpjb/6l6ZaXyrWpAKhhvOjHJx:lmWP6bSlI2yrihhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781911126, "uuid": "b28e2212-2d12-4990-99d3-94c0a76f9ee3", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781911126, "uuid": "620906f4-26a2-4df5-8239-bb032ef4b4e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781911126, "uuid": "41c1bea0-4a08-45f3-88ed-e67cfe3c2fe2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a49b8e-6c20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781902175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902175, "uuid": "0dced582-7b18-420a-9b52-236037a3b950", "comment": "Malware payload", "value": "7cf484e8180259919a66044c6d906a74", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902175, "uuid": "c7a17519-5a24-4945-8b3f-ddc7edacb884", "comment": "Malware payload", "value": "4f004d6923fdda17452d44e399ce76091327e321983927613bdc4614db05bad1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902175, "uuid": "78108b9f-e35e-4670-9a10-2942b0b046a9", "comment": "Malware payload", "value": "1b84f24ef92e8a9cf2cb1dc3d5900dbb88f6391f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902175, "uuid": "45af941e-c327-4296-9724-7ef3c4b8f4ac", "comment": "Malware payload", "value": "d89d1e4e6a87bd8fb7d5d56444e664d6f66903adb2b836f9008df7cba721f7305920ee3fff504007541b2d9730315a3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902175, "uuid": "9948983a-6760-4ba2-8937-a3569c10bb35", "value": "T1DC31749F01646B744213CADE33733689A10C91FB2D5BCB94E8884FE9D6485CC7662FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902175, "uuid": "2a3f6e66-b0a2-480a-b827-639cbe39dde9", "value": "24:2YkRHP7mRCT2xsFtR0zeFUeFl4FQ+vFQZmaHR:2YkR2YxSzZsrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781902175, "uuid": "0677cabd-01bc-48a7-bc63-4267fd68c686", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781902175, "uuid": "24946278-b690-48ac-89ad-f24c27577fa0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902175, "uuid": "869356de-1ba9-46da-8d18-67fc7f5f1cff", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bb6f4f-6ba9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781851319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851319, "uuid": "a9c3040f-37ed-4d2b-8d62-469a99c5a43b", "comment": "Malware payload", "value": "370ab4ffb405ed48a2fb996a5ac964e3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851319, "uuid": "6a54f260-725f-4735-ba5a-fae6a0dc545d", "comment": "Malware payload", "value": "4f00d61599b96e6a3a184dc1c0438e6b6292ac370e152af04e6e4eee7c08488f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851319, "uuid": "5e2931ef-0196-4cdf-8f0d-2ed31baded68", "comment": "Malware payload", "value": "9d02c2980b8215bc8e4b220d28a102078eaa57fa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851319, "uuid": "88f1b2a7-ddcf-4573-b560-ebc71459eeb8", "comment": "Malware payload", "value": "d29ba5fb8adde9e0b1ad62d6a725084296f38a71d9e63f92fa66313d0f17cf70a0a527a776dffda759366c3818921468", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851319, "uuid": "c947b9cf-7a55-437e-bec3-0fadae76bf92", "value": "T1D30175CF04D618226196CEB8BFA7DC146D86EFD21CC24E0CAAC618E3508C9947836F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851319, "uuid": "5932900d-8fd9-4092-868a-03e21db39df8", "value": "12:hKBFKaLcLLDvTWiIjDrIMTWmgTWC6TWpdgWKy:Ar7L8WiyUMkfgWKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781851319, "uuid": "6f47cf00-cfe3-4091-a31d-70b8dde2650b", "value": 703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781851319, "uuid": "54862337-4493-44b5-a8a6-846de638309a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851319, "uuid": "e6123fba-140f-40d6-b3bc-f75478561646", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb26627-6b8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781839063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839063, "uuid": "05869260-e5b1-4a25-86cb-5825f39e4b7b", "comment": "Malware payload (Mirai)", "value": "fa3d9e0f1203408f42267976b0caecdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839063, "uuid": "9d53ed3e-8d88-4837-aa59-314398af1897", "comment": "Malware payload (Mirai)", "value": "507ded1111093e7b9c7203b2382b5abbae459ceb247466feb1a69f0acfd083b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839063, "uuid": "3ddba94b-399f-4c6f-9b90-eaa237f574fd", "comment": "Malware payload (Mirai)", "value": "4e43444e4f79569647455d1da7146b3b220afae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839063, "uuid": "a252b625-4122-40da-94e3-c40a06e5ba48", "comment": "Malware payload (Mirai)", "value": "e270602755b82213f4dcf59195cd33d229f4b59eeeafd9336d6572e3b1d4f3395159b8e0e581d88585101dec31bffe92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839063, "uuid": "10f2a41d-c98e-48fa-add8-007e19b9b486", "value": "T129730294E8C343FBDBDB0762DB5AD3062730E1A9C136CB4A06BF47962575FA31D89484", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839063, "uuid": "b789e887-8708-485e-9907-43b83c5c364d", "value": "1536:pbQospd9wjmQDJlD+4kOWP9MW2PVKTL99p5V8+h6zjvBqGhfBuNLb0O4u+qgw09Q:pedGaQVlC2mJ77lXN/4u+qgwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781839063, "uuid": "be9dd588-6a35-43dd-8054-2af55748c79e", "value": 80532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781839063, "uuid": "a5bc0844-dd8c-46e5-8d69-c6b63d62d11c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839063, "uuid": "232214e6-beb6-4653-8421-617ae5515dec", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac5963a-6c22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781903103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903103, "uuid": "44c01bcb-b647-49e3-847d-e58f70483a6f", "comment": "Malware payload", "value": "222e3364f963c5189fd681063e8c4569", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903103, "uuid": "a922ffdf-6e3b-4867-8e44-fa5340c026b7", "comment": "Malware payload", "value": "517520d23f9c6f2cb32c4387f69aecdbf6f2ec9c98b5ac42e89e45d1cfdccffc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903103, "uuid": "15d344c9-9134-453e-afe1-3fda45abc787", "comment": "Malware payload", "value": "adf703321eef4c24e54cf66dc55032099860e5c5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903103, "uuid": "690b3e4d-3194-4bd9-802f-f577511c9ef4", "comment": "Malware payload", "value": "578e2a5ff2a39a346444af11272f38d321051cbbafa495ba34345a044cbb453319d7850709efb6c3b5c89b63b5d70f5e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903103, "uuid": "41996445-0741-405f-bd84-3501257b4dd5", "value": "T13306F0DF06F151B9387CA8306B9D1BC5EE415E304A66F8A92DF23170B01527E9AC7C6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903103, "uuid": "22dfe50d-1e12-41df-aa3f-02983affd9c8", "value": "49152:r2Oei7oWllm/WVtI75FYUKmXxqW2/3pcDOo+jPaD/QR:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781903103, "uuid": "e4497338-1d76-48b4-8aba-cb1aff3c4a7a", "value": 3735217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781903103, "uuid": "cf4ed206-05b4-4017-9df7-cabbd73367c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903103, "uuid": "740cc869-84ff-4e71-9e08-793b811d5b5f", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79309e8f-6ba4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781848957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848957, "uuid": "92ee013d-cfa8-44be-950e-892fba3e9812", "comment": "Malware payload (Mirai)", "value": "d958f927a723a2cdb934feee6b5979e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848957, "uuid": "3b95c55d-4891-4fce-bb1d-812dbbd75164", "comment": "Malware payload (Mirai)", "value": "52ae64bd92dfbbfa253809f0639bb9b6621ef52f549fe83c9dde95570acee19c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848957, "uuid": "b581b86e-c3c8-4a01-a2be-eaca7b987959", "comment": "Malware payload (Mirai)", "value": "480c79daa474a8e933f84055617cc0c66bcb6467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848957, "uuid": "fe83f691-d6be-4178-8182-58b807cc3e15", "comment": "Malware payload (Mirai)", "value": "1af5b51bf61865b79f2fea1d5f210ad6681edaf43a6b7d0ab3f89de416fb86955cd19054782b1bdca020b0d1a4e0467b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848957, "uuid": "cc793de5-1a39-4033-9d21-d8b98a217631", "value": "T1B18339C1FA8BC0F1D91B89304067F63FCB32E9695061D75DEF5A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848957, "uuid": "52ff1cf7-085a-4653-b16a-4e120af7397d", "value": "1536:R9xmTguMtCcu4QJPUh7sdDkoDeTIW1a0KmoZsv4JQ917UTI:R9x9ZNkcZsdjGs0KmoZc41c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781848957, "uuid": "4e463da5-dc20-4f00-845e-3bec2f609f68", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781848957, "uuid": "d15f0ea2-1643-41fa-b2fe-c789a2f55cdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848957, "uuid": "cc88348b-3709-45bf-9b3e-b4b2daf3a96c", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e365b9-6b9b-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781844950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781844950, "uuid": "d64d8978-9c6b-404c-8bf5-ed9785ba51b6", "comment": "Malware payload (Prometei)", "value": "a0725a53e8db688043801fa2aff26c38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781844950, "uuid": "b59d5b23-3458-474d-9fe3-ac2ddcda4cb0", "comment": "Malware payload (Prometei)", "value": "52b070d4137efa4f75ced91177228bce8a3209341defff5061bd7c749fe06a30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781844950, "uuid": "be987ecc-1f3c-46f6-a2bd-f0590a394bc7", "comment": "Malware payload (Prometei)", "value": "b832c22d17abfd2998288bc5d9ce58f4434d4bd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781844950, "uuid": "1f786690-d7ed-48e5-b783-da3dffcfe2a0", "comment": "Malware payload (Prometei)", "value": "f7cd2b864a25395d3be7fc8bba438efa41bbadf60be96d105ebdc8dfb043900d5bda2b1b8354505a5ea04da9e7dd482e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781844950, "uuid": "2d36485f-5476-464a-b2ad-335c5d31f5ea", "value": "T15857CF7792467CEDE9B98DB4C01015816DA878874778E3C7BAC870E666EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781844950, "uuid": "22a62e41-0590-42e7-945b-1401f33117be", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQB:cqYUQuVDt0TZEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781844950, "uuid": "beb3d2ef-8bd3-4e52-b3c1-5720b9c1047a", "value": 28672000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781844950, "uuid": "bede25c4-9ea8-4da4-bca0-2b7edcf5e66d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781844950, "uuid": "f46bfb74-e4b4-4f3c-8e90-94c9573937dd", "value": "52b070d4137efa4f75ced91177228bce8a3209341defff5061bd7c749fe06a30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc6bb39-6bb3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781855330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781855330, "uuid": "64e10ff5-de3b-4b40-96ad-ab9d12c63eb9", "comment": "Malware payload (AgentTesla)", "value": "fd0d2ee46022d5d0228dba24f9cd36c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781855330, "uuid": "2f570eb1-aa7f-4b68-9d8e-14dfaa72d20b", "comment": "Malware payload (AgentTesla)", "value": "5593330d791aca75cdd5dc752aa3efa9e958449f61edc38ea28e95f3b41d4995", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781855330, "uuid": "45bc26d9-ee39-458f-9a3b-2eb7a705a4cf", "comment": "Malware payload (AgentTesla)", "value": "c845eeb8ca7176de497c1414c68bf32ad98dee77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781855330, "uuid": "1e02f404-302c-43a1-b1d9-7781b44f4662", "comment": "Malware payload (AgentTesla)", "value": "cf49aa28a5fc267d3b8c0d6cfe5983800146c6ed6f6f220788efb55be80ae2f08739eed717b020ad961e5ab6a8d80b87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781855330, "uuid": "6173f7be-dd4b-498d-8f06-3b9c66774c08", "value": "T1D5B42225AB65C5B6C83A0531ED66C6FE57A9ED13E0F2270F63903D077834F82582B2B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781855330, "uuid": "7a0fb409-30c4-4aec-907e-8035056ea65e", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781855330, "uuid": "0e7453ff-2f88-4e23-b988-2af08e2bace4", "value": "12288:fX4Qiq8MhMwvww3r/6TPHWElAWoriCykqlOFVtGF3rPD:f4QCMhMwvf3ryTPBpoD1QOFuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781855330, "uuid": "4a40d791-910a-4d65-ba5a-9c5580deafdf", "value": 508591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781855330, "uuid": "02bffc8b-d13c-470b-9fae-34bcd9e14188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781855330, "uuid": "6ccf23dc-c054-46f2-9d05-decc30e02cec", "value": "Commercial_Invoice.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9cd3b6-6bf2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781882626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882626, "uuid": "084415bb-eadc-44c1-a5b4-7b1b299ad81c", "comment": "Malware payload", "value": "42627c044278173f6f3629d09dacd29f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882626, "uuid": "243f8f19-11a2-482f-bb5c-597f8a888fc8", "comment": "Malware payload", "value": "57e05307e0ada72fd7e55f9850617afaf029f24aacea5b5ad453cf8394c159ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882626, "uuid": "db80a100-df26-40a9-8ed4-1a54526ec677", "comment": "Malware payload", "value": "d73ece240f237dfa075394d463ac6089296ce9c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882626, "uuid": "7495838c-80cf-4e40-8c60-ca923445f247", "comment": "Malware payload", "value": "313b331b7cbd60edb57cb005ad533433e16f145e75954e4e77ee4aa7908692b79b4ab747b3989b5eaf792ebdec7bd1c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882626, "uuid": "3f14ff3f-f0ad-4dc7-9cef-aea0dfe62360", "value": "T1101103AB84787106DD0BDD90F0745B8E717B7FAE12B04708E81334E3D0DD66A716AA9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882626, "uuid": "8e2d704a-b229-4ae6-b59c-74b1bd107734", "value": "24:T4+4wg9fff4aqg8fofXhqbxp4A4E2H414KLaZjg6bJa4P4qxBo:sFFlX4Lgc4XAbx6fDYesYgqHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882626, "uuid": "3d1727fb-7fb9-4c92-b507-93b5a5573e59", "value": 1080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882626, "uuid": "c3c7d02e-6f29-43d3-b345-44cca123bb1a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882626, "uuid": "78075195-64c2-4a5a-ad7f-40066be852a6", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a38ba08-6c24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781903935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903935, "uuid": "786c48a3-9abd-4f1a-8497-77af7b0a3f49", "comment": "Malware payload (Mirai)", "value": "fa94bff5769f84d64653065dcdce1c67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903935, "uuid": "d7adafda-e887-47fc-83ab-d69548931b17", "comment": "Malware payload (Mirai)", "value": "57ebc937f7ac21d1ce337759de6e5360d9a24667dd0e5c0dba483d52967337ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903935, "uuid": "7cfb4734-934a-4611-98c2-6ebd718d6128", "comment": "Malware payload (Mirai)", "value": "1ddd1258810592656377598b8f3f7f502cb63615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903935, "uuid": "1190b32e-0393-455f-83fe-2a18938ad978", "comment": "Malware payload (Mirai)", "value": "36c81f6507b337d9ddd4511a95c74a2b8c1fbc5b5c06e6bd0db5bd1d40ed46c02e4b106dbea593c29f1c3e54c732128f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903935, "uuid": "aa656676-a872-4adc-b502-be73f9e397c4", "value": "T1A79302EE1C6C7EE0C9DD7F39A18C4B85C2D6155EB0E811A40D448C8CB4A7AE66CCA2F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903935, "uuid": "572c884b-831f-46f3-a12d-137401738b0f", "value": "1536:wmEDSHwVXaZewlYnvyatmZWAj1/SlBzBeXDYeJI6GuCFr+xmSMd6/g9eThQDa2no:wbWQVWew+nKa8Z//OBzBeXD1JXGIQS+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781903935, "uuid": "13491593-3e15-442f-8cad-84928484ee45", "value": 91076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781903935, "uuid": "f84a740b-24e5-460c-9980-b431ae579a83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903935, "uuid": "3a9c0eea-0e23-4428-aa2e-f61190a5dfbb", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123b9294-6bd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781871548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871548, "uuid": "15541460-ee07-45af-85a2-cce913f716e6", "comment": "Malware payload", "value": "340f81a1a540929d8ed6e1be12808631", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871548, "uuid": "ee1a7758-be02-4037-a3e6-3a0da2c1973e", "comment": "Malware payload", "value": "5825bea8a9944feb0d998de329156bc600016ecab00b34b1a76f20bb5d82e116", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871548, "uuid": "0e4d30fe-037b-44b7-ad23-1fc392ba0a69", "comment": "Malware payload", "value": "85cfe5c05c45b6b75ccbad8b09ad12c2cb996ea0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871548, "uuid": "493e82be-0f6f-431e-bf0d-05308864b5cc", "comment": "Malware payload", "value": "b59f6c4ee7c6dc2cdb4199c44abdd8c739961703617c21b165ce1d21875c7b7dcadd928783a206afacc2bb44a2cc85ee", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871548, "uuid": "01349614-b16d-4fad-b4fe-026c4b8f4d6c", "value": "T10896F55B93C503EA11B2B106E84D3969F712C4BC6B3693252D58B93D33B6638873E5F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871548, "uuid": "72d61dd8-acef-4fa0-8217-5e48d08eb531", "value": "49152:M48XyN/qlZCwfk4464GhS5wY3j8n+HCqTNf9fTz8IGh7gkhkTk+8p+zFjp6PIOqS:7ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781871548, "uuid": "667b64d2-401b-47c0-8d30-ab9d8d444985", "value": 8956503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781871548, "uuid": "44bc70eb-a7ad-4b8e-9eb3-dca39a9197d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871548, "uuid": "206b6240-3393-4da4-8915-4b4f37b1ce98", "value": "nouveau_curriculum_vitae.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce70032-6baf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781853554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853554, "uuid": "3b06be20-3771-465e-a881-85b9f1297727", "comment": "Malware payload (Mirai)", "value": "9f8a46e01f54530de7ffe35e8d426a19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853554, "uuid": "75730610-a0c0-411d-a0bf-2a5a3229bda5", "comment": "Malware payload (Mirai)", "value": "58401f02567784b8db27ca0b0c2d01fc037c1b7c02ed269ce0d446eeda1aebbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853554, "uuid": "6cb65bf8-169e-4f4d-bae3-36d57f74a7f9", "comment": "Malware payload (Mirai)", "value": "fc51be42431a1e93aab4dae06c16df3caed1c965", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853554, "uuid": "0e4fa814-3797-4dc6-97df-b5da4793ef61", "comment": "Malware payload (Mirai)", "value": "225f0bac38824029631bbf7e3d1f4088131e61464afae5affb545638fa9045051ca306a8963fce3902f3015d31b996fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853554, "uuid": "348dadf5-7aae-4e72-b7ac-0e0ab34ffc60", "value": "T18863F1E5D80E5263D7342FB4AD59A0C94C2552F8A1BD34B3BA136BE235F1E040AFF856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853554, "uuid": "4b67547e-753d-49e4-906c-7406e3c9c9d2", "value": "1536:VCkTLSAvaf6/PSN6QvMEx0eQEtLY8rGnfFPXjyF5q+y:VCMSie6/3KMEa9EtLL49Pj05q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853554, "uuid": "ad896974-39a1-4c8e-906e-135b4cec1f8b", "value": 67432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853554, "uuid": "53fbfbbb-e6b6-4636-8f21-94c088eb5f08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853554, "uuid": "ded7fd4f-9e66-40e6-b34a-bcc99fdd6941", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab8e28b-6c21-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781902647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902647, "uuid": "dbcdc94e-c303-4d72-81f5-98f05841c882", "comment": "Malware payload (Mirai)", "value": "51fa1b8c295351f936ab1bee568f29ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902647, "uuid": "ccdc3ff5-d4f2-4265-8ffb-ec8247de4394", "comment": "Malware payload (Mirai)", "value": "58f1e33394f6404b8bdbfe0b55d30b49ba123c2f124426f86b131fbc5fd347b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902647, "uuid": "d34fd0cd-d4b8-4766-beb6-cdb209657fde", "comment": "Malware payload (Mirai)", "value": "a928da3a28e430173d37aac4910bb268655b4c10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902647, "uuid": "efddfa9c-57d4-4c98-9ed3-f99277516926", "comment": "Malware payload (Mirai)", "value": "692640d7d8fab1f53608aef623e6aa9b953b3ca3c521013998b82788b2bd7030f345b59b23e6247d6aaa2d2f70b75d1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902647, "uuid": "7ffadf3d-6901-4736-8929-11442f336153", "value": "T1F9243B46B8819F15D6D016BEFE1E128D332717B8E2DE7212DD205F65778A86F0E3BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902647, "uuid": "1558769f-ee47-4013-8802-854978c0b5b7", "value": "3072:7OD1m0lelR0k6dgSTizozRFvXZUBoiKcXmBxYyaSBw0h7LzZ+z5TCoeLlojBV:Cbe4PdzTZGicXwxjaNSPZ+NteLlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781902647, "uuid": "6e262206-89da-4c70-a72d-38d1927489b4", "value": 225596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781902647, "uuid": "beaae0cb-27c6-43fe-a9cd-5c546252ed9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902647, "uuid": "3abddad4-2d6a-4af3-a45f-9cef6361d100", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a70d6c-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850126, "uuid": "9534c71c-2b47-4957-bce6-2b15921d1cc0", "comment": "Malware payload (Mirai)", "value": "ae50ebe5712c79258b69b40d515e06e7", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850126, "uuid": "02a88635-5fc7-41c2-af3d-646482185f90", "comment": "Malware payload (Mirai)", "value": "593dc02972dadaf1715426535ea15da4941383ad6d73c45fd282c83b1ca58d94", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850126, "uuid": "71ae1da4-1ab1-4a78-830b-39a54c92c318", "comment": "Malware payload (Mirai)", "value": "793e904a4f26c1ff2c00181c245130c5c3465f2e", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850126, "uuid": "8d0b21d8-897f-4241-b85d-5c53076bc87d", "comment": "Malware payload (Mirai)", "value": "b3d182e749974c075ba0510e9258114ad183dfc4ee436f23b9824991e4d052b94e6df689fbbc9a8148e626dc79e83cc9", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850126, "uuid": "3f6249c9-0b63-4176-9c91-d3ac1c2b2ec1", "value": "T10E762711ED8B00F6E9031D3105ABB23F63315D0A8F25DBD7EA807F25F97BAA61836549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850126, "uuid": "073eaeb5-5595-4266-8ddb-4c1b3846ca3f", "value": "49152:Bi8Tnvwga9j8PSano3ouiEqy3iQVXSO3vtkK1m5x4TMKR158X0dV367ScRF5E2w:LTnvMaPSatPcSO3vtH1m50sws/ER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850126, "uuid": "8e20ad44-035c-4234-b259-299e65e0a727", "value": 7135416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850126, "uuid": "f65c265d-401c-4fa5-96a8-c6cad6c118de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850126, "uuid": "a8b3c170-8c64-45b9-9bcd-1a55ba8d7021", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0fbac7-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886166, "uuid": "2bc91493-4e3b-4bab-bd05-7f1b9a8eb0cd", "comment": "Malware payload (Mirai)", "value": "632cec91ae3a98d312b7cee4de2d4f86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886166, "uuid": "35783d93-3fda-468d-9f38-e018e1b5a74d", "comment": "Malware payload (Mirai)", "value": "597711ab59a6671e9c6f8e4212a6a3ca2396fd30e6314d7b46c24d329e719a3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886166, "uuid": "7aec75fa-958b-4910-8da2-eb5c4bc24b73", "comment": "Malware payload (Mirai)", "value": "3e9a1c758d1b529fb99ca7930312ee3d8b5f9501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886166, "uuid": "c569cee6-57eb-4a6c-9406-20cd008aca01", "comment": "Malware payload (Mirai)", "value": "bd08dc39834b9ca8d9b15128b14f90fedc925f7ad5d1c42562ca1923619f22143facf589be23cc22599f3f3bed7acdfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886166, "uuid": "53539d50-347f-464a-ac65-e9100b641fc2", "value": "T142634A232180C5FDC4998271477FA22BFA32F5BD0134F69D67E8FE22BD4AD610A5D095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886166, "uuid": "a94f3ec8-6e6a-418f-88f6-3150ad36dbf1", "value": "1536:TcRq54UHzDMIQd17if7KiqJA1MSvWMHRUVeTBn1:Tn54UHzDMXhY7Kin1MSvhRUVeTBn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886166, "uuid": "926e7568-81b2-4a52-93a5-2e2a64e87aa1", "value": 67136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886166, "uuid": "16e758af-09c0-4591-b690-f272ff6a728d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886166, "uuid": "e41b53af-b752-4eb1-ad31-41849b6427c5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2aa840-6be6-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781877123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781877123, "uuid": "5372da40-dce7-4951-86c1-9137776da1e1", "comment": "Malware payload (ConnectWise)", "value": "8d62871b6992b7ce81910dcb268507ad", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781877123, "uuid": "7aa9757f-ecfa-4f03-912d-67dc466d05f1", "comment": "Malware payload (ConnectWise)", "value": "59da31d01c8983dc3f054d29d94f792fac8c4facf5d1b0c88b941f0c14876357", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781877123, "uuid": "e8aeed86-559e-42ad-be22-0fbc336900d6", "comment": "Malware payload (ConnectWise)", "value": "2739c4ec9c058a73f18ad7dc25626008fbafcf0f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781877123, "uuid": "5b784ca7-0f3e-4c4c-be0c-b0b60e1dedd6", "comment": "Malware payload (ConnectWise)", "value": "7327d0f8fc6da37bdfdb3472673337f4a24eebeef4a2f16ea6bf89f272cadae391ae62c5a301ace1ba8085918d8ed1db", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781877123, "uuid": "d40cd6af-f9f7-41ae-981b-97dee91d7287", "value": "T17F46E101B3D695B6D1BF1638D87A52656734BC049712CBBF5394BD392E32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781877123, "uuid": "3176c967-11ab-4011-8293-a51d37a003de", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781877123, "uuid": "b65575a5-e6e4-4ba9-9039-f8c7c46d3e24", "value": "98304:4z3us6efPcIdoaxcp8wy5c3trGflkQ5DUOgJ9zll:4CfefPlHxcp9ym3WltDUJVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781877123, "uuid": "e321c6cf-e8db-4421-8b2b-8801b15c8660", "value": 5673992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781877123, "uuid": "25afdee2-31a8-44df-b365-26e4228b18e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781877123, "uuid": "7a9a3223-36b8-4db7-b0c9-6df1a9dd52ea", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee3ac73-6c0b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781893178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781893178, "uuid": "8680629e-f4af-4405-a8f4-213c907d4990", "comment": "Malware payload (RemusStealer)", "value": "1048ba7a360eb78771dfad3f5ca2d726", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781893178, "uuid": "845a16a9-aa3e-4535-b193-95bbfa577138", "comment": "Malware payload (RemusStealer)", "value": "5b32520c8250abf509ad7da4d9aa9715a45605aaba0bf340835698d30435b40d", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781893178, "uuid": "b5ba1d90-ee48-4efe-b1d3-d9019a1bfb26", "comment": "Malware payload (RemusStealer)", "value": "8d2fd4184b77f90f45b3bde08db70382a80dd924", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781893178, "uuid": "632a18d0-3343-4400-b9c5-4201d62bf4a6", "comment": "Malware payload (RemusStealer)", "value": "94252c87dab2b67e4ebc3c2b0b3ea11b84c59c6c10903df09143df2a4fd8fca5e5ace6161cf31db2ae0773d08e81bc1c", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781893178, "uuid": "ea259416-9a51-4255-919d-ec83b6a0617b", "value": "T18F64F19772E530FCE1B68B7584A04A098771F8760751AFEF07A446826F336E15E3AF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781893178, "uuid": "942201b1-6e66-4bb7-9c00-6dedc00ed4dd", "value": "2d469f12137239cccf301b24b53c6261", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781893178, "uuid": "7069b86d-9542-4b67-af99-9e40d6b7e5cb", "value": "6144:LqxzJykdMluw466JHiwD8F1Vq6c/zuwPuThBf03BFt8g:LqSeMll47Ctqu4uThBf+3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781893178, "uuid": "29a41986-a4a4-43ce-a068-347fe50212fe", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781893178, "uuid": "2fbd1311-516e-4bd5-98b8-3f0ad95a6392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781893178, "uuid": "5decf169-b1db-41d6-8b5f-57f7906d196e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2753a1-6bc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781861181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861181, "uuid": "5e7c38f8-be37-4218-9eda-a6c892a1e2d3", "comment": "Malware payload", "value": "b0670eddfb798209e1f8cea9b3dc977a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861181, "uuid": "0501c4f0-edf8-470e-a20d-87fd1d6a04e3", "comment": "Malware payload", "value": "5b4cd7e6585469c262077908a88f9fae4e1716ba0784e266bb87ba6c50413c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861181, "uuid": "cf772d44-fbaf-41a5-beb3-bb532f069c4c", "comment": "Malware payload", "value": "677bc9259b31233c59e0b52988aaaea51212c695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861181, "uuid": "7ddc81c3-9762-4b5f-b8aa-cc84889b6c18", "comment": "Malware payload", "value": "98fab19f5c30acfe5c6d49a7aeb677c88b4feb85f0ade8e53da4297416df08d59b47ddf9814fc7f60c33de3a2538cac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861181, "uuid": "a466f6e4-309a-4ba5-976c-b71fd03e1a2c", "value": "T1F745CE137F01D412D1651E72DEA4C7F89721FC58EEA6938730D2AE6BBEEA6C25D012C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861181, "uuid": "f85b231d-5416-441e-8fbf-395e297e1ef8", "value": "0aa32ccd712c1a89045e04d8fe9f66c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861181, "uuid": "3bf05e9a-ec56-4add-8fd3-9e737bd6a29b", "value": "24576:Zar6E/Kxwk045xfR0tdHfEAofvHRMGaysN4JS:ZarfKKqLRYEAofvHRSyb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781861181, "uuid": "5afd13e3-cb3b-4bb8-9563-15be6228b86c", "value": 1185384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781861181, "uuid": "a8b44210-be92-4836-9237-c9b3c371dd2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861181, "uuid": "488fd5d5-7522-4d3c-8b3b-59128d788e65", "value": "Bebra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e06c18-6c23-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781903503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903503, "uuid": "407e5809-ae56-4c2c-af82-a1313101af5c", "comment": "Malware payload (Mirai)", "value": "3ff32cea11a6f8769cc72a11e16ba1af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903503, "uuid": "b2e0c228-91e8-47fb-bc69-71c323827e3a", "comment": "Malware payload (Mirai)", "value": "5dcfa959cfc017c71a45d463711a38c057190a8e78a1f5c250dcc7f896e6bc9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903503, "uuid": "023a7acc-cf54-436e-b1e0-51a2476350d8", "comment": "Malware payload (Mirai)", "value": "02f5766fadabd856869755b9b76ee4e4d6963fdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903503, "uuid": "94ed53fd-f4e6-4963-b619-fe8895670f77", "comment": "Malware payload (Mirai)", "value": "28d7bf5bbe680fbdc7037e1afde998966ba17ef2992db605aaf8f5ba7485f189b1d255df9afa3c63a7190be69364df9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903503, "uuid": "ecf51c22-b230-4256-8a92-5c3f94b71e31", "value": "T170D44955F8809F61C6C539B6F74D42A873074BB9D3EB72069A245B3437EB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903503, "uuid": "c6a9a4b9-eb98-46e5-92fb-99bba70ab463", "value": "12288:HrLZ9fWobKaYVtoWuSFm3eF4KyBeT+UKHyw9Vw+IN8pgnSc2p:LLZ9fPYVWGmOF4Ky8T+UYylS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781903503, "uuid": "6f14a320-40aa-44d4-ba5f-d5394a572eec", "value": 620860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781903503, "uuid": "a24545e0-35ed-447b-9c6f-7154e6d0f938", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903503, "uuid": "75ee90e0-2fdf-4be1-a5c7-78eaf498c9f7", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f852fd4-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850122, "uuid": "dacc0782-1eda-4afa-b1ed-585961cb84d4", "comment": "Malware payload (Mirai)", "value": "7672fbeaf77878377606d7aed248ea8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850122, "uuid": "d0d25567-142b-41d6-bb6b-1a5fc3a9156a", "comment": "Malware payload (Mirai)", "value": "5e1b36cd0efe199691c15254189c19ceb3ee4f8baa727667ff8ca1de45ce5294", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850122, "uuid": "bbd6f3e0-49b8-47c4-90ea-4753955d84f3", "comment": "Malware payload (Mirai)", "value": "c6467cb200941c66697d61949e2c7d7ae1a1b103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850122, "uuid": "fdf48f77-0c8a-475e-a30d-0a8d5dfa0498", "comment": "Malware payload (Mirai)", "value": "087382b2efc97b64ffcd88b2791046913b3cc72c4a40004fe2384ad1f9d6195004d0622f6aa16a8c4639b1d8fc4bb758", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850122, "uuid": "228559c8-4ff8-4c14-a2dd-3e2eb6d42c99", "value": "T115F2F183D698C4F8C7584976E90EC481172A1BF8B086792DD724C7845AC6E8A73B7973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850122, "uuid": "0568aef7-3b05-4834-be6a-8b2f8567891f", "value": "768:wKiQ47RQvKeKITjXS3rru+yrQn3gQkMEJS9MLra/U3UvFw:ax7beArCGn3z5EJSycW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850122, "uuid": "66bf193b-bada-436e-a460-39a2b8c157a0", "value": 37356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850122, "uuid": "969af3dd-ac90-4bdd-9dd5-a106f4e50271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850122, "uuid": "b9e4cc6f-5c45-4c60-920c-c9336825103f", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6558a140-6c23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781903470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903470, "uuid": "fde9f826-3350-4f84-9ed8-8d7d31814092", "comment": "Malware payload", "value": "0eefaa08a8b54dbf35a9d0a0d6e24e65", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903470, "uuid": "d4cf9941-85fa-434f-8eac-e7ca641a806a", "comment": "Malware payload", "value": "5ee64d8bc57ca885cfd849cc0787db3d258af0d1272fa5fe8c5c23866bee14b9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903470, "uuid": "54fbcfde-34e0-4ff6-9b95-81759073f8ab", "comment": "Malware payload", "value": "8f1369ef5f16b64b6677d4e808d5f5557558150c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903470, "uuid": "dd47feb6-3c0f-4352-a014-137b872cdcbf", "comment": "Malware payload", "value": "55aff804d0c5ab0a90121874b82a8b0af48ff2e0bffc5e1303e307789fc8770153207b329a813bc52c8a18f96ef01c02", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903470, "uuid": "ddc439df-7370-43ba-96b1-22aabf9711dc", "value": "T1B1136C6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C5569CE218B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903470, "uuid": "f95a16d2-cb2a-48b7-9b90-600392fe75e9", "value": "768:Dr9NyXsZztC19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:3HusZLcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781903470, "uuid": "1547e106-9181-406d-8672-c6b79d2dd3d7", "value": 45200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781903470, "uuid": "30fe2399-cfa9-4473-9cc7-dcd6aef4c3cf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903470, "uuid": "81728b2c-dfc9-4532-a325-e38056b09c62", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab1c157-6bc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781861469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861469, "uuid": "3f11e5e7-d8c8-44de-bc44-01309c42db19", "comment": "Malware payload (Vidar)", "value": "676a17fea5929589b8da0412a504c3f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861469, "uuid": "4c9c09cb-9929-4be3-87b5-e979650fff2f", "comment": "Malware payload (Vidar)", "value": "5f1a653c54996145dd4f7686d284c533561da711f0db91053f60e9d19bd79ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861469, "uuid": "2be05be4-60d6-4c64-b4e3-9257ad652485", "comment": "Malware payload (Vidar)", "value": "60bbf04d7c3657bdd1c37e89b6d503d714af377f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861469, "uuid": "facb6782-37ae-4b88-afaa-2f7258e57e3f", "comment": "Malware payload (Vidar)", "value": "9722307af39c052b8a76d8a97e7a62414e32c03e78b731e9c41d3d88e5a0e7333e8cd859db73946c05381b992ca085f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861469, "uuid": "fa171ff4-ea91-450d-bddf-8ad1ee3395a4", "value": "T1ED069E07EFD11869D499A2328DA342817B7CBC051B3337D36E90B67A6E737D0AA36714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861469, "uuid": "4101633c-bc9d-4e93-8fa9-31dc8bc83325", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861469, "uuid": "a836ccb8-725d-43d2-a30e-1a3ef104754a", "value": "49152:q0vZMFXL1SjbERxJYgcLHkZRNbci8heozZkz/NMLbcsuoPDadtBpMMY9hUV5yayM:qFlRKHMR2nzuMMtv8rYaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781861469, "uuid": "4ca810ca-38cd-4b1a-b162-a3733fa92164", "value": 4013312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781861469, "uuid": "389032ea-3724-4368-b3ab-ded53bf76459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861469, "uuid": "fadb3bc6-2685-4031-958f-de9902293d5b", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54310594-6bcd-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781866505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781866505, "uuid": "e2d41716-f208-4f7d-934f-a0512ee0bc7d", "comment": "Malware payload (NanoCore)", "value": "9c136ed7d371c43879619cbe5df49279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781866505, "uuid": "e3b13d22-72e5-4791-843e-02dfe5e71e25", "comment": "Malware payload (NanoCore)", "value": "60df9a8efe346db5a354bfff4be34e6db8130ca84b6359b92e9125bc4ff05d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781866505, "uuid": "f7f257eb-e50e-4128-9631-ce89f38aba07", "comment": "Malware payload (NanoCore)", "value": "b96fd2e18fe57ecad32ef2ec676f08b7249ac30f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781866505, "uuid": "27ec1812-72f8-4852-8778-3b21b393c736", "comment": "Malware payload (NanoCore)", "value": "6b0fc59d3cdea533dfb982a0220c49c92e165e83996b6aa925ccadc9bbd07a67de2b3b3108fc8fd448a7178b23a615ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781866505, "uuid": "0bfd2170-12fd-4b6f-a3b3-fc05defacc64", "value": "T19114CF5677A84A2FE2DE8679612252028339C2E3ACC3F3DF28D455B75F667E4060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781866505, "uuid": "8aa7b4f9-c843-4768-9736-41c668325d03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781866505, "uuid": "14437ece-1cc8-4bbd-9efd-d2626491e370", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIhHT9cx77B7aqetQ0XdeMBma17:gLV6Bta6dtJmakIM5xx79PEQ8QVP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781866505, "uuid": "d1ca1b0e-feb2-46f4-982d-e66d49138e90", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781866505, "uuid": "175b77ce-be75-4693-8301-27ece60f3d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781866505, "uuid": "825e2a2e-7bb8-4f22-b650-8bc9bda8e5ff", "value": "hi88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc37b3e3-6b83-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781834896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781834896, "uuid": "7fbfb9b2-48ab-4db8-ba5d-a5e9dae5d54d", "comment": "Malware payload (AgentTesla)", "value": "b9ad86637f279789604228df68d6b1d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781834896, "uuid": "869d3794-2c11-41a2-8744-f142007feb56", "comment": "Malware payload (AgentTesla)", "value": "61c5833831b300b97a6bbacf5b8dcdeca31f7a121dd3d4d2822e3a81b5ac63a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781834896, "uuid": "6d42cc68-d76f-4d92-9449-9770b59f5ce6", "comment": "Malware payload (AgentTesla)", "value": "2e78e7c51572a8d57b3987de9b3c186212337445", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781834896, "uuid": "a296f56a-c1ce-4e0b-8517-1c766fe8b6f1", "comment": "Malware payload (AgentTesla)", "value": "83023bfa41b4e45af5454de6073e20a0138fe2ce423a3820bece0cfd74304c9c674d736c3b699fc30c35a30557c5d922", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781834896, "uuid": "f8f50dab-eb16-41e1-8afa-5138fe9488d3", "value": "T1BD958F00DD3896E628A09795C8928728ED3632C39CE5F5447DEC7F61C0EC9E5DE972A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781834896, "uuid": "4cf2d79d-8822-472d-829d-511cc1a0f866", "value": "12288:ELLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLp:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781834896, "uuid": "732e7222-4e68-4e7a-a7d0-cb59b0b01a8e", "value": 1885391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781834896, "uuid": "6f9e6d99-61c2-4edc-af3d-90c95ed1f1ad", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781834896, "uuid": "cafe6b73-2c34-4851-83c7-ae3014407628", "value": "Orden de compra POF0000095.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8e8576-6bdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781872558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872558, "uuid": "af7d881d-75d9-4495-944f-9844a3ed89d2", "comment": "Malware payload (Formbook)", "value": "217f3dc3dffb7062e017676a9af97d64", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872558, "uuid": "7869a8e9-b883-4edc-b3cc-4eff8bb01806", "comment": "Malware payload (Formbook)", "value": "626f2311154e7a07136f4d8d45fa218a359874d0d805c22c52544385bbd1290d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872558, "uuid": "b7fa1ff6-5210-4442-b22a-3dded99d3d1a", "comment": "Malware payload (Formbook)", "value": "9f1d0bb33491db95f511f75b9d4a9792d0bcc08e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872558, "uuid": "8bda729e-2df1-4831-bb72-49d63497169c", "comment": "Malware payload (Formbook)", "value": "51a525ccf222e53c6eb1742ac7a89e5757fb4c96b98685ee62daee4e73852cb01ab6b80ea342aedd00c4d3139141eb22", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872558, "uuid": "c42cee0e-b033-43ff-84da-b0ded575e088", "value": "T1459422253B88072A6BF80AA6F247353F71CECBDA5F15C1C85999D0DE418DDEBC58E488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872558, "uuid": "b12f76ed-2c7f-4562-b3d6-74f7c0bb0de1", "value": "12288:l3oOCglR1mAqpnmUM8aZjYE6gqeN/BdRUD/:lZX4mbF76gqqDk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781872558, "uuid": "2f2877ed-9f02-4a00-8f31-53654f1f899a", "value": 431866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781872558, "uuid": "917d0498-b414-4b0a-84be-8bbfbfe082ae", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872558, "uuid": "f94d144a-7441-4200-825b-e03ef7d7f5be", "value": "PI pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a5aec9-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781881056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881056, "uuid": "a5139af3-bd91-496b-a72e-c9ef2a736eda", "comment": "Malware payload (Mirai)", "value": "92101ba614b797c850ca142506ec7597", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881056, "uuid": "0371cb51-b8ee-4020-b641-2aa9465d017c", "comment": "Malware payload (Mirai)", "value": "62df4892958a7616bc33ce7d4f6cb90489f36df5fe9974e1cf38263469a69894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881056, "uuid": "b4aef15b-aeaa-4b75-9cf7-d6aae3887b0a", "comment": "Malware payload (Mirai)", "value": "3c233407cb360d2483e3211fa0b38a9aea0d9223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881056, "uuid": "925616db-c0e3-4f1b-bf20-c63504dc2100", "comment": "Malware payload (Mirai)", "value": "b5c0167af75437997cd6866606138d79822baef8c6732ad9a5f2320a8d54f64c6f1712573efcbb05ff0cb3553ffbecae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881056, "uuid": "68c913f3-cf1d-4a4a-8c4a-fdbad6552dac", "value": "T108B36B2EFB82E1B0F0B29131505AD7779F36D9314252881BFB463E30E8B52C5D699B2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881056, "uuid": "7c56401f-935b-4a79-8822-a05e315283ed", "value": "1536:vrAjQY5QYcEpcQ466xdh2WBEEcRdVFMK257tbTzPbbCraEN8qZP1SMRaLMEictoc:vrAzDcEpcQydh2WKETzbe8qjS8aLMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881056, "uuid": "be832da3-68af-4c85-9a4b-2d6e298cadf4", "value": 116028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881056, "uuid": "3afd0ba7-c70a-4479-89c4-f2f97c779abf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881056, "uuid": "3d30be7d-f335-4930-a34a-656b9404a75d", "value": "monero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81ee2cc-6bc2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781861921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861921, "uuid": "83a0ea75-dbf2-450f-8965-9bbc343c69c0", "comment": "Malware payload (RemusStealer)", "value": "7bc384b74fe21b4f915f463dfc7b4762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861921, "uuid": "2a058a30-18d2-4ca4-aa11-b94300aaedac", "comment": "Malware payload (RemusStealer)", "value": "64767a09cce6d538bea2d11e0c59f47abd05f6e57f7a88b2b7a864c782cc1041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861921, "uuid": "080d9641-80a7-4999-83d0-7d91ef5b0b8c", "comment": "Malware payload (RemusStealer)", "value": "ae06810ec3aefd9fdae1b15ce0dd1effdabafa66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861921, "uuid": "682f641a-9030-49cd-be24-0590a528def8", "comment": "Malware payload (RemusStealer)", "value": "3490a54cf3716e1f8bf8b2bf137fbecbfd5465b6866b56e6256f2d8d0243a6cb78cd931ecf3588d2a65f2ca7924322db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861921, "uuid": "5e8b65e8-4349-45eb-bfb3-70a6e25295c0", "value": "T19EC54A03FCD119E9C49AA33189B29296BB35BC451B3223D72E90B7782F727D0AD36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861921, "uuid": "d4f5316d-f024-4915-8208-398a4e6274ed", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861921, "uuid": "e863aec2-0dea-4e43-90c9-f89b38bd6857", "value": "24576:A9QTIaRICFhdx6fB91AUdyK1tdxQu1ftJM4Ia0ll7lQvA2Bele5IK2udbuHDJUSL:A9Qc4XhGfBrAIvoacxldotw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781861921, "uuid": "28c209ff-8a7f-4358-b1fe-e1ba81bc5098", "value": 2605424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781861921, "uuid": "b1554206-efef-46e9-8363-423138926e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861921, "uuid": "2495636e-d963-4980-8bcc-8add5a8be0bf", "value": "\u0441qdst\u0430\u0440\u0440\u0435r\u0425-v.7.641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186717d4-6c05-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781890456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781890456, "uuid": "f01b2ceb-c75a-4ada-a671-f0c07590c68a", "comment": "Malware payload", "value": "ce6da0cf1fc33dc1691a35445146ff05", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781890456, "uuid": "33c348a8-dc64-4d9a-99d5-197895053f46", "comment": "Malware payload", "value": "65a449e5c423848e7b3a4f9226c959a1a7367ddfe63ff7c3c04eb3cd7f3ab650", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781890456, "uuid": "0f0b3edf-c649-4f8f-b2cf-668061652d2a", "comment": "Malware payload", "value": "4b7d93c1da2549d035626d1d1b6a560492db4375", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781890456, "uuid": "57f99724-0986-4dac-a3db-8d022da5c0f5", "comment": "Malware payload", "value": "6460edc84eef7f8a9cdbd14e6894f7bec056a3c9fa0b72edd789d3964c0af30a95b56be93978cc9f7857b2edfa7ecfd2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781890456, "uuid": "192c073f-b1b5-4e41-9b22-07ef247511bb", "value": "T1F44733FE35E0DDD8C705BA709B7233F252698D1171862B9C84EB3DA0EDF0096A91774A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781890456, "uuid": "6a13bd74-f1db-4e27-98f5-c56140cf80bc", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781890456, "uuid": "a102ce8d-a132-4246-8179-9cf90f0e67fd", "value": "393216:LWMAQHdmh2verOQfou6ZxJdtosHHnjcvv7QoiLW6b2lV97pdeQQqnzfCy:LSQH8G0ougHvHgvclLW6b5uCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781890456, "uuid": "697d652f-4c5f-499e-bae0-2ba7af5e213b", "value": 25159148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781890456, "uuid": "e4c4d5dd-2168-470c-873a-e8ec57ee8a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781890456, "uuid": "f9bbdb9b-0c3b-4885-9540-2b085d239024", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b837de80-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913058, "uuid": "1a5d5c17-37e9-4673-98e4-5c8b8ee40ab3", "comment": "Malware payload (Mirai)", "value": "ae9e0708cc96418fa2e0555bbac7ff00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913058, "uuid": "6d672f26-175e-4b00-8a46-7ba2fbfa4052", "comment": "Malware payload (Mirai)", "value": "6621fff6570fd89b558db4ae0e52aac53a2b65184187c7c4779a8a96889a30f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913058, "uuid": "29296478-4865-4bac-a471-efbff72de6fb", "comment": "Malware payload (Mirai)", "value": "8622238504e8796b057927143efd73f815aaa840", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913058, "uuid": "12d65208-3c53-4457-92ff-2e5e334aff92", "comment": "Malware payload (Mirai)", "value": "f32617a28b979d09983d66ba359ae479b18065d46391ac0833141aba59fd62879dc552bc4fadb0b33e0ad35ed3e67b57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913058, "uuid": "ff8559ee-3066-4b40-be58-1d1095f612a0", "value": "T10CC33902770D0F43D1232CF02B7B1BE0879ABEA619F5E584B51DBEC65275DB22182ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913058, "uuid": "9b44b03e-50a2-4818-89f3-405f15c420a7", "value": "3072:jGTeW1uezIf77A8zzsS6gsOuTGxuciw5FzSApbo:jGTXuH48MS6gCTGxu8xTbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913058, "uuid": "f74fa40c-6f3d-41fa-ab49-086a83b07513", "value": 129164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913058, "uuid": "6c9b9078-f134-45f8-9732-f55890e816ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913058, "uuid": "a945eec4-18e6-42df-81e5-d00b06b96603", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e375eb5-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875970, "uuid": "04943706-a0dc-4866-927e-92b81e3fc20b", "comment": "Malware payload (Mirai)", "value": "50663d49950d2e85654b3af6232bda88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875970, "uuid": "0c7e2a18-e502-44a0-8667-cbdad07731a5", "comment": "Malware payload (Mirai)", "value": "66bf384cbdc0e9b48d8427fab63156af02b12fd952e6381e86a93479cb7c61b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875970, "uuid": "2c3c9228-b62c-4d50-bdad-0632a5fa23c1", "comment": "Malware payload (Mirai)", "value": "f816af82e1327880363c8f5ef8a1d8acc2b77f03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875970, "uuid": "fe19ccd4-d453-442c-a68b-c467b44f041a", "comment": "Malware payload (Mirai)", "value": "3d13764650eafe15fe01e89b9cd44d525a4556f524a4c61c0ff3e627da49189f20dcc989ce56a20507b79e4aed82f490", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875970, "uuid": "7ac459ca-78a7-4ca4-8bd8-48c6377a8fdf", "value": "T180F32B47EB418E53C0D62779B6AF4245332397A4E3E73306992CAFB43F8669D0E67502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875970, "uuid": "bcbc517b-406a-4096-b1f7-c40685b02dab", "value": "3072:qbbeTBYuhWYanLa/Pj9Ao9C1P9vvI/zEMLDCXM/9t9v:oUYsWYanLa/Pj9d9S9nIYMLDSM/9t1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875970, "uuid": "6165e4cf-b2a5-476a-85ff-c80ae8c21824", "value": 167332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875970, "uuid": "fbd604d3-a1de-4065-bfec-36f4cfaacc22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875970, "uuid": "65f20cb0-5874-4b61-93c6-03ddc024f3ee", "value": "lfpxfytvz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c529ba0-6bd8-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781871323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871323, "uuid": "e3fe5d41-1472-413e-a4c0-a8703fd328b6", "comment": "Malware payload (SilentNet)", "value": "1248f2e9904a3f6c17c31995fa1ccce0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871323, "uuid": "bd780cff-d634-4916-a34f-8bac00b60024", "comment": "Malware payload (SilentNet)", "value": "67559b42000a06fd916ff1f4d45903cea4e71e7afaf0e73571a308632cc5565f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871323, "uuid": "74d9b215-1877-48e5-a9cd-6867f909d0e7", "comment": "Malware payload (SilentNet)", "value": "80bb65e2fc7c8682fdd1cd58fad500e281cf4465", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871323, "uuid": "a8353eb5-8e35-4c5b-9f41-9587b44fa4f5", "comment": "Malware payload (SilentNet)", "value": "b9737ed148f2e77d87cb14dae4ad00e541487627ff7f5266081b42bc1f01ae807e70e71ed37f9047261603a88b6c5240", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871323, "uuid": "e671c796-9a2f-49be-afbc-78910db1f3ed", "value": "T167552362DFDC6029D05333FB9A7149614730C985B846303BAEB6915F4EA582A2FB3F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871323, "uuid": "957da1c4-d3ae-4274-8fdc-56fbfff31624", "value": "24576:vl7Ssq7GFrYAdp6yDH6sTEx1J4H3XJ2OjgwrtZ9LqFH1Sd2XaoRP1ci3:9u7GhdQQHSHJ4HnJa+Z5qFH1KnoduU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781871323, "uuid": "993aa911-473b-4823-a4f3-03b2942c8541", "value": 1400887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781871323, "uuid": "2e564c94-e21b-4656-bc99-d3297a3114d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871323, "uuid": "d1b4a313-47f4-490a-8a66-257dd1bdd760", "value": "lezys-optimizations-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd5b1e5-6c2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781908368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781908368, "uuid": "abdfeba7-02ad-4f8a-95d4-31650ad00063", "comment": "Malware payload", "value": "04260f0cc11319e7b604eed237bf1890", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781908368, "uuid": "ab9a41c1-cfe8-40d0-888b-96eda9f70c54", "comment": "Malware payload", "value": "699d34f486d468ff829739fa9af221c6cf94536815605573757f40899a54c166", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781908368, "uuid": "fa42347d-654a-45cc-9495-7bdb5757860e", "comment": "Malware payload", "value": "9141b3e8fba563c53804cf98b5d71170e3384916", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781908368, "uuid": "2f1a23bc-66c6-4d35-874f-5b53caa96ebd", "comment": "Malware payload", "value": "dbe91dd0a7cbeb43c0754d20b874a7d00a510538f371d9d6d517a5e33be46bdd9a5a287e9693eeb31ea52e9278641f98", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781908368, "uuid": "36fcf3b4-0604-4174-9172-c7b1769029d5", "value": "T1A3F56B42EC9649E9C05A637189A79282BB75BC451F3223D32E60B37C3FB2BD05C79758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781908368, "uuid": "9d5963b8-77fa-4ea2-963d-5977c3363236", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781908368, "uuid": "eb8525f9-1ce1-4b6c-a979-b55f76fb6504", "value": "49152:1W2mDdAEedx8R9yni6Ahm3cx1VZj8dQ3U:1aLbWaN1Dj5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781908368, "uuid": "dd1578c9-91bc-4e69-b947-1f82fd02e639", "value": 3351384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781908368, "uuid": "af00b5dd-e79e-4e4c-a9d2-b0712155ffa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781908368, "uuid": "0b4704d9-9433-4b96-803d-dc0f9ed57f03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361e787d-6baf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781853569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853569, "uuid": "ea9416e3-3cc6-493b-954c-179da78042d3", "comment": "Malware payload (Mirai)", "value": "60c2e1761b37884121f00efb8b9abca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853569, "uuid": "852b6834-3c33-4a67-bf0b-2e08aa96758e", "comment": "Malware payload (Mirai)", "value": "69fd4514e33f514c4de8af969499028a3826dcda629bee6e9140affa4dc738bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853569, "uuid": "9b148fcd-c2b7-450e-8084-c4efa1a13912", "comment": "Malware payload (Mirai)", "value": "ca9046b99b32c160d33d327f62305cc3ad6e37e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853569, "uuid": "76cfd1fc-add3-460f-b116-0e5ef6260441", "comment": "Malware payload (Mirai)", "value": "8c1a16550a69c20f94a4235c03b842fd1ae247c84b8bbb962a309babb6d3af22d1f0e3c206c11ec41441fb0edc52124b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853569, "uuid": "da4a34b6-7bd9-4b06-a68d-4df6ed9490b7", "value": "T1C6543A46EB414E13C4D627BAB6AF0245333397A4D3EBB206D9246FB4378775E4E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853569, "uuid": "4420bb60-b258-4809-bb12-773b454c4b89", "value": "6144:RoAv0m3XV9R5dJAsiKaq4DCcSZMTyFv13EaYmJV/GrlemI2Yl/s:SAjnlJAsiKaq4DCcSZ4oN33/ClemIdlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853569, "uuid": "8576f352-e204-4a3c-a750-52f4cde98e39", "value": 290833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853569, "uuid": "e223b6dc-518f-48fa-8012-151d2cda14a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853569, "uuid": "2ed7cf2a-1535-46cf-86e2-f65825ffd596", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895e14e3-6bf2-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1781882485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882485, "uuid": "ec8bcc6a-5112-43de-a2b5-81955d9082e8", "comment": "Malware payload (Hajime)", "value": "38a8db331942b2e325338ffda0e1c5da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882485, "uuid": "2836e12a-8b42-4350-86bb-c1e6fe4493e5", "comment": "Malware payload (Hajime)", "value": "6a0cd292bcea503fe899e65dceb6bfb9276be760168ea7b185626bd5929a1126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882485, "uuid": "5447a90a-2e36-44cb-967e-01968522861a", "comment": "Malware payload (Hajime)", "value": "04172486a6b01b0faa852def1440cac2c26ce637", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882485, "uuid": "a419dde8-3303-4d3b-934b-1605e8289b1c", "comment": "Malware payload (Hajime)", "value": "609f2e038a0d3e00485375059d7e1a19f86b7178036efa28cfc30057cc4b586b5e8299b8b04533f4119364d2f70520bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882485, "uuid": "028f0319-44e6-4160-bd79-b9f6bc70568a", "value": "T1FB831229135518E6D62585F193FD1B84AE581BA9CEE2EC147C12BC89EE333AD3CC2618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882485, "uuid": "0b6974c8-38fa-439f-a407-d2248e633a41", "value": "1536:yYI0ARqw1qIW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uBNu:yYI0ARqw1qIv7UIFM8oJorFquyjkRkpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882485, "uuid": "88c670a0-4a9e-4e03-ab50-24cc92cee13f", "value": 85232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882485, "uuid": "b38a9537-3a29-4e45-bb90-9a639ec1f762", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882485, "uuid": "e9b17a99-c742-4eb9-9fe9-04616e40bed1", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44752d1f-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882799, "uuid": "c7310aef-b9a7-4985-bbde-c963c3828d57", "comment": "Malware payload (Mirai)", "value": "d97ec52e999883cef9529031f096a65f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882799, "uuid": "3ef956f9-bb37-41e7-a378-79330575348b", "comment": "Malware payload (Mirai)", "value": "6a8f95e9ecebcd2d3fcae66a8ffcd45368cbc9740e9079072b4ae20e1465ecd5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882799, "uuid": "2b2b38a7-8111-4a45-9f42-8b2aed66250b", "comment": "Malware payload (Mirai)", "value": "1fd8795b7289a4561383cc9239fc5befbde0ff18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882799, "uuid": "51816687-dbeb-42c7-b28e-9350456fedb0", "comment": "Malware payload (Mirai)", "value": "216f4bc25a9befc43a386f0daf4a0fd3c199ea2992f5004c378c2e2462450fa608aabf1f1d82ad5c0fc0ca8e10550d18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882799, "uuid": "ba5ecaff-5646-4552-97e9-6709378c4986", "value": "T1E1257B2EF2B2F1BCE007C03417DFCAA15525B07926312DBB37C49A353E6ADA15359B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882799, "uuid": "5f80f960-3f4c-49c2-a6a9-ec2dc42911ed", "value": "12288:5ia3oAbeNgvzRNwGdoHtMLi+CSegujoS89uUbHlTILkayQgLonHX:5ia3oceNgv/Bly8kUbHl0eLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882799, "uuid": "7cfb79d6-a6c7-4623-9722-f37d4c76c92e", "value": 981512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882799, "uuid": "300faa8e-55e7-4ce9-9bde-35c7376ecc82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882799, "uuid": "aeb126e3-db90-450a-8eb1-5d3dc350d695", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332b566f-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781881052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881052, "uuid": "1d885046-c40a-441f-839e-2352549ab8c2", "comment": "Malware payload (Mirai)", "value": "bdfa3bbd366c1d4e351f5d313c6674f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881052, "uuid": "301b159f-5975-40e1-bc80-4af052532a5f", "comment": "Malware payload (Mirai)", "value": "6be1d75515cab42909768a3576126eebb09e68352835012516f39bfd1cbd375d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881052, "uuid": "9f90d089-f97c-4947-8c29-bc686c1853a3", "comment": "Malware payload (Mirai)", "value": "38b5450e6ea5e9b4f7f042d6f9d425d2308a1b3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881052, "uuid": "2a361eaa-288b-4d9f-b4ea-cbd63357f7f4", "comment": "Malware payload (Mirai)", "value": "3a60cb867d81e144bcc1502e1b264b5080c1d7fa15f3e140da9dde468130d713a3c8318bea887782b337d18e4010aa66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881052, "uuid": "f2f232f2-552d-434e-8c02-589da2b0a8a2", "value": "T152F3398ADDB11E9BC06FCE34063E835B19ED599BA2F1B366863CDD08355E24846F3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881052, "uuid": "e235e911-13e9-43fd-a081-106c660552cc", "value": "3072:V5LfEnFnHY3fpSXaEdMrv4eg32xrWDXOck8XQE41s4ebg9Axpkjksi5d6w:VFSY3xSqE6rDg32xrWDXLk/E41s4ek9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881052, "uuid": "d81a1a02-d5ff-4474-b3b0-1717277d0d04", "value": 166648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881052, "uuid": "78fe74c2-d426-4d80-ba49-587c841831ec", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881052, "uuid": "33757c33-457e-4a66-bb8a-d7b37fdc9525", "value": "monero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72a3339-6bcd-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781866751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781866751, "uuid": "79415890-4ed7-4faa-9735-eef49e371cbc", "comment": "Malware payload (Prometei)", "value": "7c83b3106ca7cdcfb03fd0d094c45619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781866751, "uuid": "2e683dbf-9b3a-4cc8-8fbf-1edc2ed1480e", "comment": "Malware payload (Prometei)", "value": "6e9fdf40571cb4737a4d729f31b0a1ceff9f91fbe7e8ef775e6a82d915e661fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781866751, "uuid": "54df10c0-3d59-4386-bbbd-cea823cb0b50", "comment": "Malware payload (Prometei)", "value": "7762ba97c3572c37ae61ed9e0d9e7776a76c614f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781866751, "uuid": "a0118672-7a84-42b5-b285-8b8ba5170206", "comment": "Malware payload (Prometei)", "value": "208da7b219abdfaeaeb1008f963c584fe139ca690e292131507726fb44f04521beae6d03aaf1cd03f09c81c4043a5211", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781866751, "uuid": "669fe25a-3cbb-4939-bab6-d11c00aacf2a", "value": "T1EF07AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781866751, "uuid": "f3bda538-80a4-4f8c-81da-4bc1468ff84d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQO:cqYUQuVDt0TZEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781866751, "uuid": "a4eb03b9-7814-4085-90a9-6b6d52f2539b", "value": 18055168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781866751, "uuid": "2c0e9714-eb6c-46dd-b1b2-44863c8022b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781866751, "uuid": "aa80e340-9fbb-4cb9-9f1e-ee2a2d2a17b9", "value": "6e9fdf40571cb4737a4d729f31b0a1ceff9f91fbe7e8ef775e6a82d915e661fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9056bd9-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913059, "uuid": "27b81161-d6bf-4f9f-9b2a-adcaaf1a5faf", "comment": "Malware payload (Mirai)", "value": "041b1b4023b8e78eb4a18f787e4e988b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913059, "uuid": "8c2672f3-25fe-42c2-b385-73f1e7bb01d6", "comment": "Malware payload (Mirai)", "value": "6ef5b978b002ff58d2612ae7ee43df4c044b13ce1396de07375f082d3ce5b75a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913059, "uuid": "b81c5651-594d-436f-8da4-6f9e2e5e1518", "comment": "Malware payload (Mirai)", "value": "af76b7321d54e1bb701f023988e18fc3653198c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913059, "uuid": "955c847d-1879-423f-aead-eaf2465dbe7d", "comment": "Malware payload (Mirai)", "value": "3f1f36012f143093604d61f8980a14ee1963a414a60cea45a2681111a301324f8817d0d52d10200d58d1f2d15ee71832", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913059, "uuid": "021300e5-7b48-4468-a65c-df74c6eb6576", "value": "T12E845B92F1A268FCDD52C931425D6123E63834594322ADFB27C8DB793D16AD0AF3EB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913059, "uuid": "21564147-756e-4210-8088-616d68a7fb3c", "value": "6144:j3VR1jAf7GexZKp86/p/UKFkzbSHPZPyU8bJDIsNk8LO0Jt2hDdo3jlh6:jFDADNZp6/p/7WPoQZf7LO0vW+hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913059, "uuid": "b7b9f3b6-6bb5-448e-9967-e1641711fff4", "value": 397696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913059, "uuid": "600ae9f3-6a02-4a24-93f6-0afabb1fb920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913059, "uuid": "581e857e-af39-4df4-a9c8-c694394f1edf", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b679570-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883616, "uuid": "7e707567-f492-4c37-8d5b-715e8351ceb9", "comment": "Malware payload (Mirai)", "value": "cf42c9c0f9db2a68471731c6653fda91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883616, "uuid": "5d31a05a-a399-4916-8b4d-7525e092b20e", "comment": "Malware payload (Mirai)", "value": "6f55ef2c93b5c5b1f773b9e6a1e1f34394ae86a00eb62d27f79b5a630aba47cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883616, "uuid": "9a6c692e-e272-47fa-8218-052d16190a21", "comment": "Malware payload (Mirai)", "value": "0a4089305a8193065cb9f147fd036ca2b08ee2fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883616, "uuid": "99b0e701-7e70-4a79-8cb6-bc29d918c143", "comment": "Malware payload (Mirai)", "value": "99731efff1c46024e997b24aad26f9e597139c56ce4d0968ee25de1448b5a2e54187410acaa9ca4f749f974a5adea9e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883616, "uuid": "60a972d9-9b2f-4add-9317-af85843191a4", "value": "T1DCA33A45F283D4F0DA4219B0012BF77A9A30D9355561DE2FFB98FFBEAD22612540A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883616, "uuid": "66064569-038f-48ca-8918-692bc80d6c3a", "value": "1536:pvPnNPe5btv8gB3mogAIz8hYhNhthzhy0hgZhLAyRGjuOZDrao9ympUS318YppND:KD7ricNHEjuOZPz+2Nl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883616, "uuid": "b8ee2185-a339-4b85-8ea2-93b5b1681e07", "value": 103796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883616, "uuid": "2e9e267e-c0cb-4556-a3be-3de37ec0ee95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883616, "uuid": "74db9529-8cc7-4e70-a367-50b25a4ad385", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254c806d-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781883606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883606, "uuid": "cb1a5e28-7890-46a2-9ea2-376afba10c32", "comment": "Malware payload (Gafgyt)", "value": "b0f399914bf9aca8de5493b9dd91c2cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883606, "uuid": "31d954d9-4b11-4f03-bf3c-1aa0890bfd69", "comment": "Malware payload (Gafgyt)", "value": "6fff3a9e3e836e0cebec2f14a9255bc5795bb25e22e9c9a861c11a089719b727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883606, "uuid": "a512b75c-6ac8-44c3-b951-bc0193889e98", "comment": "Malware payload (Gafgyt)", "value": "9cb40d2f87cf8a2516b269e2beb7482bb7243bd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883606, "uuid": "a3a599c9-f1f7-471f-aa60-fd9bd263349b", "comment": "Malware payload (Gafgyt)", "value": "a2dcc2dfd4c2f774892479908b411b8ad54a2b07fd890c94b36dba3f2b0e667601052dce7247cc2f219c3949756dabf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883606, "uuid": "5afe8be9-c740-4aa4-8798-9141af855f0d", "value": "T188E3D70E7E318F7EF769C2344BB34A30969923D716E1C685E1BCE7091E1424E685FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883606, "uuid": "133b90e6-4105-4955-b095-09556928c5bd", "value": "3072:trxwJXqtmCWzd753pUgTKmLB+dWeqnVlyTQ4Ii9ZnFEO:tVcXJznpUgTKmLBIRc0Q41FEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883606, "uuid": "ce95735b-b5de-43b1-a1d6-297458e39c2e", "value": 145572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883606, "uuid": "24ef8ee3-2022-4b7e-8b80-1ff011de4dc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883606, "uuid": "00fe4d7b-5268-42eb-ad18-2e3ff0e4564f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a201ae1-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "49d68f67-98b8-446f-be44-b992f7ffbae1", "comment": "Malware payload (Mirai)", "value": "6d3eba3081f1fcb06dd21c881be12d20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "d8096da1-bc90-4b73-99b2-fa90ab9c90a5", "comment": "Malware payload (Mirai)", "value": "70a61ded8cab0b885494f48e7f6cc9ee71b4017bbd38ad355785ec4225101448", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "65d7736e-fe52-44a1-bbdc-f99b6e35e5ad", "comment": "Malware payload (Mirai)", "value": "41c8d28c3f6cb7001934d96b17d06aac641390b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "97a65f4e-4d4a-4165-a4fc-20187351e60a", "comment": "Malware payload (Mirai)", "value": "4044a6a1a409bb7fdb34ead3f4f03dad5008cd35b375bc63c9e25d130c5c185de9ef786f8c1e4adb0856427aee93f484", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875910, "uuid": "6c0b8e4d-f10a-4224-9493-6f53a2953be0", "value": "T1C5931AC3B800EABDF81FD7FB41630909B63192660E530A37B757F9A79CB7095542AE84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875910, "uuid": "adb1dbc6-0100-4eeb-9039-f054ae2ced92", "value": "1536:Xu5IIgDKe05FXrFHFjpM4DKGCsyXTKXzMO51C8c4d2cHOI5e2glTHdJSFkImshmH:e5ewhjpM4DKGChozMO51LdUIg2gukImp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875910, "uuid": "85feb24a-cced-47ee-9a96-a8ad55180636", "value": 90204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875910, "uuid": "b9afeef4-5d51-478c-b706-2063e14ae945", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875910, "uuid": "fe1f0cb3-6df2-417d-bb24-f30d60263ec8", "value": "tdhyctkjq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ed5b46-6beb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781879614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879614, "uuid": "52bc7398-01a9-4f96-868b-ebab03bfc158", "comment": "Malware payload", "value": "8486020cb04f4cadeef6a6e0db264e66", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879614, "uuid": "bd2f9f64-83b3-4664-9a60-e5db9d564445", "comment": "Malware payload", "value": "71c79c58dc14cf56ff1c7c4dea1894b4b4d9794a84abb0cc65168a99c0429c69", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879614, "uuid": "d698b91d-5a57-461c-8f2e-6c2a50519f7c", "comment": "Malware payload", "value": "95281ede663c46fdbad5162a6622c44ab3434c36", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879614, "uuid": "f65b63b9-7cf1-4c73-8c3c-34412654bb4d", "comment": "Malware payload", "value": "f7fdfa54887e27e449c0bb7b7353a71111aea577e9f7a10dcc35ef39056d8c80abc02b9413681c0f50d6259b5c0463f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879614, "uuid": "50ea72c9-2725-4b9a-9841-b9373790b9e5", "value": "T10525ECB07A7BE0147537CA7D2A6A686687B7EAF13CC83770635301831E6D60878B2D75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879614, "uuid": "bf94623c-7af3-46dc-ac9c-e1c44b11e031", "value": "768:LDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDsDDDDDDDDDDDDDDDDDDDDDDDDz:t5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879614, "uuid": "1969b8fc-efbf-4727-bd1c-bddc91ba303e", "value": 1031536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879614, "uuid": "40c523c1-b92e-470a-bde5-04bed6781826", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879614, "uuid": "2e8c14c7-befe-46ae-9f4c-96663ebf663f", "value": "sostener1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4490dcdd-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882799, "uuid": "d0588e71-858e-4879-be54-88e05ab12811", "comment": "Malware payload (Mirai)", "value": "b9289b0fea33c75c0e25672b9dde785d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882799, "uuid": "bcd51fb9-0c42-48a8-b38d-e81534a4a4e0", "comment": "Malware payload (Mirai)", "value": "727260debe1aeb8a1dfa26ae48851d482ef1d237e46a48416a1c615df59960fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882799, "uuid": "2412e7b0-da5f-438c-b130-a595d53ace06", "comment": "Malware payload (Mirai)", "value": "4a07f0c1aed661deaed5076ca9042039fd282308", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882799, "uuid": "669192cd-3c3d-4877-832d-58ffbb3b0a8f", "comment": "Malware payload (Mirai)", "value": "1610ae5b11db18ae83fd0de9927f9eb226b8348774796320baa486ffc43c0f8a9c41482acb074ebec1aaa09443de9174", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882799, "uuid": "6a5210d3-d15e-48da-aaa3-63d00bb71ab0", "value": "T1A0733B81F94B80F1D847487090BBF33FCE31D6954175D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882799, "uuid": "3e44a317-3b1a-4fe3-890f-01fe81f6731a", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AH0:uVFrPNQn+WVQ3EXVUk29jgxO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882799, "uuid": "d5cd0841-3a01-42e1-90fe-73adbad28601", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882799, "uuid": "e814a6a5-9c09-4ef4-9c2f-3e7276255317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882799, "uuid": "eace27a0-d3c5-4fa8-a8e9-a0e67fdcab10", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b80882-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781876008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876008, "uuid": "2a1f4d76-3d07-41d7-b94d-135e3e47b9e5", "comment": "Malware payload (Mirai)", "value": "262d7670ad52da4f7d27f47b482e6a81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876008, "uuid": "4a06a4a1-4cdb-4a90-a1f2-3208226a478d", "comment": "Malware payload (Mirai)", "value": "72a84783477cb70424917cd9720c50d6fd776ecabb3c7c4c70f96920acddd383", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876008, "uuid": "22b1618b-1fe7-41b7-8649-e110af9dd334", "comment": "Malware payload (Mirai)", "value": "ce45b4458ac912a8444763e65a626870faed7662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876008, "uuid": "5c8d1dd7-f5e7-46bc-8d67-e05015236beb", "comment": "Malware payload (Mirai)", "value": "5ed34ae9291138629e665885e4dde789445fbdfbace0198cef544987a6fed4c935cd9d711c4aaa4d2b27f61599d49a39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876008, "uuid": "8ddb9aac-890b-4586-9c43-5707f1949a14", "value": "T127836C02734C0D43C27B1DF53B3F23E6D7AB85D122A4F6496A0FA9468271973169AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876008, "uuid": "ebb8c49f-c221-4f8a-9c52-ed64a9e0de17", "value": "1536:2e+D2qAotSPNYXGlnP9KTwxKAjcbKEGymioM7KYvVmmHiw8d:2e+D2qAotSiX2nPWvpm3MfS/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876008, "uuid": "51d75fbb-4d57-4be5-9120-668529a2a715", "value": 83508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876008, "uuid": "838cd065-68c1-4468-b094-0e61866b921a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876008, "uuid": "b462b435-b576-4a54-b1aa-051bdc6f0ff7", "value": "zlkbnkpmc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baacb5aa-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913062, "uuid": "470d7610-241c-4f99-845d-bfe51780d3fb", "comment": "Malware payload (Mirai)", "value": "d2fb8ef4e512f504cf94b9657cdae3e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913062, "uuid": "02404bd5-bd61-430f-8c5d-e2e4eebd44a3", "comment": "Malware payload (Mirai)", "value": "742e57549e29600b68401ec1527c43033714ced05d67bf85a45205b15615edda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913062, "uuid": "a83ccac3-52b7-42c0-8125-adb108b7c277", "comment": "Malware payload (Mirai)", "value": "e158a82de02677ceb6703c8a05a72505f8cc21b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913062, "uuid": "43d16914-985d-4b69-82a6-532c48fbf918", "comment": "Malware payload (Mirai)", "value": "eee4bdc524b04526190a9a2d4730cb9e0cb7f6d622c819cd304787a0e5bcdc2f105e87600f9e31497ba5e8a5190cf6a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913062, "uuid": "79fcdb63-878e-4657-a79d-cd31783a9960", "value": "T163143C53B7224FA0D315D67207B38B6A5AEB11C21EE248D5936CCB143A24BE9185FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913062, "uuid": "8dd1c3a3-761a-4886-b696-eeaa3ae7dc68", "value": "3072:icANdWG+l1H48jKr3qHz8NmgPPDeU4ZbjztNSKCkfoCQdmpzM3:WY/t43qHqm8De5ZxPCkNQdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913062, "uuid": "4a9ecfdb-204c-4c04-b402-9abc72d8bfa1", "value": 208972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913062, "uuid": "0c43e30c-cd56-4691-bfa4-f345cbf60e08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913062, "uuid": "51047238-05e9-4360-91d0-f04ba2deac4d", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5317651-6ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849568, "uuid": "8de43ed5-e730-4a44-91e8-1e07641288b2", "comment": "Malware payload (Mirai)", "value": "968cf01a5b6fbecab103c6ee92a5259a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849568, "uuid": "7ac1d129-81c1-456d-ba36-fedcc065a0ed", "comment": "Malware payload (Mirai)", "value": "753de6436a4d52a88f530a4244b40d9caa9f5fcb5c40a35591549b14b7b42ccd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849568, "uuid": "f37cb387-a006-48bc-bfa1-a34600469633", "comment": "Malware payload (Mirai)", "value": "233c879c295f1d08c9a341784fd2c22f364ae443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849568, "uuid": "942649a7-2ed2-42b8-afe8-1a3dac540698", "comment": "Malware payload (Mirai)", "value": "a78864b4e779076cc60f5f5746cac8491fcfb356198e5301d65fb0d802aeff5eb94d0964de9e75729155a68bb9395540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849568, "uuid": "a5ae3ed8-d464-4443-a5c7-2da74ad78fcb", "value": "T1D0B3E84E6F319F7DFBA8C23447B39A21975823D227E2C685D19CDA011E7038E645FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849568, "uuid": "3b83b9a2-0a71-4e8d-9416-755ed3ca1263", "value": "1536:qEg8LiZcCcpHOWWJDjpnBoQaOjLr1zPtoq0OUDiIwSDDkEWre3Xe5myLICd:Y4ix0pot5zVoq0IIwSDgEWaPyLICd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849568, "uuid": "30b9e258-608d-426b-a276-769bf68881ae", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849568, "uuid": "5aa4c7ad-7776-4983-ae65-24dc6d83a1f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849568, "uuid": "df5310a3-a269-46be-8c72-58b966290051", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910ae0c1-6bd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781869184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781869184, "uuid": "0d1a150b-0ccd-4f1b-b14b-f2fccfd316b4", "comment": "Malware payload (Mirai)", "value": "904f2aafbe91641c0439c715a3cbef0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781869184, "uuid": "85fb687e-1d1c-46c8-9ca5-a44c0a11f200", "comment": "Malware payload (Mirai)", "value": "76226087850f97fe183df4ce812595287c502f07787476000ad485bd7f4b1028", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781869184, "uuid": "5bf4f9ca-9ea0-4861-bd9b-a807a899bf31", "comment": "Malware payload (Mirai)", "value": "e136c521ca02862e7b88c65eebd547f91b42edf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781869184, "uuid": "87ef3fc6-1fd7-4fc6-bbc7-5cd06b78d5e6", "comment": "Malware payload (Mirai)", "value": "116d3394ab0503a669ebed98f9f6f73a395a617d20b5eb3fdd082daf57d712fe122591276b9910e2c2fd3c7c3ce7fe98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781869184, "uuid": "fa04453b-00ec-496e-b8f1-1a8ffadeeb1f", "value": "T160B30999F890CF61C6D1267AFB5E528C33130B78D3DA31068E159F3467EB95B0E3A912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781869184, "uuid": "18ff7fb4-2156-4417-958b-7c0dc4e0fdb8", "value": "3072:oSQHtwe8TKh4uOM14+y8YqXfPxjPL5DKMXK+O7:oSYBuRP+yR0fVPNS+O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781869184, "uuid": "0d5ea448-9c5c-4ccb-ad83-56ab1bff768f", "value": 107760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781869184, "uuid": "dd15b344-a7ab-478f-b672-6a60c8644394", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781869184, "uuid": "728687d8-0a63-4b68-815d-4580c0a42816", "value": "nshkarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f52c77f-6bf8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781884911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781884911, "uuid": "7abb3706-1414-4790-9671-30db77a7202e", "comment": "Malware payload", "value": "66125202e04f15c387d098b9b0116b01", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781884911, "uuid": "182860fb-944a-45d7-b4b5-60aa2f101558", "comment": "Malware payload", "value": "7653ccfe8fddfd8562f5236c673d15fc355033f186ca1e1ea736c8c5bf1ac02d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781884911, "uuid": "6ead0831-a2b6-4cf1-9d67-3b145f27f569", "comment": "Malware payload", "value": "6db97e9998d32c22d5561c7eecc6fafdaef5763c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781884911, "uuid": "14809485-d3e9-4cb9-9709-e3ebc83134dd", "comment": "Malware payload", "value": "a146fd1830ef0cbb974e6f6f740e12bd4452fe786aced52f07862c3405b59779f5bf304c73585a3dc5e48696bd588126", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781884911, "uuid": "95d7fea1-6ddc-4bbd-a918-08281930b9bb", "value": "T16EC312192FB45423E478AF335B15E70C10D38D5A98E7F1C658D26F8650BF7A80723AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781884911, "uuid": "a76d25e2-fa81-4f59-ab03-9f3d77cc10ed", "value": "3072:iI/SZwfaL+emvWNIGXZf0uMsxAz4vHs9xWWvDzeeOM:iIKCf1lWfpNbAz4vHsu6DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781884911, "uuid": "6f7a7f7f-f215-47d6-9f85-f767c33e45ce", "value": 126426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781884911, "uuid": "e4056543-2003-42e1-ac06-18b30aa060b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781884911, "uuid": "e93695f8-072b-49a8-b300-5c61cf8a3aa9", "value": "Radium-Client-1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de00bbfb-6c11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781895942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895942, "uuid": "8f200d50-dd7f-4b49-84a8-c3d983e9b748", "comment": "Malware payload (Mirai)", "value": "74f04e0fa2e40c727908da0a13ccaf17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895942, "uuid": "85e99712-ddef-4ecf-862b-430c8619bd2c", "comment": "Malware payload (Mirai)", "value": "76e12dbc2b7221386ed324989f50cd5bb15827a4159e7652d68124107c8d44d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895942, "uuid": "3095c81a-8daf-4b07-9a5d-0c2049728a34", "comment": "Malware payload (Mirai)", "value": "34270b54e5bfebfe11b0febd4c961c9fc3dbf75c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895942, "uuid": "07a0944a-64d8-4735-a50f-3ad5b844f3df", "comment": "Malware payload (Mirai)", "value": "eddfb41c5ea93606645d23e1d1427380c1b9bf469013d164e0bbae026e6d001ac74ac958f6396c4a63a12ddc10b8a664", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781895942, "uuid": "534bcef1-feaf-4d90-889b-badd56b6727a", "value": "T1DB23E1312E5A3B839DF006B0D0B7E4A759854FD8F66D376921B2129CA18174E8BE56CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781895942, "uuid": "3cceb9b5-f294-4f83-be7b-316d00ae97f5", "value": "768:HKgKQjIH13JToFvP2VOyzaTlMc+Yj2zYns3pccOQs3Uoz3:qgU130OVNO1xqYayFz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781895942, "uuid": "0eacd1b3-549b-42cd-a303-79443dcb16e5", "value": 46636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781895942, "uuid": "2633b811-28a4-4c8e-af41-a4f37a141799", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781895942, "uuid": "b466b90b-7d16-455f-b6af-1504763c256e", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9819f0-6bbe-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1781860346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860346, "uuid": "f64634be-2530-49d2-a1ed-c1a8c4b391f2", "comment": "Malware payload (BlankGrabber)", "value": "9fc9747ca7ec01a45634a66c86b8cb2d", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860346, "uuid": "4123bd8d-d66e-482f-8a95-bbdabd00146b", "comment": "Malware payload (BlankGrabber)", "value": "772f1769d905a367dfed2bf65d8450af2a4f96e65a3b27493d84e46405708232", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860346, "uuid": "54501dd5-8768-4a51-bdca-8d860133e1c2", "comment": "Malware payload (BlankGrabber)", "value": "3cac2abd2ccafe4e74128915ded3d23aeb9850ae", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860346, "uuid": "150c3061-3854-4930-931e-6fffdef63c6f", "comment": "Malware payload (BlankGrabber)", "value": "edd3fea6a4e9dfc098362b57902c3bbd752ef99c79bc84907794f6902859e023eeb126004240080208a36ec643a886de", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860346, "uuid": "ae24f84b-afea-449e-b545-aef4391f452b", "value": "T103763394A76802EAF5F7E33CD902C412B731F5398360DAE75390822A2F17AD15E7BB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860346, "uuid": "6539ab5b-bcf8-4dee-b050-eb359b84d366", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860346, "uuid": "118e11d8-1cf9-485e-94c2-b0f79f28f824", "value": "196608:pV16vV2B6ylnlPzf+JiJCsmFMvYn625RXyq3:E2BRlnlPSa7mmvYZdyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781860346, "uuid": "ff4b998c-4042-491e-aa07-ce568e435a51", "value": 7184802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781860346, "uuid": "62a1c4b2-b72f-4bdd-b8c2-aad0eb73e0d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860346, "uuid": "3229cf52-869a-411b-9f79-da5d427406ec", "value": "valorantcheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc52305-6ba5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781849264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849264, "uuid": "434853a8-e078-4bbc-96f6-2c3a707942dd", "comment": "Malware payload", "value": "6297e8dfadf721d9444f2093efb71f96", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849264, "uuid": "55e776d5-fafd-46fd-a33b-b90d57cbe1e8", "comment": "Malware payload", "value": "78127093434c0fa650f7e30dade843ddb3f9d0baa7742cf4b31f58e2472dbb16", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849264, "uuid": "4dec30c8-a7fc-4077-b9ce-c618f141de77", "comment": "Malware payload", "value": "d59b25dd0d1e6f0be2ddd78a28d7c4fd612607f8", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849264, "uuid": "b9622e70-65b9-4152-9deb-633a9a7e1bf3", "comment": "Malware payload", "value": "ad6d85b1ca70625e66c17443cb65ae02d2d4b2c17bc9bcbe06d6cc7437d818101b114f5af08ebaaea79b07a8962feb46", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849264, "uuid": "29074980-fb45-4201-bde7-e22895b49bd6", "value": "T1B1A7332D6943FF0ACDA2E7735A8C82645EEE67DB2468126732C43F4B7464871FC93819", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849264, "uuid": "5fa981b9-b1c2-4a66-9cba-de5a14ce81f0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849264, "uuid": "d99ef398-f96d-42d4-9431-76a70a2318df", "value": "786432:gYI29zwVmFZhkOkSlhQ6q0j84c6+PExalKwMLs6Z8OAYfxjYEziw0j4C+mW:gYI4riOXnI45+wa1MLzmiptq4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849264, "uuid": "feb1ed71-a3da-483c-b5df-60e60b6265cd", "value": 44012784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849264, "uuid": "06cb892e-04ff-43a9-aa10-77b326847da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849264, "uuid": "291f764b-15d8-41e7-88f1-7f0e65fa3ec5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd05fba-6bbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781858894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781858894, "uuid": "8f96606b-5f11-4b36-ad2c-a4597f0deb22", "comment": "Malware payload (Mirai)", "value": "ad5c7a4e7c6df134a80d347f2569502f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781858894, "uuid": "43ace22f-c77f-4c4c-b8fb-3f985b9967a2", "comment": "Malware payload (Mirai)", "value": "782af3bb679994dba4a19ca22b657ff7248201a3fdb23b28b12adff796953289", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781858894, "uuid": "82c38695-6b25-4373-8d8a-a1ac01ace0c7", "comment": "Malware payload (Mirai)", "value": "57ed72fa1cddfac6d17ba3174d59ada2b56f5b75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781858894, "uuid": "c698b297-a1a0-4094-8f36-c3433b8560ca", "comment": "Malware payload (Mirai)", "value": "0c5cbe81ff40696a4b7c2043948f6146097b7c4afce2e439f526ac39cf631f6b3565db14add6e5bbff342a436ad681a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781858894, "uuid": "53db4d26-3ceb-49fd-ba78-2a61c7b0600d", "value": "T13F649433991584A1E0214CB2226777459C47C7BF88E726D3EE5A5DB0FF3141B92BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781858894, "uuid": "a04eedaf-eafe-49b1-8bc8-dea950768e2e", "value": "3072:hIxGusFUJJoYC548SVOW+1KwjoSKsVJSF45B:hIxqcJo54CAwjotm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781858894, "uuid": "e5f8be2d-7cc4-4c4f-bc94-1dfdd62807b7", "value": 326206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781858894, "uuid": "973ce6da-597d-4aae-b76e-49ed9c94f75a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781858894, "uuid": "f94f375f-b906-45b4-8b10-6e043a212547", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a48beb-6bee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781880865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880865, "uuid": "b93a0dcd-2032-4b9c-9862-7eae397a2b77", "comment": "Malware payload (Mirai)", "value": "be572a7988d1788af2dda843f2891149", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880865, "uuid": "96f67450-1f74-4a12-845a-3a8ad8cb7ec5", "comment": "Malware payload (Mirai)", "value": "79cb59f0c2e43c71173b3affdd033f9ddc1a18981168b47fde4b3d5cedd54913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880865, "uuid": "0b7004d4-c851-4020-97d7-67e8a90a2fbc", "comment": "Malware payload (Mirai)", "value": "17fbd449f836c8d4f0a5174de19c3bf57a4feff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880865, "uuid": "78e9b581-d2b9-43bc-8702-1dd2bb0933be", "comment": "Malware payload (Mirai)", "value": "8ff3dbc320068fc31aaf9aaf0ea84aa06d9df019eab658dfd380b2e052f52b5c3ab9eab11e4ac9adf8fe42e86e0cf9b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880865, "uuid": "19071092-8940-48b5-a31b-61fc7b39d876", "value": "T10A737CCAFA83E0F6FD8315B1657BAB325372D0395055EE82D32E5836EC52810971B3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880865, "uuid": "fbea715c-e16c-4bfc-b05c-7b8bc4950424", "value": "768:wTyW9duQxqe8CTY5MhzYoFY/u58/T8P4nBSC5fMVr80/8tcF8g9DXdSjj1FzIdnM:wFhiyh/FY/uCbl2HM52pSD37ZJgxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880865, "uuid": "42c832fa-3426-45b5-9e6d-561f5c619956", "value": 80264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880865, "uuid": "734db6bd-8d2f-490d-beba-0c5ed8b8fe31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880865, "uuid": "86fd50f3-95c4-4718-8878-063dfa2737e9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1384c79-6bfe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781887786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887786, "uuid": "00c255b1-aded-4e81-acd9-7771ba9a2aaa", "comment": "Malware payload", "value": "cd0e4b780aed14240fb43883a4dff0a0", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887786, "uuid": "4a8e9409-4702-4b94-bc27-b74bcd64067c", "comment": "Malware payload", "value": "79f490b5b77b744532dfb6fd2fcc2ee13968c980066ae9c291476b3881c4a5ab", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887786, "uuid": "cb323ca4-cb58-4927-bcb7-8f6b15e249d6", "comment": "Malware payload", "value": "0b76a2d6cf96ad30e2b10b64336384d846e9076e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887786, "uuid": "84e3e60d-3a04-449c-bf3f-572b3a621b19", "comment": "Malware payload", "value": "f338c3ae9858687f84bb65ffb501776c9be3740498d50a40510877b551b3a4d18749f7455412f126b142d2a62d8cebda", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887786, "uuid": "a8808838-5398-4522-a7d4-ac755e4b5a94", "value": "T19F11BD188FC71315FAB78939997E2305A93AB805FE635E1D4190858818FA700B925F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887786, "uuid": "a136de98-d922-404d-a9e2-1e1685ab379e", "value": "12:8AlXEY0m/3BVSXzZUllGW+fnGUA5XkypfJjcMgTCI/JUl5OBUiNMI0Y23Kyt+8j:8AtJ/ByUl1+fnGVfJAMDuUKHYVKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781887786, "uuid": "ced7a874-4a4f-48c2-9ac1-a30695b58cf5", "value": 1036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781887786, "uuid": "82657868-de5a-4b7c-94a5-f9da52a3dd70", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887786, "uuid": "1ee511f6-5bc2-4ff5-8e61-ad16155aa1ff", "value": "Laudef.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc229949-6bbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781859002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859002, "uuid": "8e11d27c-fcce-4525-988a-d458b7f3a3a7", "comment": "Malware payload (Mirai)", "value": "2f27c0bcb3baf06a5b3597d74665b4d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859002, "uuid": "b2ff89ca-0633-4388-9631-902054b8a4e2", "comment": "Malware payload (Mirai)", "value": "7b1e4ef53d3b45fb4e2981e652a7c6ebfb7e62de0630ddaaa2929b4418a02149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859002, "uuid": "4fb0362e-bafa-43f7-8ada-978b5e03462a", "comment": "Malware payload (Mirai)", "value": "8e7eb28d16a301902e80cb478486660f93217992", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859002, "uuid": "bb01d203-2814-40c7-880f-f1c7a7cb985c", "comment": "Malware payload (Mirai)", "value": "b544cb51598b1c902b08efdd0945ab5c3670356276d8e8dd97edc2c6dc9ccbdae98103a6d49c94e85fd4b3de670c4980", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859002, "uuid": "226295ef-307b-4ffd-9746-363d2465fa1a", "value": "T1D684643399254DA7E4158CB3126732415C4E97BB84EA27E3FA668954FF2680F41FBEC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859002, "uuid": "8f4bb97c-2c09-4689-b986-12c8a0335444", "value": "3072:G+p48mI5vVaVMrUtmVKwjoCJZgnQUmr0h+afjUHJMNb:G+psM4YgwjoWZgQUmr0h+afjUHJMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781859002, "uuid": "bc86c62f-9897-4192-b7af-99c3279f58ea", "value": 386961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781859002, "uuid": "cc4b0197-0e35-48ad-941e-a4a5b3887bbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859002, "uuid": "d20e7918-825a-4788-904a-6c354f87d331", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc4991d-6ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849393, "uuid": "0c7c0dfd-1ade-461d-b196-1ad24d232e6b", "comment": "Malware payload (Mirai)", "value": "de13a8a7f3fb23b3efe49bc853229c30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849393, "uuid": "de0e897b-b352-45dc-b5c6-94d89583d029", "comment": "Malware payload (Mirai)", "value": "7b81b5ac951a02eefd5e0e401aabc2bb463365ed69dbd862c719bcb28646b33e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849393, "uuid": "ea1eae47-3394-47ec-bedb-a41c98e857cb", "comment": "Malware payload (Mirai)", "value": "330223089506777928192c9ece3b843dc90b0140", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849393, "uuid": "7bd57f14-c62a-4ea3-a47d-2c8600ae5f51", "comment": "Malware payload (Mirai)", "value": "9e447221f526545377cb63af1c217de094acaaecc51fdbdc764241f186f4ceee9f3efaa1149863f8ed8b52c49779e593", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849393, "uuid": "caba0e93-e499-4a4c-b8d7-a74851516dfc", "value": "T19A13013126017EA5C564EC3CAF39C54553E50FB4E0EEBF3A2B494A5073E5D2123BC299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849393, "uuid": "806f0963-fb1e-46ee-a8b0-b59a20bfa589", "value": "768:rw6lTQWQ97oJpm68luHy7T7+9AtU+jToXIygamC43yIIRZOs3Uozb:1+WQ97Sm68luHyr+9AtUATpldCbPzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849393, "uuid": "f58040db-e0b3-4497-a826-77833f4e051a", "value": 41660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849393, "uuid": "26966ceb-36d1-456b-80f0-17243421e23e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849393, "uuid": "876cb276-f512-44ad-8086-13b9a8589bff", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca84244-6b8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781839299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839299, "uuid": "8ae06392-7d17-48a2-8078-bedf6b284e7f", "comment": "Malware payload (Mirai)", "value": "0d83d7d367dc497550a25fa2a57ff3a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839299, "uuid": "4926edf3-0651-42c1-854a-03a43eb90d0c", "comment": "Malware payload (Mirai)", "value": "7bec2a9b2d5a482b0468be31546c6ce33e875d93fecea2afaa2b9e4d46902444", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839299, "uuid": "27c65668-4110-4fbb-9aca-27de81e1d628", "comment": "Malware payload (Mirai)", "value": "01c2795ea6fc68fdc0c9ff1202f3a21b1563d61c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839299, "uuid": "8773d17f-65b8-445d-bf41-b694cd21fc6b", "comment": "Malware payload (Mirai)", "value": "4e9b77d742b441f86959acfbcb7612b38deb4ccc0c3d949c8f6299b61a7d8e460750cb4b35a9e46fa85e10b03c6143b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839299, "uuid": "e312d02f-8eeb-4615-842b-ff4282e5d51e", "value": "T145830220B71436B589B52D73DB2D749536C6937083AB8C6ED1166C8C12C0E8F98AC7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839299, "uuid": "c125ec9e-556e-4d4b-86ba-31f4d6914638", "value": "1536:p/XZiEVAqr8BgHGgyVvZOB9NiPjNm/4F87mTB0Pe5GZdZP+7ZLu:Bp6qrZHt/ViPxld02M/mtLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781839299, "uuid": "447a67b3-cc68-4a2f-80c3-f4a13b301e63", "value": 85472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781839299, "uuid": "06580cda-af1b-495f-bdb9-7bc0e460759e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839299, "uuid": "12ff25e9-ff31-4cba-95b7-24a83b7e529d", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28562456-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883611, "uuid": "6cd3f755-c027-4519-84ac-f1ec2982f777", "comment": "Malware payload (Mirai)", "value": "13aff6495abb979dd981498e60c3d86c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883611, "uuid": "51572594-9918-40a3-8f93-ffb2f8cf522b", "comment": "Malware payload (Mirai)", "value": "7c04d762bfb2322a5e4c6ca8c238a7209aae00217a7242077224c668c39f3f25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883611, "uuid": "05b89273-68b0-4be8-aa6e-04c11c7734cd", "comment": "Malware payload (Mirai)", "value": "b6f90abffa9b02b20b95eefbf0ea8b7d06f84d94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883611, "uuid": "ea7b1e45-7b22-4871-9863-9acb4f85eb89", "comment": "Malware payload (Mirai)", "value": "2dfc7bdb8cb7c8ec6006ce7328f3f2419751d2eb179703ec13a95d9570bc439325bb702df35d363f5b4eaf2233278d23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883611, "uuid": "88075c47-21b7-4f47-9135-baaebe81fc50", "value": "T1B2B32B46BC92C616C6C761B6FB5E828C331617E8D3DB3203E9256B7C378751A0E7B584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883611, "uuid": "c78d8062-6f62-4917-a913-34d88b806575", "value": "3072:FFop+AA3b6LQrA+568PWOsQi/WKukdNafMvlnR3lE:76Ll+56knsQiuKukd0kvRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883611, "uuid": "aa493425-7c81-480e-9172-fef6be60a622", "value": 108596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883611, "uuid": "dd29dde6-ff2b-4d48-91b6-d1bc9a541714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883611, "uuid": "0fe72e83-d085-4716-96f0-49d99fe6360d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469a6746-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781882803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "a3291012-bcd0-4da5-9bb7-f9b6bdb151b5", "comment": "Malware payload", "value": "49798b441b57c7727c557a37b255be49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "f0052569-11dd-40ee-be2f-e4c3e71f91dd", "comment": "Malware payload", "value": "7c2e806cf61299e07ecff6b2d8dbdbc07b8d7e3b00518d1ebb869db3b3668382", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "6de39897-e09b-4d5f-b06a-e7413958ea63", "comment": "Malware payload", "value": "b8c579feb717639569b225370449947c31d2fb8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "252ecf4f-643e-43b6-9d23-d92a86b99fee", "comment": "Malware payload", "value": "2a8d795f3fb6c27234c6a99c545caf6f101b0c28160f7905d4299c77f2df3214a26eef35afd772b5cbd0d1eeb669952d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882803, "uuid": "cb7c27b2-e2e2-47cc-833e-cdaa3fd6196f", "value": "T135D08081C152D143C47C8D3575441F6E1B34C12740501F6663D56FC8CCEA5540F31F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882803, "uuid": "b20c40ab-2b9a-4746-9926-71c8e7349cf0", "value": "3:Bkkk/tMlwXll/O/slrCs4X1lFrSwfOEUmsM8IPNioOHyUvwGcVhVflgLfE2:Btk/tMl//E2s4CEULKQXSEwhVDlOfE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882803, "uuid": "6c2649db-39b9-47c0-b07b-06f2c4018332", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882803, "uuid": "c8d4155a-9a41-4ab2-a47c-45541da03f61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882803, "uuid": "56717827-7cf7-41d1-b370-3f5a93348ff7", "value": "I53KfWiXe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bdeec1-6ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849512, "uuid": "fe150a5e-d865-4a32-9bcc-36891cc7d209", "comment": "Malware payload (Mirai)", "value": "513609176c49eb51c83c050e21bc2bd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849512, "uuid": "a9c94792-5dd6-4d08-b6e7-82af699fd820", "comment": "Malware payload (Mirai)", "value": "7c665140eb8f5e9b4bf20c71204b7fd104ebcd29046b45c02b570d6dd0ad39dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849512, "uuid": "3a139a99-b5fe-455a-b154-173bba86f3d7", "comment": "Malware payload (Mirai)", "value": "db8e478eb8a683f79e5147ea250ecc6a21bb196d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849512, "uuid": "d58ab1ee-7f69-4fab-bbcb-fa5d66e9c43e", "comment": "Malware payload (Mirai)", "value": "6aec58beb8dd6c41464e4f1e4acb8b3460e7dc76594cf4e9d7d4fa57e6477665b87a9c4eab4fad22e74f3e2cf275f656", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849512, "uuid": "c5e3a571-3b87-4694-be7c-30bf2cf43476", "value": "T168F2F8D1B8825A2BC2E423BAAA6F518E336173ACD2CF7717D8111F507B8991F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849512, "uuid": "48956e05-20d7-40a9-81c3-4ed2377e9e45", "value": "768:CzQJzX74uXq3GpKWKKZSo2Tjupjq3e+aErWl6Mja:RXJXmGH2T+8SErWlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849512, "uuid": "b4f8c335-84c7-41bd-9b92-22de5ddcdc5d", "value": 37120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849512, "uuid": "4efb51b3-88e0-4292-a777-e3a508db5738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849512, "uuid": "ea97fd84-4252-4cd6-ba63-1f7d047f9d00", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f694bb87-6ba4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849168, "uuid": "172c7c63-137b-4c47-8b39-a5d2f72f6c0c", "comment": "Malware payload (Mirai)", "value": "885655f3677740d58f27cdcdc7271022", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849168, "uuid": "efe5c0d4-53f4-40a9-8b58-368c810fd149", "comment": "Malware payload (Mirai)", "value": "7ca44fd4dafbab0d887e95504b9ee69f0ba2b9fad8d9e656917557980d681532", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849168, "uuid": "51d2980b-2aac-4117-a036-593c97024012", "comment": "Malware payload (Mirai)", "value": "12d9a8a9f5ff0d93f70c4e575d8aa1640bb3adbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849168, "uuid": "4bb511ba-d634-4704-bb98-a1ffe3de3790", "comment": "Malware payload (Mirai)", "value": "6e03cbbc1f61dc6a4446623310ca440dc060990f37b7d0f5b17d2dae04131cf925c292ff582306bb8ee5354ed3f2dc10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849168, "uuid": "63decce7-7b4d-48c8-96cc-adc02b99f3eb", "value": "T1D19308CAB401DC7DF40FDABB4463690EB631E26156831B2B6757FD93A8721E05827F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849168, "uuid": "0035a319-012a-4e0a-8e8d-92cf0756a705", "value": "1536:yi63OKm+NsHPs87A5p3+JqqohhcZRPY6Ci/bJPb8AsQX/AP5LbZzs0z3L7Vk7yuE:yasGA6JqHMPYpi/bRYmAL1zsq8yudSIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849168, "uuid": "65306a53-0a40-4fb0-90f2-211d09361579", "value": 96712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849168, "uuid": "6fc8b813-233a-48e8-859f-5c6a427fc21c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849168, "uuid": "2f11e1bf-ea44-46d3-9bff-f92d8e95182c", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6d8ee6-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781886916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886916, "uuid": "cd4cabda-ff8d-4e42-aaf8-af77d0f5618a", "comment": "Malware payload (ConnectWise)", "value": "cb9ffc27b1389af8e23c0295fb87083a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886916, "uuid": "f1a924c0-e8fd-4f72-97a7-65cd98e1ce5e", "comment": "Malware payload (ConnectWise)", "value": "7e049c9f4ab886854efe293c3b8fef7d4b95c700a89a30b7a305a2d7722b943e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886916, "uuid": "f9df4328-466d-4424-bdc8-3d2d92532a7a", "comment": "Malware payload (ConnectWise)", "value": "7976534b2572c28e87604b9e3088d42bf822e796", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886916, "uuid": "d479a4ee-2ce1-4dc8-9a35-a937ae2d1278", "comment": "Malware payload (ConnectWise)", "value": "f3e0cbc8c1ab19a940d54b4cf369213362ece5d92f1d11acbcfff0cfc78613c2dd4515acee5c63c7d92ac65d1c4a0055", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886916, "uuid": "93ba4911-90ba-49a9-a74c-d106a425880f", "value": "T19546E111B3D995B9D4BF063CD87A82A99A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886916, "uuid": "93c0bbad-0b8e-427b-bf77-8b53e4e236b7", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886916, "uuid": "e757f1e6-0110-4e54-b964-c8599f786336", "value": "49152:hEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:2Es6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886916, "uuid": "d8b3c969-9950-438f-b63a-070ff6332eda", "value": 5622376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886916, "uuid": "10ab7ef3-5c50-4855-99f0-6a4784599c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886916, "uuid": "470b9a22-938c-414f-82c2-bd9d3e6ec648", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a18272b-6bd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781867696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781867696, "uuid": "1817e0eb-3a30-47d2-aaaa-3a40051dadd8", "comment": "Malware payload (Vidar)", "value": "990143b90c23deb2cb149faae712288a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781867696, "uuid": "b432c305-0b82-4411-9b90-70435c5ed852", "comment": "Malware payload (Vidar)", "value": "7e3d33c794a53db6cbefc1cb7bdb960a4518636be4278abd75243efc45f11507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781867696, "uuid": "dbae289c-794d-439b-89fa-0d0eb2fea49e", "comment": "Malware payload (Vidar)", "value": "9b52ba6f536f3104aa21d2804ff7bed54b7c2dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781867696, "uuid": "6b60aecf-3e7c-4d47-bfd1-e1b2425939ca", "comment": "Malware payload (Vidar)", "value": "acd7d2f8f79e6019a35ac35dd6e26bd16fc1dcf36df7bc09868e111503d78687e3d1764a50777eb14a3f3c7ffd30c017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781867696, "uuid": "dc906842-d955-49e7-9eff-ff2dcc975ee8", "value": "T174F57C02AC8149F5C19AA3328DB741927B35BC6A1B2533DB2E20B73C2FB27D45D36759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781867696, "uuid": "0645b26c-5ca0-4b03-bd9e-6a9bc64b1357", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781867696, "uuid": "8f8ad741-2852-4e78-8720-613363d96f89", "value": "49152:kLd+a+oMl7LGHtwsYr1AkyFnbYGI0cQvHT9W6haygKQckJvEDi1Nq3iulbHWqv9D:krx81UwIQIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781867696, "uuid": "8248e56a-1226-4984-ae7c-eb0f6e054664", "value": 3501440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781867696, "uuid": "f4d80aa0-d6d0-41df-8d15-db8260fc3646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781867696, "uuid": "08db83b8-52b8-4ff4-9d53-e18569c6c57e", "value": "Fps booster v3 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5f0ea2-6c14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781897018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897018, "uuid": "fed4b7f8-dcd2-40c2-b68e-a15907b8ee19", "comment": "Malware payload", "value": "1022716e15007252d93901d0072e0913", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897018, "uuid": "bdc1e34e-0691-4fec-a093-be8172e85bd6", "comment": "Malware payload", "value": "7e5ac45a8086ead2dbba28349513b81cfb9fd0d751427cdc7387ae0ab8df7fc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897018, "uuid": "b490fcc5-fd6b-46cf-8a9c-0754a275fb7e", "comment": "Malware payload", "value": "169c0e937d8185359fab41cab91975ce0c116a35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897018, "uuid": "6aa6ce7c-2d2b-430f-8587-8104a7f39afb", "comment": "Malware payload", "value": "ee69e3bdfad96801198a6943ae7d79ef17598add1c03f4657e3ed886a3d8bebaac4b70cc5206da18f351b835885d8023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897018, "uuid": "260d6469-19e6-4ee5-be82-b14b09dbf2f9", "value": "T19CC3294AFC819B01C5D52A7AFA5D51CD33270BB8E3EA7116DC211F2567CA91B0F7AA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897018, "uuid": "a91d9172-70ab-4428-8566-f3213453a4cc", "value": "3072:u7MhbGD7lHLM0RbpU2h8kRvUoodLlHAs1Pt4bwVcd5u6O:ufbpUlk1UoodLpAuF4bwVcfu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781897018, "uuid": "804490bd-653d-4155-91d9-e8207e59a194", "value": 118356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781897018, "uuid": "e62f417e-c039-422e-bcc6-354a2e5bb808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897018, "uuid": "7ef2dfe8-a285-4015-85ab-b8886e60ed97", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39328b17-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875908, "uuid": "dd09b709-2a85-4fb6-9ce5-e8e482ad6817", "comment": "Malware payload (Mirai)", "value": "5206870fb3a6da60e987bd90644defad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875908, "uuid": "e7e5befe-e999-4bd3-82be-019821368373", "comment": "Malware payload (Mirai)", "value": "7e8198d246c79a79596a923e686319754c9e462dedcea65316968c4a9d7de457", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875908, "uuid": "f2ae604a-2929-4229-8d9e-5dfd289a50e1", "comment": "Malware payload (Mirai)", "value": "ecff8a34d2fd56a1f09b51ebb07247b847da08b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875908, "uuid": "b0bba23e-01c4-475b-b37b-f8018d5bb876", "comment": "Malware payload (Mirai)", "value": "28f8efacf25751b540bdbd511e01a5e9090979c288b51502c643fd61fa6104ec1cc52f5b7fc67c9af5dfb56f115804ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875908, "uuid": "bf6ef093-39f6-4bf5-8504-53d5ecc19777", "value": "T1AA03F159FC32AF9D8B7014D89A384E8A9F1D15F9D1BE7077196F128C708394A6A35F03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875908, "uuid": "4c8b643a-0bc3-4c10-8852-090f4e6c488c", "value": "768:BVYPrcMo+oaasy7ZBErQy5la0ajFtc8mXPo92cM09m9npYk9rrE0cRdZxWE9q3UO:fM4+oaa77bEkHbA84o92chmV9HrcD8Ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875908, "uuid": "4b179092-5f87-4c80-b57c-4d8191d09859", "value": 40256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875908, "uuid": "2208007f-5736-4f5e-a164-af0777874c57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875908, "uuid": "b1cc528e-c73f-418c-a17d-7b3e34dadc04", "value": "obmsxxvnc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedbdc7b-6bad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781852993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852993, "uuid": "0e559e4e-a301-411d-8776-a700e8bc3daf", "comment": "Malware payload (Gafgyt)", "value": "c9a251ad0bf9dfddb20e3c2121f50be2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852993, "uuid": "8c6aa784-7407-4df1-83e1-50ccc2b380b5", "comment": "Malware payload (Gafgyt)", "value": "7f1904799092fc3ca1ca7e34e3c31b270e315c098a29d6c2991bccdcd7964032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852993, "uuid": "36d5ed5c-035e-42b6-8fe6-049136903173", "comment": "Malware payload (Gafgyt)", "value": "3fae2b96461b77fc7cb056c7b92ad1db3ca8b399", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852993, "uuid": "d1dba41d-b121-4f5b-9142-0f738f75f987", "comment": "Malware payload (Gafgyt)", "value": "e8d047214599a91160c22f0adde1015b7e8a144c90afe309b87c4efbcd9547afa846a28cb3c42b3f005297f0f95245ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852993, "uuid": "d0ded9fd-6d8a-46b7-b98e-f4e81fd400f8", "value": "T19E749523D8154595D1615CF322273389AD0B87BF89E732D3EE2A59A0BF2051F52BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852993, "uuid": "3850a6d9-cd8c-458f-b351-0ab8495dc7fe", "value": "6144:O1RxhklmpfwjoSROEkSmE/67QaSXRiORNb:WRjklm1wjNYSmE/67nSXRiORNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781852993, "uuid": "2e459bd8-8a39-420a-a18d-c6da1feea790", "value": 349725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781852993, "uuid": "da99b148-75f2-4574-a7b2-2f05f835fdb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852993, "uuid": "f18e8833-41f6-4487-ae6d-9cf5840baddf", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb2c782-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883623, "uuid": "7d423a56-cf1d-4e91-b23a-e5aeb29a77dd", "comment": "Malware payload (Mirai)", "value": "cf63da41bd5e0741a90e2b8e68a5b9d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883623, "uuid": "dd778b48-85d2-400c-af0c-0abaae2c16f9", "comment": "Malware payload (Mirai)", "value": "7fad51a51214124a5c92adfc455c91c596a6d3d51812b587d7cdb5935245422f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883623, "uuid": "59776673-554f-480d-8f7c-5b5f2a5c03d1", "comment": "Malware payload (Mirai)", "value": "3e3fa1e054c224d2376f32f96fba897e19a6d4bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883623, "uuid": "ef6237bc-8107-42b7-8aec-604323dc4de4", "comment": "Malware payload (Mirai)", "value": "6df4945b686b5fc52a12e2e128ced89e38f6920715a9f16fb84cdf4361849532ea23f84d28d590c04842ab8c76fca1fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883623, "uuid": "1b2da324-c1b5-46a6-a0ee-62b65f597da0", "value": "T138143B07FA41CE53C4D61779BA9F924533339764D3D7330AA928ABF83F8369A0E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883623, "uuid": "d711353a-5bf3-43ce-a320-4e99df9225fb", "value": "6144:sB4cZYZ9tIAH0WVa8488t4JRAeoECKM8i3RGM/9sWmmIwCDOAJt:sacZYH3HtVa8Q4JRAkCK36n/DmBLDOA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883623, "uuid": "00a96215-351f-487f-b8b4-6e71acbb0889", "value": 205620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883623, "uuid": "34c0fbf1-d202-487c-882f-20380d3dbc59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883623, "uuid": "c711f6c2-2581-40a0-99a7-d10fc23612b6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832828dc-6b9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781846397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846397, "uuid": "47c440a8-5f3e-4de8-b7ba-f8c344ae9a3c", "comment": "Malware payload (Mirai)", "value": "f399aa12b06f49021839e26f2567bd77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846397, "uuid": "d7ac403b-3888-4017-8b95-1950944ac636", "comment": "Malware payload (Mirai)", "value": "800ffd8e69478a788f8c22cb7b7968e63ab7b460d6d88fdab8a9f5d49766efcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846397, "uuid": "070a25cb-4f1a-44ac-92d4-5da2ae33c3d0", "comment": "Malware payload (Mirai)", "value": "8f315052811852478099d68ff83fbc6f0ad1950d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846397, "uuid": "3d36cf09-2157-44b6-b2af-95062d9abdd1", "comment": "Malware payload (Mirai)", "value": "7988cc9a65aee3aecce07d96e853333b30e7174175e1ff152e39c71417b8038942d9471d481e0d43cc9458de563f93a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781846397, "uuid": "57fdbbd5-1ec6-44ea-8da0-57a78a316456", "value": "T16F13F1D7037AD5F0E03360722F98D4B8DDE55E6785991B2F24AC61FC5AB3688160CAB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781846397, "uuid": "ff4f9ab5-82de-4ab9-b53e-7d908c60a4f1", "value": "768:eAx1S4mk3UW7pGwBV38utaDoZngR1gsaODPO/rgQO5LbYhx0Yb:zMivBz38uAo1u1RaOPOD3OBbQxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781846397, "uuid": "d02f1367-51a3-489b-987e-215aa792ef14", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781846397, "uuid": "6d0bfff2-7043-4442-9b4a-e394e93c7279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781846397, "uuid": "879f472c-63cb-44e7-8951-1fd616f0ab08", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8890cf-6b8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781839115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839115, "uuid": "19e4b044-dfc7-4b59-bbc2-88257b50413a", "comment": "Malware payload (Mirai)", "value": "beab039b5fc2326b7f53b6394a4086d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839115, "uuid": "6a1e4571-0d21-4eb5-bc78-0583524e014d", "comment": "Malware payload (Mirai)", "value": "805266a4849b87f3c6e4cb01f7cf16b415e441d2b9dadefa843a18f6ba4badfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839115, "uuid": "7190ecae-c7eb-4787-a429-15aab8e3dcd6", "comment": "Malware payload (Mirai)", "value": "e274ad6243fd008595fc6a501d84740d1f670231", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839115, "uuid": "83088ec1-d977-411b-9918-736faa960e74", "comment": "Malware payload (Mirai)", "value": "59b11ddf36750ce94db3f4ceba5d3ca21932d40fe2de38d10e271a0ba9c1d19d581b40fc728874147b63e6086f799ffa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839115, "uuid": "3bdaa4db-ff1d-4329-8655-aa8711d9dc1d", "value": "T1FE245C02B31C0D47D1632DB02A3F27E093EF99A135F4B645795FAB8A9272D321485ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839115, "uuid": "5b009b76-4bd1-4e90-b19e-88940f7f2d4a", "value": "3072:+k5oTYxVW4Z014himFkGApAZ3Qs6PuxS2trDN6fC567E6z:+LCH9APuxS2trDYfy6Fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781839115, "uuid": "a71f3f78-3252-460e-a210-fa403787111e", "value": 213200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781839115, "uuid": "1088bee7-c0fe-43c8-9a26-a55e15c94803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839115, "uuid": "0a330b70-d45a-4ec8-b91c-239b82fc654b", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a45a30-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781850136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850136, "uuid": "2f0c9e37-333c-4d05-a0d0-1ff6b326354f", "comment": "Malware payload", "value": "9120b32a76fe31de74f330f30f43bde2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850136, "uuid": "3fce4520-0b52-4b52-a354-3b732cd848f5", "comment": "Malware payload", "value": "80f93c981de0b8e2d22575555ed6e2084aa60422edb2719e03678fa58881a496", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850136, "uuid": "d2711d3c-173c-4256-9513-0e731e04c7d8", "comment": "Malware payload", "value": "21c58ccfa7bf8823c848528a9cc086af81cbe66b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850136, "uuid": "7a728a51-e589-40be-a16a-a566a3ba090b", "comment": "Malware payload", "value": "a0788bffff421353794a456e542dd81b6f28a1d68e92f01f66658072c3aabeac229c965a351758877a59874d73b207d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850136, "uuid": "3a657934-49c1-4dd2-b2cf-6ecda4232da7", "value": "T19B86F905BDC42BB6C02C4A7494EACA5522B05D145AF18A7A21A0FFDDFCB62397F478DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850136, "uuid": "b42e1108-5158-4f6c-ae4c-900e73963e4b", "value": "49152:NkZkhOtz6Va3NtqNjNuhAW0xVKAEQADyZZhnhUxMl3J6orY5Esw:ln5jEQLxmEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850136, "uuid": "b195a4bf-9ab9-48e4-baf4-cfecc5ac5b5d", "value": 8061143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850136, "uuid": "9c7147c7-5036-440b-a3f7-8f11ea7ac98d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850136, "uuid": "14de1d34-d162-49db-a408-251e459dcc3e", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f23f736-6c06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781891031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781891031, "uuid": "4d98f4cd-2f38-4549-818f-b233a5bbfa42", "comment": "Malware payload", "value": "733ba7e3742a8e57c8d8f1f8bac23680", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781891031, "uuid": "ceb2a40c-28c3-477c-b222-46558069d3df", "comment": "Malware payload", "value": "81a7fcaf38d46174cb5e2989fb65dcb00242e07b3456daa58519bcedb569fe8b", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781891031, "uuid": "ccaa0cc8-405a-4b98-a142-8a01788a6ab2", "comment": "Malware payload", "value": "8a9d3c5d35246c2bf3549e3fea441eff6477a917", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781891031, "uuid": "bea4e878-015e-4f50-bd99-0e8e79598419", "comment": "Malware payload", "value": "13d441cd9b5ac0de66982ed43e86e0716ddd947c32a38a9022d8d7ba309ac16b280115ee2c3d3665191e5c95b4dcaf2b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781891031, "uuid": "6f6201b4-dd1e-4a1f-875d-59ac23531870", "value": "T11FF58D17ACD509FAC5AA633548B3A5827B71BC592B3227D32E60B3783F726D0AD31714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781891031, "uuid": "fb157ede-3548-459b-8798-d1f47e9825a6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781891031, "uuid": "a82a1e9d-45ee-453e-8d0a-72ddc23882b6", "value": "24576:cLoLigv2d6zr20avihC5G7hYxGclgtA7powfaWdgN1iqElD6t/7o9x3YLsko4Z22:soL7+EX2TiIc7yjJpoIr9lDAskfy+830", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781891031, "uuid": "030dd9cf-52ad-415b-bdde-166101b77409", "value": 3327840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781891031, "uuid": "d5825307-4ef7-4923-80be-c0ee85cfe516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781891031, "uuid": "d3e2a733-2b9a-467a-babd-e9220f9b09fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29260aa6-6bdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781872445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872445, "uuid": "1c3d10fd-b9c5-4fde-8d58-fdd2233dd20f", "comment": "Malware payload", "value": "479c75d82ef23856840bd12218e1b4c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872445, "uuid": "29e1d544-6a34-47f9-b7d6-b6aefa6136ba", "comment": "Malware payload", "value": "81b19f8611103172377c688fb97b10620699c66fc7f207b4dcd01ec89ba07bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872445, "uuid": "e58fe420-ec0c-47e9-b0ac-ff9ee0118e3b", "comment": "Malware payload", "value": "6ebd6bbe27a35a67366e70b924c1521a1996828a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872445, "uuid": "c913f90f-145b-4fd6-8366-71f8d5bc04bd", "comment": "Malware payload", "value": "67e0fc0f41ed9960d14818d11ce25776cf6af94f68f01c2ca1b938e624472fc472d5bf79132a43a4ad9d56b3a7c2c7db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872445, "uuid": "4cf80f48-733f-4953-9284-d73b16515203", "value": "T12B15E0225F466B99D6AE0F78C0660C6C37F8C9076392E61B2FED40F59EB3B94C917052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872445, "uuid": "48ea8c44-a0a5-46dc-b6fd-8df5aa5b308e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872445, "uuid": "bd586cb6-f018-442a-abf8-89ba294b780a", "value": "12288:gHNilfyO0EZPy5E1Z1IaqHcvVnaXujgZ/CbmapHIuj0dK1lfwPHa05LxZlvxZWmk:eNmxaZ/CK+HRj0dKLfhMNv7Pcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781872445, "uuid": "9806b092-793f-487d-b9c7-4133ab0a6b7b", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781872445, "uuid": "aee95e4f-9d28-4533-9b29-e2f19961a449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872445, "uuid": "20836c07-5ba7-4070-a6f0-2834f86a1e8a", "value": "COTIZACION DE NABORS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4768b2a5-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "ea27568a-85e9-4fac-b99c-d2d3b9e43bea", "comment": "Malware payload (Mirai)", "value": "b54012ce6d97e9aa581f521898b9d8d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "dd1025ef-1974-432e-9989-4cc4e9eb6f18", "comment": "Malware payload (Mirai)", "value": "81c87b7b5209318c4affb895fe8a73ee184ae81b6f03add41b28c5ab500fe655", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "afa7419d-19ce-435d-bd61-000720a89eaf", "comment": "Malware payload (Mirai)", "value": "6a48d2484347bb300c4e034fa8698e1adc94f1ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "76fab4bc-72dc-445d-b995-cbf8db60b5f3", "comment": "Malware payload (Mirai)", "value": "c75642e539092eccbacbae37759d2e2d368147961cff0c95a742a08b12be75793ec4d5f9cb1809105d8cc459d02bca36", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886240, "uuid": "cca9066e-250c-462b-b1c6-990c0cafc7d7", "value": "T1B8A35D97F401EE7DF80BD5BA04670A0AF630E3E51B930B366397BD67ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886240, "uuid": "c27c352e-9ae0-48e6-8c53-e79811bde8af", "value": "1536:iPhR5NhZp+huOzP6DxHd8P9foRRfZAuDbAV3GNPt8Qkea:ip3PSVWxHcqRhzhNPt8Qkea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886240, "uuid": "713c8c49-6b13-47ff-9310-05c9140d7931", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886240, "uuid": "4518b065-725f-42a9-8ddf-ab25cf88cde1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886240, "uuid": "262c7b70-a477-4f8b-94d9-41616c60cf62", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391503b2-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875908, "uuid": "5073d9f0-3aae-409a-be70-a17e9804bafa", "comment": "Malware payload (Mirai)", "value": "bb735cd8ae85896ea8f664edeafa9a57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875908, "uuid": "4e6506a4-72b7-449d-aa55-ac01ac2e782b", "comment": "Malware payload (Mirai)", "value": "81efca11332db2ea8282d1258dc3c9429be094fa518ff5136cacdea33ebbca78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875908, "uuid": "2b71d53e-cfab-4cad-9108-6d01891b5124", "comment": "Malware payload (Mirai)", "value": "10f7fb595b333c470c23958b5fa1d4ff2057796f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875908, "uuid": "db7eb9fc-30bd-4f88-8e54-41ff7666d285", "comment": "Malware payload (Mirai)", "value": "8d3961799f8e85d2d963e3f88e9271202093c5c8b856b88618478f952a6d40914d5ae2e9f025960c791d6cc977a33836", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875908, "uuid": "1c40e3a6-c841-4944-888c-ab40003b6b7a", "value": "T1C1739E86C43A1DE4DB88AA7431E5DA7513E3C104A1D75FFAA4CAC168A447F8DF808BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875908, "uuid": "a43f8922-22a2-46b9-92ad-e49ff9e4f3c6", "value": "1536:p3NeympaHTRA7cH3b0KQRrd78bzOCRk8Zsn4w8:p3Q/wHTjHL7QTqzO3+64P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875908, "uuid": "4f3fa5db-3116-4c83-89ce-66409100e06b", "value": 74884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875908, "uuid": "cf25308e-3306-476c-8748-9ca7656d9339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875908, "uuid": "036200e6-46d3-498d-b4a0-1c18561c29d3", "value": "nqmwdsyht", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa8d9d0-6bea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781879132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879132, "uuid": "81c683a8-db79-42dd-b822-62fc0e8b0402", "comment": "Malware payload", "value": "b674ba469dcfcc3a624849068ec2cb6f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879132, "uuid": "fa65c598-321a-40ac-9449-be41b4aae28d", "comment": "Malware payload", "value": "833887196f6379a8a9bfb7d93dce0a7ac1eba6d63fb7338089b3f0704f5b35d2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879132, "uuid": "f4f67ad8-df05-461e-8d68-c6149e4ac9fb", "comment": "Malware payload", "value": "3da10ee196ac0d0938cf319ec99bc84ef6c90690", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879132, "uuid": "1ababfb2-ccb2-4199-bd9c-50cbe4b1a9d0", "comment": "Malware payload", "value": "5eb99e77fe3f7783cb5ddecb8a684ceaa77e6ee31cf978a2269db496a65934f2d73189b05f87dcbbcffaaf6d7dcd4719", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879132, "uuid": "6df26149-e602-4a47-831d-d8944f7bc918", "value": "T121018CCA86106910402A961E629731A0B410C3CE554A0F747F8C5E3DFBEC914B03AE94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879132, "uuid": "4e525616-d0b9-468d-baf5-837ab6c7a5a9", "value": "24:kXCKysE2hi0ziQvZohaJUHAjraEERvOEo2s7:e9Qp+MsJUcraES02s7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879132, "uuid": "7546ab5c-6b95-4b06-b62c-073ed3aa7a0d", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879132, "uuid": "a0d2b979-35cb-4005-9c0c-86b70e6d6cd0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879132, "uuid": "8acbd710-de50-48c6-a622-b9f7091f096f", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d8de4b-6ba4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781849091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849091, "uuid": "477ce72a-1f44-41e8-9d84-1dd575d59c7c", "comment": "Malware payload", "value": "a77098fef95975680f19575960dfc93c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849091, "uuid": "97532ff3-5e6e-4082-b5c4-1c2dd2785fad", "comment": "Malware payload", "value": "8354c72cb6a8b0894886897b31ac8c17db4516d761154af49d0a78f81938ef5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849091, "uuid": "d82bb348-6aed-4f44-890e-59236bf7fbad", "comment": "Malware payload", "value": "6c01128cbd85145165f48db330dfb1b5d5a38dda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849091, "uuid": "a9478bfc-8b60-4682-92b5-0ea8a1a0fe21", "comment": "Malware payload", "value": "807352f68797886fcfe0ee8842100af47cb825656406e4a3cc5737aad588bf480c28407333cffa6be4c7d25a1596f4ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849091, "uuid": "fa31fc59-5336-4fb1-986c-02de030359f9", "value": "T1FF264A03F95191A4C1EEE130C666D293BA717C895B3027D32B60FBB92B36BD46E79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849091, "uuid": "45083ab6-c03a-4cc3-b6a3-1a00b3dd7659", "value": "49152:sy2hWP9zrb/TwvO90dL3BmAFd4A64nsfJyWCm7x/k7KLybeAMUpvm3qKMaJNyvdg:2m78KRU+CvdxENgZfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849091, "uuid": "8fdb1683-2663-4377-a894-06003549b806", "value": 4722880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849091, "uuid": "02212680-e6ae-483b-9bf1-f21fea5d686f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849091, "uuid": "4bb24b7b-857f-46c3-a871-d14b6c4bc709", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bdb188-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781881050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881050, "uuid": "5b5b7b47-07d2-440c-a3a9-677f09634b07", "comment": "Malware payload (Mirai)", "value": "f9aa0f1a69f886ff57747939d5c04427", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881050, "uuid": "1d448b40-dd60-49dc-a02b-5d069e619f3d", "comment": "Malware payload (Mirai)", "value": "83a4882db905fea65c4adbb2bbde645fb6bac0299de61edd51287f05c3b4f575", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881050, "uuid": "7ef15219-5751-4990-82fe-a13dd2b9189d", "comment": "Malware payload (Mirai)", "value": "06583c2f88c310669b4db0d30d52f0ebc1905989", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881050, "uuid": "67e830ca-ca43-4a18-ad0a-a20f758075db", "comment": "Malware payload (Mirai)", "value": "047830fd28d21fe05ff46b62623f53cef29bf0d51da642bd7bd0b15b56344efd6cc8c7208ba20b7bd601e69f26b83613", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881050, "uuid": "029733a0-8ef9-40b5-9f6d-fc50a1da1c48", "value": "T183F34A4BB7608F90D275CA305AF38B679AB9119716E35481E2BDDE203E1134C6C6FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881050, "uuid": "874e402b-b9fb-40b0-8d4e-9ceaefbd39e3", "value": "3072:eFXPl7WE4XQbSQLW6g5vIwFUYoOfJdVa94qgUuiv0JeE43jP:eFfl9Yi4IatoOfJbeSU1PfzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881050, "uuid": "efdb329c-86e1-45ec-b311-61c614d5847a", "value": 166648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881050, "uuid": "60c95793-d7be-4eaa-8371-d000447b24f1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881050, "uuid": "cc1d67ca-4471-41b9-95f0-ab7b4d6ba05c", "value": "monero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9308cf3a-6c26-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781904835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904835, "uuid": "97983687-9efc-4db1-a909-d2a9811efe79", "comment": "Malware payload (Mirai)", "value": "75ee1568dbd79260e9f60248ffa5dba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904835, "uuid": "ddd36f7c-7c75-4a88-8442-1dda456dc950", "comment": "Malware payload (Mirai)", "value": "84330c79f069803006a4644155fe62c92956d28b396f48dc4153c8176a8785e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904835, "uuid": "64981ac4-660c-40de-94eb-c5033619557a", "comment": "Malware payload (Mirai)", "value": "c21bc4f3f3f392e07fee026c172747bec52fc26b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904835, "uuid": "faf7936e-6109-4b51-a57e-ee86a31b71fd", "comment": "Malware payload (Mirai)", "value": "190f250b015ceb260f8391c9bc47bad1c4756a46f0f3eb05ec541fa9d55101d3183adf27cfeeb2c9e2eb913f24913ae8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904835, "uuid": "c45a03e1-2376-4367-8b4a-848dfc090d98", "value": "T1295301A721A07DB8E03D41B6F71FEA4207D94B1AB21D3F865659B9D840CF6F60074BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904835, "uuid": "b249e2cb-c89e-4892-81e9-2f109a077301", "value": "1536:sblzdaDmfTDo/PyrpA82VZr86dh5Jl44nsMlNVG+9I:sbQMTDuPsyrbJlm2HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781904835, "uuid": "8fb23f69-b753-48bf-8a7c-cc94aea3c1a2", "value": 61240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781904835, "uuid": "42057d26-7bc7-488d-8197-8ea110c44d9d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904835, "uuid": "c567c30f-2a05-4d7b-b8b2-ef35abc2522e", "value": "monero.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3e943a-6bf2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781882384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882384, "uuid": "9cd0ce1a-49c6-4e6d-be0d-1dfff2dd44c1", "comment": "Malware payload", "value": "06e56e420fa5e2f1c29345d342eeccea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882384, "uuid": "8658f060-671f-45da-8c4d-3ae74b1ded6e", "comment": "Malware payload", "value": "846afc3a59b00718b3c0c406d3f443e7252794569f31c98d7bb5e6928067d4a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882384, "uuid": "fd3879a2-0eec-414e-882f-9a331781a101", "comment": "Malware payload", "value": "6333c65366054933dc24098c8e28d55d052c8200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882384, "uuid": "946f1bb4-7530-40e6-9638-58bccdff2239", "comment": "Malware payload", "value": "4e29c10450cdd0a7e4de5b9843f265365bb885c82f3aa8dbdc9fe59b8afdff61419b45117169d76510db0e2344cc8524", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882384, "uuid": "386cc895-3058-42ab-87f6-f696fc82b230", "value": "T160D08091C152D143C07C4D3575145F6E1B24C17780501F2623D56BCDCCEA6D40F31B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882384, "uuid": "2b7a14bf-e6f6-4447-b945-7607af2f15ea", "value": "3:Bkkk/tMlwXll/O/slrCs4X1lFrSwfjjNleEsM8IPNioOHyUvwGcVhVflgLfE2:Btk/tMl//E2s45leFKQXSEwhVDlOfE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882384, "uuid": "0d53a059-a0de-4e4d-828c-ba3c012aa562", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882384, "uuid": "314b0fd8-aa36-462e-864e-bbf8d0b73bc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882384, "uuid": "ae5ee02d-0e36-41b9-8e64-6658e3533ac0", "value": "ZtNzfCdj2VGYFlW", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b2a52b-6b8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781840064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840064, "uuid": "4686e853-08f9-4aea-9d6d-3748861dfe4b", "comment": "Malware payload (Mirai)", "value": "68ff5d7782fe0333ccf1b9732e3ec7af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840064, "uuid": "bbbdcc4b-4a69-4def-9d70-cc6902d2eaaa", "comment": "Malware payload (Mirai)", "value": "85a5109380dee438f649de286411d991f17020007f960d0f17cf030328ce3fff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840064, "uuid": "b0d7df8b-c984-4be2-bbae-f888cdbda1ba", "comment": "Malware payload (Mirai)", "value": "d588e4b23b499e1cc0b66ac4bd0807b49ee66e5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840064, "uuid": "5821947d-632c-48b6-a778-3275705a49f2", "comment": "Malware payload (Mirai)", "value": "7b9a2d60652fe6eb8ebe21f7703500c8966d65a4199c7522c4ed9957d3b2a5031563c8aa42737f6b76b1b7d1bee5d2c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840064, "uuid": "775e21c1-9a3f-48d7-b9a2-12ea2d2499ff", "value": "T1B38302E74BE039E7E95CF3790B8847C102D20E289DA7E88B50113D97C98B15EB942BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840064, "uuid": "dd425cbb-03cc-4a66-99ba-1136f726e1af", "value": "1536:vj83wAf21LaP8K3fcmnrX+fq6pXlOVE71RtHIgxc6kFJD4T8O+RnDkOdNKSVJuH:AgjJcvhrX+fq6OVy1RtHIgkJD4oOSDLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781840064, "uuid": "8b7cc174-84a9-4019-92e3-e8e3f26a7989", "value": 88108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781840064, "uuid": "66966891-fee5-46f2-88c7-34d3762b81cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840064, "uuid": "b5f16646-73b4-4790-a794-ccdaa0526f8e", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2ce600-6baa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781851434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851434, "uuid": "877b2dd3-b8ea-479f-8783-33f20b56f9b7", "comment": "Malware payload (Mirai)", "value": "3a9d5b9d76a68bfd2dfa75a94bc006a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851434, "uuid": "6af061b9-ac37-43b9-9343-8e678e3a2100", "comment": "Malware payload (Mirai)", "value": "85d2eac1764a73f08fada318703215b8958d59226c7adb1832f15922f2ad3c2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851434, "uuid": "248d3592-6833-42c8-b472-aba5edd25bf5", "comment": "Malware payload (Mirai)", "value": "19188188fb72795fbd37666e90e38efbe236f2c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851434, "uuid": "7748f135-5f26-461b-b412-195bd730e7a2", "comment": "Malware payload (Mirai)", "value": "77d986be0549c13d16803a6b2e2a48bd1de585bf6529170f2e3c6298c2734dcc2ddb14a3a916372e52f18f1ad990b753", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851434, "uuid": "c3acae5e-37c1-479c-b816-27b61c3e32e3", "value": "T1F903F130E03222CBDAAB9C75AD89DECDB3B143D5A747D2C0E19A7BD46616C3DC4429D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851434, "uuid": "17448159-4f05-4c19-900c-db5b41ad583b", "value": "768:cWyywe+EbN5oGbtz6gcvlsOUTJt5bCPej+T1RkAuI1bfgVoFAY4uVcqgw09R:v0EhLQvlaFj+T1iBI2WFH4u+qgw09R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781851434, "uuid": "289b399d-d6c2-4ae0-8792-836d4ea01883", "value": 40184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781851434, "uuid": "553bd976-4b1f-47a1-9582-d9e3e27c198e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851434, "uuid": "f78d77d1-9101-4688-a4ca-d557fc639792", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6975c033-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886297, "uuid": "74a575d2-29ae-4852-842f-03cbca59fc72", "comment": "Malware payload (Mirai)", "value": "c858bd77e2f1ff22d29a1184cd9f393b", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886297, "uuid": "0daf271d-8d19-48e8-a987-1d6fa15c808a", "comment": "Malware payload (Mirai)", "value": "85fe96ef97ceea686340a6fe291b77a068feb1f952a2653426b2ecc76b115c56", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886297, "uuid": "7301407a-91e2-4982-9756-1fb5a742b41a", "comment": "Malware payload (Mirai)", "value": "81f0a5f3dc18cb421d1f4a9ed4e3224d4a9ac145", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886297, "uuid": "f02624b4-f9a0-4951-b454-6f8e7d0059a6", "comment": "Malware payload (Mirai)", "value": "d5cb7dd51ae83cd3fa4426b8431c2ea83b57ce7062b605d3e0580deca1224286187a9b59add93c685bdc5abd8406bc73", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886297, "uuid": "1c5ba860-c9f5-4c49-a4ca-7441fc33a7d7", "value": "T14E630279E0DB940145116B71ED11B31C2FD32F7CA0EABD60A05C23E4865AA26677D2AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886297, "uuid": "2edc1a88-552b-45a3-91d2-9bd6b18323e4", "value": "1536:2xiOYZgOqv0xNEKdwWZshfuCJS6SzWPbyD9gFU3zntiv:25oJK0xTdyhLJFRDyDmSn0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886297, "uuid": "63ab1432-46f3-4dda-989f-5ba3d32a04db", "value": 70096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886297, "uuid": "71e257ec-65fc-4174-b58f-64e5befb6ee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886297, "uuid": "23d70022-7459-4c63-8ca8-e87aa346f75a", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770e6ce6-6bac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781852390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852390, "uuid": "c59caa0f-5611-4e6b-969e-0a57401c4f5b", "comment": "Malware payload (Mirai)", "value": "c02585906fa12cf68988074688a5331a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852390, "uuid": "d2d9ceab-b41e-4ed0-89f2-2e1dec8110c0", "comment": "Malware payload (Mirai)", "value": "86279b40d44922be8ab094828cd4a18bc74fbb8f45f0573bccc89890ae2f110f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852390, "uuid": "fc0d5c8a-0a9e-449e-aaa2-be9cddc5024e", "comment": "Malware payload (Mirai)", "value": "2e3fe285ca99dbc6efc9031cf28ecd5c8f954fc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852390, "uuid": "61ec6e27-37f3-4ee4-91c1-3de95ff5e7c0", "comment": "Malware payload (Mirai)", "value": "3c0db7e1faf99fd71b1f8e6b5bb9743f917892651eaed4771026ca0ebf9be6996896332e64246c96c6ee0922a41772ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852390, "uuid": "499e513a-3182-4664-94bc-a64130a3f860", "value": "T15AB2D019818E6EB0C2F4027EBF7B818365A59C7DC2E726BF4E950B6C648905305BEF47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852390, "uuid": "880f5ac8-0123-4d25-a4eb-a0ff94b6038f", "value": "768:fH+P8QDpuxY0wfLiVPh2zUFychs3UozMC:GPlDgYsPh2zU2zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781852390, "uuid": "6b80c4af-7f85-4ec3-8523-6c762acf0894", "value": 25144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781852390, "uuid": "fc00bcd8-3d84-4841-9ebb-399ab786b5c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852390, "uuid": "e3791113-b863-4a96-b628-c1c55c57a8f6", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f423b6-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886243, "uuid": "547a46f8-f443-4ba2-a32a-fd07a62dcd00", "comment": "Malware payload (Mirai)", "value": "b0dc0d0c733ebed4b3f57c4fb788e581", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886243, "uuid": "7d3c0a67-1cd3-45d1-bb77-6c26fb224db0", "comment": "Malware payload (Mirai)", "value": "8757d7d7da59c3f5211b445501ac287209d219a9e51aa14f0d911b9755a892a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886243, "uuid": "f59e3eee-5e29-49a9-8bc5-2806f90e77a2", "comment": "Malware payload (Mirai)", "value": "717384bb7fa530bd1bd36d6eeef0518b0399d16a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886243, "uuid": "d8045489-9882-4407-b6a3-f767aa57c738", "comment": "Malware payload (Mirai)", "value": "84b60a5bad02d1d4fbde3f74240a0e29fd2d8d064b183032289762eafc6fc1044c1919c699e646d480b74b4fcc682376", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886243, "uuid": "f574c457-db19-43eb-b538-e605b210e445", "value": "T11D635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886243, "uuid": "6832cb44-d6c8-4c21-aa35-4070f3664a90", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnPH:zGYxpTGASC4XTfyyLpIoYPsPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886243, "uuid": "7ced009e-7139-4256-9734-c909e6d845b9", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886243, "uuid": "464fc631-29af-4cce-a9b8-a215dfb2e559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886243, "uuid": "12131464-94bd-436c-b460-6650bd082c76", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bae201-6b7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781831548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831548, "uuid": "787b014d-1369-446d-b8c8-ffe63b90d596", "comment": "Malware payload", "value": "0612d338934f8760df2f2e99d559fecb", "object_relation": "md5", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831548, "uuid": "9515b0d2-0f7a-4e1d-9ec8-071e4d3ee5b4", "comment": "Malware payload", "value": "877cdf98aef369186b031a7306f6986bbd2fee71631291b952280ff47aa9482d", "object_relation": "sha256", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831548, "uuid": "58c67299-937f-4502-8c8e-c95c9806dee9", "comment": "Malware payload", "value": "16cac6237a2441ef6998b471c1219f2bbf0aecb6", "object_relation": "sha1", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831548, "uuid": "b566db7a-c581-4451-987a-d156075ffc30", "comment": "Malware payload", "value": "7a703404b639f779348d80eff16994d1df2d39523e3371d8954d7a84fb297637f4bef7faa9458e2b464f252210167430", "object_relation": "sha3-384", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831548, "uuid": "67935af8-93a3-47b8-a627-96090a259c04", "value": "T1341375058EE79D147373B0A1E2CDA4097A9B40C74F4BAE243C4D92AEEF52774A1F46D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831548, "uuid": "42abcd26-f359-4439-b07e-0688f78a6959", "value": "384:j0FINvSo5o/DzIoq47z2YEEFXBoBZZ4z2ZfFhiXu/tobOfvuy/97M8T:cCUIoq47z2YEmXBoBtxD8SZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781831548, "uuid": "bf902987-b221-4597-b3e6-84e18bb63357", "value": 42626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781831548, "uuid": "0e89393a-4eb9-411e-bb6d-a6cf8ae6a8dc", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831548, "uuid": "d97c9731-f20c-4439-be2d-05461e2587af", "value": "u.pl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6459e061-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875981, "uuid": "9be64f54-bc68-4d7c-b6b4-3faf15b79c0b", "comment": "Malware payload (Mirai)", "value": "9bd25bdb42032398de53c1065d51c8a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875981, "uuid": "158b167e-421b-499b-9463-842a2e3b0ab0", "comment": "Malware payload (Mirai)", "value": "8835445412658ef6f2ee6b51bc3770750e7a55391d4bca6432f58efe02672e12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875981, "uuid": "7432e31f-40b3-4923-97b0-a2febf0faa8b", "comment": "Malware payload (Mirai)", "value": "1768f80cc94a96f665aa3bab271d44d158000df3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875981, "uuid": "f7611a05-5e53-43f7-b592-5d75b57eee14", "comment": "Malware payload (Mirai)", "value": "6c8070c3d8cd2e228c5eb043a57a8d8447a43f9eb66ef9d214cc7eb371d6f1178d18f8e141d499cef3a705ba68acd60c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875981, "uuid": "d79b2e94-fb5f-4df9-bc31-7c5b040df6d3", "value": "T128834B9BFD805A16C9D4527BFB1D428C376613B8D2EB3203DE29AF25338351B0E6B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875981, "uuid": "40b7de5b-ea61-4d16-b074-160ed4353608", "value": "1536:UnBOu/6wG7lNcZnQOaagN7P18EM/UHhBU/cvYw+:UBBPGROCNT18pa/Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875981, "uuid": "09a73c1c-c147-4b73-be9b-d8c66035f08a", "value": 83880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875981, "uuid": "ecb77523-bf9f-4218-a5db-6fdc47aacab0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875981, "uuid": "00587824-b35f-429c-a70f-a708e2965805", "value": "simjxtksv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b6ed0b-6bc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781862024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862024, "uuid": "a73bf3e3-e0c3-49c4-b6bb-d62224a0e20b", "comment": "Malware payload (Mirai)", "value": "b14d9424f8064790bc860185ed330a96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862024, "uuid": "2daf4a56-54c7-4ade-a991-ce27e3a40b0f", "comment": "Malware payload (Mirai)", "value": "887e01fd41194be3385beb6066f25f6ecddf8baef087cefbc111a2c19295531c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862024, "uuid": "ac6d48fe-7742-4474-9cd1-37a20ad5e076", "comment": "Malware payload (Mirai)", "value": "81795513b76931b46f33e1229ede20fafa99e2cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862024, "uuid": "edb5f3e4-501e-454c-b05b-2a39897b00ca", "comment": "Malware payload (Mirai)", "value": "eee95c3e7bd289b5eb41905d22be201e97a7b286ad1d1c3701764a1ee62f87675b99c8ab8b300ec4b49b2cfac2a32688", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862024, "uuid": "c0686121-4e5d-49aa-aff4-38fcb60b2dc9", "value": "T184647333991584A1E0204CF2226777469C07D7BF88E726D3EE5A59B0FF3541B92BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862024, "uuid": "2987e759-a2f6-4dc1-ab18-c35d65bd5cfd", "value": "6144:GD99+Qdnxz5QOMwjoWSmCxreAmXFscMdxDa3aT:S9+2xzEwjomMmXFscMdxDa3aT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781862024, "uuid": "30f35ad2-c1ea-489b-affe-a6e1e34d4dac", "value": 323343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781862024, "uuid": "7aae9bed-b0bd-44e4-910a-5174d3336133", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862024, "uuid": "fa9067de-c9f6-4630-9b3f-de3dd1909e98", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d5d12c-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875909, "uuid": "07f483de-7800-4752-bcbe-7154457a804e", "comment": "Malware payload (Mirai)", "value": "53d5ea31d8a421084a2f001ddc21a0db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875909, "uuid": "ff381515-1a04-48a7-9560-b5e9b53d6b6c", "comment": "Malware payload (Mirai)", "value": "888b9df3ffb29e928d640e5c1d6079905ca9d2b7568fc23ca670b677a5d393e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875909, "uuid": "90615396-299d-4dc9-9493-b1e73504453a", "comment": "Malware payload (Mirai)", "value": "b9eb22cf5913f5aeef2fd56579d24725b4172ea9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875909, "uuid": "cb0ffa76-8175-4bad-8dce-15b83adcb97e", "comment": "Malware payload (Mirai)", "value": "7d8da6ca728e1fb6d78f863c0ea7e32a0ecff2d5dedcb5c0f9da57a56059859ab0200fd97fb63342fb20223378d476cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875909, "uuid": "bdf15582-2934-4049-ad14-788cbc32adcd", "value": "T1DEF2E1C3C8FEA4BED832487501564840F235E10E4BDEDF59115D39BE599BA1B0F64AA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875909, "uuid": "4e2e3302-82d9-4076-a02d-5f8451790da1", "value": "768:/YCWE0EhzihEqPRZeHNhLmrs5aY+LQSUuH62+rDT5xFe49m8Uk7GLx05v:gRE0EhQE0eU3pvHqrRLZ9m8Uk7EAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875909, "uuid": "668c6e76-5033-4856-88d2-16e0a819bec0", "value": 37612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875909, "uuid": "8fd706c7-b00f-44ff-8c38-e89e5631a41d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875909, "uuid": "cc3a6f7c-92c6-4fe9-845a-ac4aca415d53", "value": "rubcopfkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e62f1c-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "0d089cc7-1c71-45d3-ae82-00e5e9fcae35", "comment": "Malware payload (Mirai)", "value": "cccce3b1923542c91d47a455d13c6635", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "e543724b-c8ae-4f0c-94e1-8276fb04a16b", "comment": "Malware payload (Mirai)", "value": "89324506c0907776ed44a27fb5a369a092b25ad943e72300ad0d04ba1398c17a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "424909cb-f393-4d6d-9678-a61464857adc", "comment": "Malware payload (Mirai)", "value": "e6588703d76d4a843d2250a08d58c56d6d4ba942", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "16a9b9a9-5f61-4777-90ba-4a7a9ddf8eed", "comment": "Malware payload (Mirai)", "value": "a2e0d7f38ba1cb91eed292d05184ee60d5172801af67ed98751afbc5ce7e0d454457933978c87681d7c7e73f6042c12c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882803, "uuid": "03565bab-70cf-4916-8a8c-1de8cbc2a7be", "value": "T18CA34B36B874192FC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882803, "uuid": "a2f88dd4-7514-4871-beac-b9eeb3822071", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0ooj:bbbmPTO930bkbRl886oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882803, "uuid": "e1c81a2a-9254-42db-a353-3eff9c395e9b", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882803, "uuid": "c7ebb895-e2ce-4f04-83a9-f4b6b4ea5e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882803, "uuid": "8c02a1a7-16b0-4428-8474-bc3384585722", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0eb329-6beb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781879614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879614, "uuid": "89f95d8b-ed93-4a2e-936c-3ab396018dad", "comment": "Malware payload", "value": "4a1aa3c64184e9bb96d7a58d216f9832", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879614, "uuid": "393a9669-90e2-4a8c-85d9-30c3769f57d0", "comment": "Malware payload", "value": "893319d1e55320b7ece901b959aaf80d9badb6b8098c8dec72596105fd6ea192", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879614, "uuid": "de758762-3555-428a-a4ed-9fb00c79a7d1", "comment": "Malware payload", "value": "fab4e1cca33456d042f2221f6a86beb5952f8045", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879614, "uuid": "7370b112-7923-46e9-920f-d84a722e52bf", "comment": "Malware payload", "value": "73896bce54535c517935816c1ea64c709b67ff8ef269d9443ecb208e2aaf69939bdaa98dd094858886ebb9a39ac3d972", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879614, "uuid": "592f47da-cc34-443c-8c27-43d6ba159912", "value": "T16925FB11CCB7F048B20BC9412A7F28764763EBE63EDDB754B7518096BB58628E442E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879614, "uuid": "1a9d5110-63cf-4b51-9bc7-9e6faf9f74a9", "value": "192:LRKJQwBLVw60ZaglfUZjO96f2GmsNzu2SLQNCY:/DlfumImsNzRSLQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879614, "uuid": "44454756-aa82-479c-9149-d6607bc63854", "value": 1031536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879614, "uuid": "1b2ad0e9-21aa-40a2-a4f5-2d3a764026f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879614, "uuid": "15e94b3c-1711-492e-8076-50cbef968afa", "value": "svchost.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f978b717-6ba9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781851320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851320, "uuid": "1322f4f0-ba1f-45e4-884e-42810117385b", "comment": "Malware payload", "value": "e0e5872a7d0983d8544a135843d53a7a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851320, "uuid": "868e9afb-3777-4cb0-a3ae-0592b89834fc", "comment": "Malware payload", "value": "89a6e6573ab658f6be25944a4f80af4e7994cb28117184dfc9bbaabcd121f0be", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851320, "uuid": "c410ac06-1b64-4807-8d2d-4385aa6eb10e", "comment": "Malware payload", "value": "0912fef2bbbb327e1ce3be591259bad28a4f7cdf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781851320, "uuid": "70fec468-236d-480f-a842-d6aa140b9c76", "comment": "Malware payload", "value": "86c31e0081b945470fc76243d53b2d79bb6f72d866e81aa0885cc6140eb4674d43843d2c052c402f2fec8374ec515e39", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851320, "uuid": "c6fe9bdc-69fd-473c-80d8-7ef2b2d0ef87", "value": "T152136D6566913C24AE9998371D7E1F0CBDAA83E23104A1DDBFCB3CF18C55A9CE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851320, "uuid": "7d06aba3-5b69-4adf-a151-ca4f9e64e48d", "value": "768:RXRWNGxVj9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:rlxecy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781851320, "uuid": "32a1ee11-6995-432a-ac73-3a336f9dcedd", "value": 45216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781851320, "uuid": "35a114de-3069-492d-b771-3aef51ae5fe8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781851320, "uuid": "3b76d250-914a-4ec9-b9f7-4772a0efb126", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2a5f53-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781886837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "bf1b1f4d-e477-41da-a256-ca728b35eb42", "comment": "Malware payload", "value": "c34c7fec225bf2751bb9f9d8a3170dbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "8fea748f-a880-45fd-8ac2-501ee36d34d3", "comment": "Malware payload", "value": "89cfdb1c3e7b9cb97d84bb36bca178fb2e76a0b340fbba69a9b66b92fda38dad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "44bb0f6d-587c-486c-8597-8dbba0b53f1d", "comment": "Malware payload", "value": "b72db5ccebe0df727d137823a34c64a91b83c6b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886837, "uuid": "d7a8d9ca-eb31-483e-9ed5-4834ac76359e", "comment": "Malware payload", "value": "d164102cd13a7951a99bdd3606549a3bbb596c7d707dd199b07e8b6008262867585631c33fa163a5e8ccaab280bc4fd4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886837, "uuid": "b15f0a5c-3c0a-4b47-8d02-384c16567cf3", "value": "T19E21320CF7107A1FCD6F65391A6B470A10343F75E41305125B686D36BD770C1BB2928D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886837, "uuid": "c6dac378-27b7-490c-a52b-4329f53eb107", "value": "24:3rL8i3gVcjwjU7FAFqydJiEEMQ5vgKKtDSbQaOMkm1849q7oxLwNTX6Q:ci3gScjUFA8y2MUoKKtDSkapDvq7NNjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886837, "uuid": "80d34097-aeb8-4574-8963-6ac782aa6323", "value": 1224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886837, "uuid": "4ace2a9f-623c-4eec-b7bf-bca79586e1fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886837, "uuid": "cfa884ab-2e64-49b8-8ca2-09031504c0cf", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4820138b-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886241, "uuid": "a13f45bd-7cfd-4bf9-817d-d1e325c773e8", "comment": "Malware payload (Mirai)", "value": "0cee7019a7b41939940290a2f5f8b732", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886241, "uuid": "2416a554-2e31-4da1-b320-55de10ceb1d5", "comment": "Malware payload (Mirai)", "value": "8a86f0006f8ca3bf97e7f02d3d5281c739b26bed5b04a886fc88ea3530e6d5f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886241, "uuid": "f3a3e503-0f00-48d0-8348-501756be45bd", "comment": "Malware payload (Mirai)", "value": "2ca7c68a8975bfc3576a31d43fceef5da8087b55", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886241, "uuid": "6bdf8188-9ea9-4c8c-8015-34ac14b300b0", "comment": "Malware payload (Mirai)", "value": "27560c89161b47a974d5ffce9b2f4cc6f92292b62c0295eb027352b12a05bc051eee1102a6a5c4816544fac01eb13665", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886241, "uuid": "ef8e994a-3ac2-4662-9d80-98dd0cd6c5c5", "value": "T126C3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886241, "uuid": "7ae666e8-3106-4bbd-af86-fa710359e214", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMYN:MwCvdHmezn0nUPMu9KryXsMYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886241, "uuid": "96176961-3f55-489c-86a0-57f88e0890af", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886241, "uuid": "dfbc010a-98a1-42e3-b560-8b24620ef3f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886241, "uuid": "33977c53-7aa3-45ad-bfb1-07ee6976894a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ae0ff5-6bbd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781859610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859610, "uuid": "258464ef-23bc-4fb1-ad44-39e9118815a0", "comment": "Malware payload (Mirai)", "value": "f238298387134012f2bb33dd7ba20a62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859610, "uuid": "da9e3832-26f4-4b86-af9b-58941c19aa79", "comment": "Malware payload (Mirai)", "value": "8b3314ebaf457c3602bfa8e0539400db376b5a606c97a8047673b1a550c9c49a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859610, "uuid": "64ad07f3-0a83-4970-9a9c-ab482dd9fb3b", "comment": "Malware payload (Mirai)", "value": "82936432fa3268a17becaa9e0af3ece14d368c08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859610, "uuid": "3e8b6bdd-140e-4093-aae6-e6e93cbfc587", "comment": "Malware payload (Mirai)", "value": "a269af51c8a9e298948989a0f1b44a732c045db1621d74acd74d10c017b421dabd1331cbe6dc59626c350dae788b5c14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859610, "uuid": "cfaa91b0-e0cd-4a13-b644-c7f8b423d61e", "value": "T1BEB30945F8504B57C6C652BBFF4E82CD7B2A175CD3EE320399296F20379B9660E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859610, "uuid": "2f30c2a1-ba25-4297-9934-f5900079db51", "value": "1536:RLtoBI8nAncx4VsgzF7nojHm9OSXi0At5l6l8jqwywV0tNFz/xJ3zsEo+5v8ZJIg:R5o+8np45R7oLNF7VuNwFm8JI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781859610, "uuid": "99a8dd54-fe2d-4fce-a176-87ddb1a40996", "value": 113260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781859610, "uuid": "385a6c51-9431-4ff1-acae-117c721caea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859610, "uuid": "c271f041-3f7b-4299-bb66-ce5c7ca3de38", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98466a8-6beb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781879613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879613, "uuid": "ec573dee-7d5e-4cc2-a6c5-60348ad91ae7", "comment": "Malware payload", "value": "b718b4bbc4deff7ee65d9aa425715bb9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879613, "uuid": "0ae83653-2fc9-4d4e-b3a5-f24b6c4e9ad4", "comment": "Malware payload", "value": "8c975ee0ff72d187ccf7b9cbeb6960c02489df9c2a2800170ded747bbd3f63f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879613, "uuid": "8dee1b59-623d-4754-beab-653f224316bc", "comment": "Malware payload", "value": "d4329f96a9ccbc85ad2104e79cb86af532fcf5c2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879613, "uuid": "d6a22cf1-d5c9-438d-9535-4afc5e2a3924", "comment": "Malware payload", "value": "3fe9418c90c0f8d36379ce2f9518410f7a8cc381196e97c8f0d67eee4c35e67eac9cebe9a45757b2e34b7dbe910295c2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879613, "uuid": "79d0349e-9baa-4fb8-8dbe-54e6576550fb", "value": "T1C9251DA13D7790D8FCBACDBEFC632D81461AD51238D927392243E182EB45561EE32DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879613, "uuid": "5673fa53-eba0-4e6a-8f73-82aea625ac1d", "value": "3072:0zzznzzznzzz20zzzkzzzzkzzzzkzzzzezzzkzzzzkzzzzkzzzznzzzkzzzzkzzo:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879613, "uuid": "61eaacaf-2125-453d-909c-0b9598d71c5c", "value": 1031536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879613, "uuid": "4f4b6351-ca17-4038-87e6-7e88d1ccad2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879613, "uuid": "185baffd-2946-4d4a-ad4a-fbccc1de7cad", "value": "sostener.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3866f086-6b89-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781837252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781837252, "uuid": "659080fb-0483-4d0c-8080-46dd7e30e935", "comment": "Malware payload (Mirai)", "value": "6082f9c1fe1141f8ecd5181f5c91b78c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781837252, "uuid": "c78c94e0-64c4-433e-9dc5-c5d3205093e9", "comment": "Malware payload (Mirai)", "value": "8cb508594fd08b9616245426d8f086d2e386a2d5c7d6aa9dae9145fd252be517", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781837252, "uuid": "1791346d-6a8e-4b36-b74f-55d892c417a7", "comment": "Malware payload (Mirai)", "value": "c360ddb2abb85008b075ef69a9b7f0e1f862e48a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781837252, "uuid": "084cb008-d371-48fd-a099-b77ea5a5e9b7", "comment": "Malware payload (Mirai)", "value": "30677df5f11e8338a72c75b0b661ecf9cf8f2065502a422dd30d440cb27514ddfa571fa11fe8bfe0e273909c728c4628", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781837252, "uuid": "5ff3b176-285b-4453-b18e-97bc4d6bca59", "value": "T1DDB33B41BC82565AC2D6637BBA6E968C336613F8C3DF3116DD114B243B8A92F0E77B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781837252, "uuid": "c4d737ac-1000-4f17-920f-9eddf9ccb3f4", "value": "3072:JoC79SEh4iJb9bkTSLoURCr9eHb+FECr6Na/lj:JoCs4f7CS1Hb+BrF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781837252, "uuid": "768db407-2c6f-4bdc-b02c-f1fc25ece57a", "value": 112556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781837252, "uuid": "7e4f4231-2431-40e1-8c07-daedd62c68e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781837252, "uuid": "2421c375-697f-4c1c-8cdf-150aef54646b", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3c2ef8-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781881178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881178, "uuid": "83d76f6d-fb3e-45da-a83e-d4292efbe427", "comment": "Malware payload", "value": "b1546f1ec88a181fe599922671dd9dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881178, "uuid": "672f2ef8-bea8-43c8-aac8-cf8a4f3179ee", "comment": "Malware payload", "value": "8d435497203598ab6ce153ca32873ff779c6db7945316c53328383a79d2031e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881178, "uuid": "242ad299-3309-4d19-9d15-55a158231189", "comment": "Malware payload", "value": "30a14de1d7e4567170da50b1f214f47fa622e76b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881178, "uuid": "7d08bb8a-31a3-4627-9443-d4c26c2cf2f4", "comment": "Malware payload", "value": "1124521b519f7cf9187faa3bfda6e5671e844a7058eff9f9eaed5d5306e8268fbc11213e4deb645c320e09c1fac4f3f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881178, "uuid": "d2be4888-67da-48ff-a3b3-2de0ed4cb509", "value": "T160C53907FCA108FAC0AAA23189B356927B75BC591F3227D32E50B7782F726D05D36758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881178, "uuid": "2a78d767-19cd-44ff-b22c-c2509822d50b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881178, "uuid": "3ec814a6-c84e-417b-87c9-f9472b001399", "value": "24576:v8o1ypxx91j5+bgGJoFVd5p07GAC6rhoamg8vA2Bele5IK2mldQQDc/mrS6J:ko1Ovfjag7bzsDpoVgR83t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881178, "uuid": "bc0de1bc-3e80-42af-96ac-c5efca651deb", "value": 2496336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881178, "uuid": "929f2e6c-73df-424b-8c37-94d0ba6104f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881178, "uuid": "de6770f4-8c33-4195-8094-92756924ba60", "value": "\u0441qdt\u0430\u0440\u0440\u0435r\u042564-v.8.199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43df0c71-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882798, "uuid": "6db95e18-10c3-4bc6-b459-6f7b51ee4a75", "comment": "Malware payload (Mirai)", "value": "23a61ce5e114da9b01fdf5a44dc800b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882798, "uuid": "bbf2f74d-bf66-4112-9601-ce7adb07be62", "comment": "Malware payload (Mirai)", "value": "8d50448f4f30dc65c33f0ea3ffa1d9ab5fbb106d3d5318f784bb19e273c13010", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882798, "uuid": "47605e19-fe5d-45f0-8b3c-efaa430b527a", "comment": "Malware payload (Mirai)", "value": "a1dddff80388c070e120b21067ff5c50402144e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882798, "uuid": "209bb40b-57df-4504-bb6c-bba185c38b98", "comment": "Malware payload (Mirai)", "value": "0a2494c5fb143e79eeffb508da664611dae1a00fda6a055331b517bdf6f3a62becba00c374007768c73046b53a98780a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882798, "uuid": "8116daea-a15e-4272-91d4-6516df1737ca", "value": "T160933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882798, "uuid": "a134c916-e032-4081-8299-06cf8aaa8fb4", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2DH:eyxt7W+G+3QBBntmzg6d7WidDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882798, "uuid": "579f3835-0ce9-464d-ab08-4626aaa129ec", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882798, "uuid": "528c6b3c-7097-4c3b-9ca7-7d043fffda0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882798, "uuid": "80bfd081-d251-4d9f-82a6-c089059223f7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac316c6-6b7a-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781831109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831109, "uuid": "e329ed01-d6d0-4341-b4e5-bd3bff2a453b", "comment": "Malware payload (CoinMiner)", "value": "c30c89ce2ea25b2aff4c8685d336631f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831109, "uuid": "9ed36841-7727-40a8-817d-37e1bdfa82ed", "comment": "Malware payload (CoinMiner)", "value": "8d5fb1aa1eead3de107ec5b99178d3c8d48b23b6116554cd9319538735c3d7c6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831109, "uuid": "12c60b51-2c62-4081-8eef-2ba34b4560cc", "comment": "Malware payload (CoinMiner)", "value": "875655956b204974c09e9ae49bb817318d5d494d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831109, "uuid": "6a130aa8-a4a6-4a34-a967-d1b6471846c8", "comment": "Malware payload (CoinMiner)", "value": "fdc847cc8c6732f01f9347c07d19c94cca7437f6455f177c9c0344370e100c24ad58e7445d0d4221c57070a116f94e90", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831109, "uuid": "f484f172-d43e-4e0b-a306-33f4d1d7ddd7", "value": "T1EDF53355A4D12578E9A9CE32C3BDFF18D23271264B427EDF01B4B32468773C6AA2EC45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831109, "uuid": "eea33066-364a-4add-9ce9-015702234d28", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831109, "uuid": "53fa6fe8-0ffd-4fad-b8d1-b34c23ca1761", "value": "98304:oHBmvp3CVMNsK5oSvA77BqrfHhgBufPYp:iYh3YSlrvA7uhDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781831109, "uuid": "7654f7bd-94d8-49d2-a42e-412e90fd089f", "value": 3446760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781831109, "uuid": "346f0deb-ae23-4f33-9a42-1f5b63e47164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831109, "uuid": "53193b25-3ef6-41c3-920a-d1b0d612e2c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d1b791-6b8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781838293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781838293, "uuid": "4088ec70-99e1-4cab-8de2-9e67d3f0534f", "comment": "Malware payload", "value": "954dbf202716981aef8ba18ddbfe08c0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781838293, "uuid": "21e2dd9d-c89f-48ae-b386-62d9142faa1b", "comment": "Malware payload", "value": "8def1ebecb7f52c55229bee652449ca379847f7c2f8bf8a37efcff479d3c3298", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781838293, "uuid": "6ef82d48-4e69-4c9c-a08c-f389b1698df6", "comment": "Malware payload", "value": "156fcb118ab551d7e05fa9cf1b688480b164a0a5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781838293, "uuid": "0699db97-ed04-4b1e-a24e-cb139d15b3d1", "comment": "Malware payload", "value": "6c2b01024eb54fad5dc8a15ec49a626daaf340f5af0738b6cf66158c63656994ef8d8bd0a79c801232de7bfd1ff204b0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781838293, "uuid": "4080616e-3fcd-495c-9cd9-92cae021ba81", "value": "T14ED09793D17301B010E98829E0D3B980B6224F7F4E84C22EB86328742F09A08B0C0364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781838293, "uuid": "b7a23b1e-d425-48ec-a711-ef6b679021b3", "value": "6:hToWlQ9qcZ3/F7W4HwAulNXYq4HvXDG+NjVsNXYrkJ:VIjZoKwPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781838293, "uuid": "8e8c1903-c238-42df-b658-bcb61b3f855b", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781838293, "uuid": "442bf7eb-494c-4097-a29c-db530f4f3cd8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781838293, "uuid": "d209652a-e538-4236-bca1-8ec776d796ea", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a86015-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886913, "uuid": "aacda169-33db-487f-84d6-58cb86a01074", "comment": "Malware payload (Mirai)", "value": "7bddde1953297665bf63a78f9bc4757e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886913, "uuid": "8a6ee71c-9e88-491c-a1e2-d0e5252c907c", "comment": "Malware payload (Mirai)", "value": "8f770aa0c277dc1537304b5682bc10f288c00d58a8fa3a63aaab22df3b2ad1ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886913, "uuid": "c79bb05f-dd35-4041-b561-d3a28f30acdd", "comment": "Malware payload (Mirai)", "value": "b46f5096c2f514bad3a4e3d083ef556923656689", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886913, "uuid": "d6e65fd8-e000-45ff-9877-2584bb244404", "comment": "Malware payload (Mirai)", "value": "f44eb0aa178d9b0446afbbc7899d65c2c07d30a5643e3bd57d8acad84d9bee2cc35729c0c9eeb67a1923222b21a741ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886913, "uuid": "668d181d-428a-46a0-9571-31320f901ac2", "value": "T1EE045C01B70C0A43D2A72DF43B3F27D1D3EF9A9021F8E644651FAA899271D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886913, "uuid": "bbe234fc-7ec2-484e-8eec-c6b5956ad752", "value": "3072:M8DydhO3AHxNRxvK7MUMDb0EzwAqT3IKW:M8pOxvxvitMDIEUAonW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886913, "uuid": "ef857857-c1a7-4226-b2c2-53516c0b8aa2", "value": 178820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886913, "uuid": "2b338c4d-65b1-4fcc-92e4-21a884df2bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886913, "uuid": "dccaaa1c-aacb-4729-9490-baef586af1fe", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971b05f1-6bfe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781887662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887662, "uuid": "6f2aaa20-b668-458e-ae1f-15d617f2ba58", "comment": "Malware payload", "value": "681866a55cf1b2939ca8413b33b807a8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887662, "uuid": "d636e4ad-9c16-4091-8590-322b7c2f7e6c", "comment": "Malware payload", "value": "9332cd4e9ce6ed2b6f53661ab38877b512826fb84f7b1d4465edbd9d82136d1b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887662, "uuid": "810e2f20-e1b9-44c6-b5a8-401d37f5d2fc", "comment": "Malware payload", "value": "a9fef75cedbf61ea96c96e13d8592abe5a4022df", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887662, "uuid": "215bd7c2-acc4-4ef8-b363-52bb6e00af60", "comment": "Malware payload", "value": "2ea84c31c8144664a57c0cd79b9bf62f064aaedb36f4a093b9b262ce2ba1de4d53834bb8ce41da97d6b36b82f24f82ee", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887662, "uuid": "e5f4f495-fd66-4db9-a683-de6c5d1d342e", "value": "T10A824B0FB8424726D0E210B49676977BDAB96872338414DBF7D44AE90B686D5FC3311F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887662, "uuid": "80fb5f4a-4d36-4ec5-865a-7eaedf60354d", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887662, "uuid": "30c20259-e29e-4352-81d2-0b45bb66e8ba", "value": "384:SIqQlV6lvV+v0CvBu9JgwQcOv4av8U9cxF:Ig0IE9C4a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781887662, "uuid": "70f72c49-d566-4a5c-ad64-5303b35ec49c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781887662, "uuid": "6a603671-1ee3-497d-bcde-99964bb470b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887662, "uuid": "444abcd9-5948-4dfb-952c-8a149a8b6e68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec344af-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850121, "uuid": "5ad0eb97-a1f7-4c8a-8c1f-2b1c681209b1", "comment": "Malware payload (Mirai)", "value": "29393fb7d6c1dd210eae301b0097532d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850121, "uuid": "f74e43a9-1641-465f-ac43-7eda71502c37", "comment": "Malware payload (Mirai)", "value": "93a0ec09e2335cd28d4a96dcd66e809f85fb32553a763281033ec28c48cd4b5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850121, "uuid": "82d203c7-049a-4a1a-8595-437d6b657317", "comment": "Malware payload (Mirai)", "value": "ae2c124be7914a1c3c214489f342c1b89fc2b9d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850121, "uuid": "6236028a-79ab-46cd-8155-7ddc0c72a33a", "comment": "Malware payload (Mirai)", "value": "b5dfb5f0820d5004292f63780db04e04c3cf658847cde70f8d32da4dbc5a013605483d0a5cd2fd8a25a207ef7eec466e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850121, "uuid": "e127d1ab-dd43-4620-822e-a3398cb3be71", "value": "T14EF2F12592260969F5D214732A9E1FB01FDB0FB26683D5A46E91A963EF432BC30C72D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850121, "uuid": "89362da5-184d-4dd0-af7a-60cad083488a", "value": "768:UlWqYyhCwSYafk1BqIm/7yaTCcs+7/shQdqQ2qSdhRJgGlzDphMgE7:3q+ZYz1BE/7NHsg/smKqoZV0v7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850121, "uuid": "73d9bbb8-1b40-4360-b670-f66e10b84dd1", "value": 36360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850121, "uuid": "56c766fe-2939-4a4f-bd8f-2177034edb30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850121, "uuid": "a1582a98-cecc-4524-bc7a-ba2a5a4776a5", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf6a7f9-6bc3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781862382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862382, "uuid": "a36a1abf-f069-4942-88d5-9dc18c9f9212", "comment": "Malware payload", "value": "e7e0cc0f91eff7a9e5c8bfa6174e690b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862382, "uuid": "8090e410-1823-4a19-b76b-be747ff4f8d9", "comment": "Malware payload", "value": "94b5cfdf5039324b106687db0982d5cb373f743ef988dbca032c18c65b6c4f55", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862382, "uuid": "4cd7cb40-c44e-4dfa-963d-f9a0f04eae3e", "comment": "Malware payload", "value": "de1a32dbc1175f3b7576a3181d96bebf3f6d4061", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862382, "uuid": "d6292793-473e-4781-9723-0e26d9c38c27", "comment": "Malware payload", "value": "fcaac7023f00f0f310ae9261d90ece5087fad7af576c40506a3cce237eba8ee24d07652329b62003a9b0c09cb1bd5bf3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862382, "uuid": "0ead1bb1-8c9c-43a7-92e4-83989dea12ad", "value": "T10E3172DB81151A395602CACE7B773918B11C86FB2C4BC7A0DC0C4E9AC6C86DC7152FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862382, "uuid": "e0b405e6-9c47-4193-86fb-b4eaf6f309fe", "value": "24:HoXo9So+5w2a4aoWBmHXmEoRtnKtVpmSVp9EiuF0:HEwJmERtnmDVK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781862382, "uuid": "543c4ea9-6560-41db-b090-8c6bc86d9a65", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781862382, "uuid": "2832fc21-0a26-4b3c-a59d-dbff84b05222", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862382, "uuid": "3a3f40e0-7c4e-4895-8178-ec7bb470f890", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e86aef2-6c14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781897016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897016, "uuid": "e4ebbdac-46d5-4ec5-8904-084540a2be4e", "comment": "Malware payload", "value": "e243cc6df48a3156c294139132fd43ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897016, "uuid": "7bc49cd8-d570-4593-90c9-8baaf8b98e79", "comment": "Malware payload", "value": "989d2c66878fa727c0c9dcb8292e0a8f42c23c7062f6c815cde854dadcb24a65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897016, "uuid": "6e677cf3-21ff-4bcf-a7d4-3561f932acbd", "comment": "Malware payload", "value": "88b4d36c568697fa18c2ff5dd17e21d76a9f42c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897016, "uuid": "a7d029fc-88c9-490f-99e5-663662b9e586", "comment": "Malware payload", "value": "dab22aceb23f6183f0d7aa5bd1150b9785dc5dc3d5bffd4f9c5268e636c45f99917684ddbc338315d1fca363797d6aef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897016, "uuid": "34d5a9d3-2a60-44ec-871c-ae883ea618b7", "value": "T1F8D3F809BFA00FFBE89FDD3305E90B0A258D691763A93F367534D818F59A14B0AD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897016, "uuid": "dd16c8dc-e2ef-4db1-8e2d-06319a543391", "value": "1536:VaDX1uhtGm+wZOeD+P7ZVq1bBRyBYJzhasC8fHDLt7Nqlj0ju+7QViI9cLuIrpCC:Eb8Wxqsq16sC8fftkOyiI9cLuI1qWK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781897016, "uuid": "ac17a20d-90f5-4137-ba02-0229a0c3eee3", "value": 130224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781897016, "uuid": "0f09f24a-a833-489c-ae7b-3651788af9d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897016, "uuid": "7ae904fc-2c5c-4b1b-bcb8-6a6e85c395f8", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d5f6b5-6bb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781856874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781856874, "uuid": "07542d4b-d68c-4589-a0c1-f134669d24b2", "comment": "Malware payload", "value": "171a356e959494170f0f9d8a7536e684", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781856874, "uuid": "1ef6507b-a5c3-43b2-8443-a90419ab0c90", "comment": "Malware payload", "value": "994a77fad92b7ba173483358efc7afc3bae565f9258b98d3c5c1a0fcad948d6b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781856874, "uuid": "395e9459-59c1-4ad9-ba33-f8cf24b505b6", "comment": "Malware payload", "value": "3ddb0da0a9600a726221c00e51ae8a8ce9cf8664", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781856874, "uuid": "3e7feb6a-e679-43f8-8900-c5393ab44061", "comment": "Malware payload", "value": "adb1336ca989c6ce268c19316d421d67a5229a042604e96907ef9a5b5c6f64d559bbc01b462e30a18150c1f9ee48f0fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781856874, "uuid": "052fb5bf-d188-4829-be4e-42b597a90129", "value": "T18C05E83DC9A4002DF1B6E618C86A045FE9933A4B513CD90B61DA2B4F2F73946B7D236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781856874, "uuid": "a7d06989-4632-45cb-8c39-5288aa993b35", "value": "3072:/y6MVExHMx/nubvFAxLQu3h1P2ZByv/sF0FQUslP5/+WOzHAieTfrKxkllNj8f9L:SmKLQu3y6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781856874, "uuid": "e62b6694-551d-4dea-8f1f-dde20cd4576d", "value": 859004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781856874, "uuid": "2d9510d5-1094-483d-b47c-ee0b7ea372ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781856874, "uuid": "48de87b6-6506-4115-a3e4-7a88bd30762d", "value": "ANTWERPEN PO#1 2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c7b625-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850138, "uuid": "c3433bdd-8fc7-440b-acbd-8ceb19ec580b", "comment": "Malware payload (Mirai)", "value": "b0c1c3c0710c2c76a94e47aa659f5545", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850138, "uuid": "50d28cd7-d27e-42ee-bf65-85f14579a9e8", "comment": "Malware payload (Mirai)", "value": "9a73f2943cbe4f30f0885d491fd72791f42914187241d5cc5049b6326571c231", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850138, "uuid": "1fe96e7b-d36f-4c82-b795-bb16c020e7cc", "comment": "Malware payload (Mirai)", "value": "b8addb3a0fb0b60d5e69c1de803dc4e39fe4ad04", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850138, "uuid": "5a298a0e-4238-4adf-b590-55e3cb04c225", "comment": "Malware payload (Mirai)", "value": "766fc2f3bd0f04539a62fa18e55b8d9955cc6fece2f809a543b373beeb8e52018a7a3a38720c1544092ff36e7cfd9478", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850138, "uuid": "9f1a5e84-6536-4dcc-a8b7-2d92a93940db", "value": "T1DC767C92F708A139DA4A0A3248A30F74B3912D47C1F989AB9709F72F05B16F7595FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850138, "uuid": "a926776e-0701-4743-918f-bb1f57092033", "value": "49152:j6smbUdg+PNciRzCcEzEz/8gsFD1f/tHTHjHEEHHEU+i+HHE+jHY+EH+YYHUGHHP:YUy+lciRzCcEzEzEgCFGd1bUnUjEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850138, "uuid": "cf72762e-ddae-4bcc-89be-7d972912f618", "value": 7209144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850138, "uuid": "e3b85dbb-25fc-442b-bd6c-5bcd4cca1e83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850138, "uuid": "56dc51b4-1f4c-43b7-a8b1-ae2c3193c776", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e13c33-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875906, "uuid": "745b0367-33aa-4f92-9023-cb7810a3ca80", "comment": "Malware payload (Mirai)", "value": "6ade32267eaf0171ea73ca73e642f8a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875906, "uuid": "0a863be1-6110-4e6b-82e6-83cdc347ff46", "comment": "Malware payload (Mirai)", "value": "9b3c5541a82693532e9c61b95ecca277f0f2de013ba0169e0d427b82c342fbc6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875906, "uuid": "5c9f04e2-a8dc-4572-9124-a4b22c103583", "comment": "Malware payload (Mirai)", "value": "6e353d3e35d9e6b1704b9c4d5430e2e84d250544", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875906, "uuid": "0ab87a23-89a4-4630-81ac-e5ebd9cd0dad", "comment": "Malware payload (Mirai)", "value": "50d787ffc652866edbf42efae1485cb81c9366ecff97418a62fcce2dbec7e6f19b25453057092cfd655f93d816e82072", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875906, "uuid": "7277d65f-3a10-4fa7-a9d2-d12f82783495", "value": "T1E203E1EC61E26C4BCACECE7875CA1B915D11B9C028DF677E2712494DCB65992B0AC0BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875906, "uuid": "804b16fd-9fd4-4453-97aa-b51f64b7d31c", "value": "768:V5YEbf0/A3F/m80ZKWdftUk5OETKbpad0cGKcnusGi4e6g8CH6R+7kKi31eWZ:VKEoImnZPd1UYOC4K0cGN0g8c6R+7kKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875906, "uuid": "620c4327-a94f-462b-b143-0c4744715e7d", "value": 39432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875906, "uuid": "02f0b8ca-1721-450c-b64e-7bdf530f6d11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875906, "uuid": "21b159c5-0b04-4bc9-9632-39c32a78f27f", "value": "kznpkpoyh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd29cc42-6baf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781853823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853823, "uuid": "d1c4f226-fa58-41df-8725-a8675e627e1b", "comment": "Malware payload (Mirai)", "value": "0961410bb8d3401cfb0a814f6553c4ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853823, "uuid": "cc249179-4b53-49f6-9f37-3db5292e6e5d", "comment": "Malware payload (Mirai)", "value": "9b6c432f0a6292bcb510d15fbddfcf47a43b68d7eb14316cbfadad40b201c84c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853823, "uuid": "5051c9a0-bdee-4b77-8e87-ef06160844a6", "comment": "Malware payload (Mirai)", "value": "d83ec751c33aae0628ebc0fd3acd32c33097e671", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853823, "uuid": "8fbd0e8e-f4b2-4c28-a679-aecaca340fc7", "comment": "Malware payload (Mirai)", "value": "75084d55fcde3eddf261dd916a516b38dee8cd7e19bd9d537a7e1aa6a62020f7c09367c171b5732051ee957525f2edcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853823, "uuid": "ddbad678-afe3-48f9-8f8c-a45bd9761043", "value": "T1A0730295E6891D07D6B32B75AB35C8136F5332EEE1E22398F051BF9CBC1161E20E464B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853823, "uuid": "83140f4c-ed38-4d97-aa6d-0ed442c577ef", "value": "1536:RKxL6RggzRLSy4cI6TRW9u7TvQhAwxHWQVs8tTLM5pzo:YxeRgsRLccR8U7TohAwxHt6N5pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853823, "uuid": "4481b13f-dbd5-48b3-be75-f6fd1e9eb45b", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853823, "uuid": "948cdb28-cad3-44f0-bc29-780f1b817298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853823, "uuid": "0ae2f867-8760-4b6c-889b-8bb866fb9296", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0c23ef-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850173, "uuid": "47a0e00a-19ac-49ea-bde0-dd55d3609627", "comment": "Malware payload (Mirai)", "value": "ad6e65287158713e3f0852eb225587fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850173, "uuid": "bfc6b5cb-64c7-4522-b632-db5bc19c732c", "comment": "Malware payload (Mirai)", "value": "9bec31a73c4242d2b856ef8bd4cdfded64ce9cf43be02abe3488a4c238ec1e25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850173, "uuid": "47f6cd33-7a9c-4d02-9ba7-f036202610de", "comment": "Malware payload (Mirai)", "value": "74469b8706e895fde6692cb6876f2355c172b522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850173, "uuid": "7d7b6d07-0c4c-4db5-a30b-cb4319ddd7ba", "comment": "Malware payload (Mirai)", "value": "fa2b4b586db25378383a0f1f7a76944ac4f3602b72acb4263aa029e568bd806a4f6ae730fdeb9b1bd702bbff57a83845", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850173, "uuid": "2833eafc-0792-4938-abb4-da57d32a2dd1", "value": "T12E93D506BB650FFBD86FCD3746A9071239CC550A22E93B3A3674C91CB51B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850173, "uuid": "76c921d2-40d7-4757-9748-306b5a7bc5d2", "value": "1536:lX1tMe0R/thiZMZE6UgaLiVw0FmWnM9kyXZLHLQq7V861yMRVz8Z:lltMe0R//pEZ5Wn2XvJVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850173, "uuid": "613d9eb5-d5a6-458a-9406-c02d676025d8", "value": 93464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850173, "uuid": "ef60f05c-a021-422f-9f18-01d1bee3f7e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850173, "uuid": "b1fc589b-ebfe-4172-8cb3-7301bfd9a058", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435480f8-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882797, "uuid": "921adce0-3a16-4ff0-841e-5dd253c58ef4", "comment": "Malware payload (Mirai)", "value": "bb4da7e2857f4754bb516ca1c86c7d9b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882797, "uuid": "850a649c-0ee5-4fae-a749-37cfae781dfe", "comment": "Malware payload (Mirai)", "value": "9d7d2ced32a18eed328e6ebf48d6165621c307ff1b1117383728c0d76cf22f9c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882797, "uuid": "d7236bc6-84c5-474f-8d7b-92537408675c", "comment": "Malware payload (Mirai)", "value": "93bc7e3468626d5cecb73f95f62e93ae1a7cb7c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882797, "uuid": "28ae0663-9b97-4c7f-9fed-491eeca22de7", "comment": "Malware payload (Mirai)", "value": "ba77304ca296747aa07c79f592a85f2bed079b3ec3edff8bdefe251beae18b94805d926f86bd9d6fc41c133f558675f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882797, "uuid": "f7e724ad-2f4d-4bac-81a2-222f2d256002", "value": "T19C932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882797, "uuid": "81098b57-9541-4e32-a195-f93629e72e02", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2z:AGUJtkyYEETn0T32TDBf0nsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882797, "uuid": "3c717899-51e8-453c-8836-0afef27f0261", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882797, "uuid": "850626ed-eaa1-4b72-8b11-64856f3ba4b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882797, "uuid": "1d29adea-6f35-4d16-b18e-ba56eb530e03", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96da5d0-6c11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781895988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895988, "uuid": "f91c94de-d235-4de3-a2b7-bcb2958dfed0", "comment": "Malware payload (Mirai)", "value": "cf5b2a868d7ad8041d28b17dda696f6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895988, "uuid": "5080736f-5aae-426f-9139-4549fe87ca48", "comment": "Malware payload (Mirai)", "value": "9deec974a7f54159d120967d7f07dcabf59935ee4f8f656e041f716d37c63286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895988, "uuid": "7d65b990-1dc3-47fb-8baa-1b5efd56f232", "comment": "Malware payload (Mirai)", "value": "06de8f210459d5b1f2ebaf62af639678b0d8e0bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895988, "uuid": "e2b2832d-00c3-45c6-848e-7556a7f20f8e", "comment": "Malware payload (Mirai)", "value": "8dccc7f7d6eb91ade0428898025d39f7b15785218c60ec9059f51119cc50e8dfffced93ab9a0b2c86dfb33ac3c305657", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781895988, "uuid": "f0c51ca5-7f5f-4942-a42f-b68a8723e0cc", "value": "T18CB32A42BCD2565AC6D6637BB66E568C336613F8C3DB3116DD118B243B8A92F0E33B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781895988, "uuid": "ae00b52b-8ddb-4ef9-8077-8ecea7638e6c", "value": "3072:uVoDzds/C6DUzoZo2uioGrmlkxEMvq7c46f0a30e0:0oDqq01XuaEMvqY4M3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781895988, "uuid": "c0f3c539-87dd-43b2-877a-0303941d94da", "value": 112568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781895988, "uuid": "c69ed252-74b4-4e42-b88c-119a9d57492f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781895988, "uuid": "981f1a21-fc68-4eed-a9ef-503c11f54d23", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a8a2de-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "74f5f7f6-6352-49a8-add5-7cd80291d33d", "comment": "Malware payload (Mirai)", "value": "008918a957825c167a565bf143fe0687", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "5c154c86-8c5e-448f-a8c1-36c6aaa4e1c5", "comment": "Malware payload (Mirai)", "value": "9edf96a21f675c365b79757aa4b762229a529bdd95ca43ab9eb7377cceb72a82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "fca53ddc-5f0b-41c6-a6f3-9c44a2a76b53", "comment": "Malware payload (Mirai)", "value": "3accbd25c08a556f60208095865b64fd652ea72e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886240, "uuid": "0c692968-5089-4b99-9bb2-21fa582eabfc", "comment": "Malware payload (Mirai)", "value": "af0c2f24e781aeedde97f0e447287b59e70cb5d1db992b674847947780ba72e611a330b09e1e8b4e4dbbe0411e34fadd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886240, "uuid": "f63551ad-6aab-47a9-b592-ab6cf2d3e935", "value": "T132C3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886240, "uuid": "69e94a51-0c42-46a0-be13-89f8350ce4a3", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3x0j:IaOulLUUogcQ9BvMEWSWC2h3x0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886240, "uuid": "7ef4fad9-67ce-4a75-8d80-4aa3be3aa9a8", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886240, "uuid": "e8733f83-b9a9-43da-b255-8c6f1d2d5e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886240, "uuid": "8afdde46-7509-4638-992b-c00083c17c52", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440b7259-6b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781832977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781832977, "uuid": "84a82e38-28ae-438c-b0d8-efa6ffbfcb0b", "comment": "Malware payload (Vidar)", "value": "ef7a4f4fda351301fba309eca8aef6d2", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781832977, "uuid": "33903f33-a3c0-43d2-835e-2a59fc27366f", "comment": "Malware payload (Vidar)", "value": "9f6c51cd8fa0323a43f333e55a4566c99e87a3cde09a11281aeaff77749a528e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781832977, "uuid": "9361028b-c0c4-4078-8dd3-24a724262902", "comment": "Malware payload (Vidar)", "value": "4a1dba02fbc034dc1df2b05b3db31a408936139b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781832977, "uuid": "b262a7dc-ffb3-44d4-93cf-3af2677f7a43", "comment": "Malware payload (Vidar)", "value": "50b801d60665536f19f881e1e2af207f52350bb32a7e086743adb1cf462ee60217075b834681c34dcf7718c146a91855", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781832977, "uuid": "b6a5cb93-42d0-48d6-8ed8-ba7d4b01e8f2", "value": "T1A2F58D03FCE149FAD15A9331897286AAB775BC041B3263D36E54B3B92EB27C05D72718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781832977, "uuid": "49b979e0-a1a1-4d66-9153-8df880c4f6e4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781832977, "uuid": "91da1381-f08e-40a0-8532-db57fee2bf34", "value": "49152:F2JsEWfxjlZCF4WtJ5EBASwW1iCCw6XQJ9Uo6vwh2o4G:F6sFBAw41wh2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781832977, "uuid": "ff4f0cd0-855f-4f0e-9f33-dfe0832c55d7", "value": 3443568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781832977, "uuid": "cb14b2ed-983d-4377-8ae5-964f6ce8871e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781832977, "uuid": "a3399388-3463-48e3-a0af-38a9da35aaca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4539769e-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "57cdf55b-2074-4162-8bcb-23bc2ec50521", "comment": "Malware payload (Mirai)", "value": "b5b3e2ba3892b24a7ebd9ae78759cf9d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "b6aa854c-da10-4382-b33e-0a9c1ce7fadc", "comment": "Malware payload (Mirai)", "value": "9f7c3a561af2df3425118bc93b2e9d986f42fa98005f9bdbc53b23d8c64a8aec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "4017c75a-4434-4d59-80cc-b86bbccfe40e", "comment": "Malware payload (Mirai)", "value": "6c8543a6d39faed887c38f94d69fc3e651adc201", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "4d98929f-0234-413a-b7b6-3978d456b845", "comment": "Malware payload (Mirai)", "value": "66e952a264d5394fe25faa2d8ea60bac2023bf275c146b950ecafb7659332fd55b0185d63f65dce97c04bd407c6db7e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "958eea11-8d90-4396-b504-8427a27d1e56", "value": "T160C3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "710f6865-cb30-4176-8f33-66eebe62be70", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMeN:MwCvdHmezn0nUPMu9KryXsMeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882800, "uuid": "dfdf0603-bd64-4fdd-aab1-1e6a1480689f", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882800, "uuid": "cf308cad-960f-4cb9-afc7-da91c7399139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "c3291aae-3350-46d4-bdb9-bf5fb70ca184", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bdab29-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781850128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850128, "uuid": "9749503d-6709-4f69-ab8b-01e9ae52bab0", "comment": "Malware payload", "value": "65f49d3ef9c78b5298ae67c467f8477d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850128, "uuid": "c0a572d2-cce5-48ee-a466-70e0344bb359", "comment": "Malware payload", "value": "a032bafefddb44e4ff6f01afd52731a711e1acb233dc341e938549b27f1feea1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850128, "uuid": "c1e90194-9c09-48aa-a8ac-b6dec4708e6a", "comment": "Malware payload", "value": "9cc979e693089e8ca5c092397fa06de7c7539e4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850128, "uuid": "7b5d11b2-bd6d-4fa1-ae6a-59bcbe51d706", "comment": "Malware payload", "value": "fe42c70f34aed523039830ae931e35beb54c4026c1bd4d7660488778b3e66357ec1774bbc9612a311ab644a51c668f85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850128, "uuid": "cb3c246a-86cf-4534-a9dc-14d082bf7ff2", "value": "T1B6762997B8D24942C4E43A77B8BE80C432631EBA8BC712576D05EE383EBE5D90E35754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850128, "uuid": "92cb4848-ec8e-4293-a7f2-33997afce88e", "value": "49152:z08hZ6rFS1XBgrwZUJrQVcpxjqGzqEP6rPv0Gv/bOsEoOpbu3I015ES:YLGX2EqJrQVcpxjx6TRbOsEosi3nLES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850128, "uuid": "921a44ea-7887-44a5-bee9-374dc34fe70c", "value": 7209144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850128, "uuid": "dcca3e75-8f9f-4e72-a4f4-b6670fec608a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850128, "uuid": "9c916df6-205a-4ae4-af79-e78c2f20a14b", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0627797-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886899, "uuid": "61efd137-7f8c-43cc-af57-8cf98f9d551a", "comment": "Malware payload (Mirai)", "value": "38de49762a8616be01f44877da10a33b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886899, "uuid": "2514c5fc-fd93-44f7-ad42-f65c569d95d0", "comment": "Malware payload (Mirai)", "value": "a0a1acd156783cc4b46facceaf7dcf131ea1864c03c790e3dc5c20726e8d535e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886899, "uuid": "b98f7c1c-eed5-4b8b-9e36-3227f867a188", "comment": "Malware payload (Mirai)", "value": "39a39a77eeefacb9df63b3be0bad1b9f1131db93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886899, "uuid": "758f121e-8763-4bc2-b8e4-515c712d4834", "comment": "Malware payload (Mirai)", "value": "cc1672c2f084426cd6cfb9b981e3de56296b532bcf0065a12baafa688c7ad0ccb8bdbd128ced54b62668dbba5ed861c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886899, "uuid": "09f76d27-f3e1-431c-ad67-b92391c8a5b2", "value": "T1FCD34B85FB83D0F2E8A609B1902BB7375632D9394036DF47CB68AD36E865611D71B32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886899, "uuid": "1e8ddf53-ef32-4f5f-a1bd-f41e1c67f775", "value": "3072:OOO8CPhXpqGIazG2SmD3KBdiM/AG08hyKuc:lWC/azGS3KBsMoGjhyKuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886899, "uuid": "1a8ac538-e1c7-4973-8bb7-ea2e48897a2c", "value": 137368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886899, "uuid": "1d8aa03f-f0a2-44ca-b1cd-7a44fd07fff5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886899, "uuid": "5f5c5139-fd1e-4b36-883e-adcb90ed5f09", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1982aa99-6b89-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781837200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781837200, "uuid": "658dfee2-40ad-481f-a30c-f8bcc4f0baab", "comment": "Malware payload (Mirai)", "value": "fb410cd5d952c836525c1fb2f5ac913c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781837200, "uuid": "b6b0bc43-e466-40b0-a0d6-413ff02e2a18", "comment": "Malware payload (Mirai)", "value": "a0e3d38ca27ec312b6c97ace7dd3d8fa72f229b6bef1ed60eea86fd002c2afe3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781837200, "uuid": "76d91873-b8f9-4810-b276-cbdde54bd0d1", "comment": "Malware payload (Mirai)", "value": "448e8b86a7663e028b989d4919fac1cc8eb0328b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781837200, "uuid": "24fecf7a-50a5-4a84-8d5a-5f4aed76a52c", "comment": "Malware payload (Mirai)", "value": "337bf224a82d01c07dcce43ebfa63f95cb583335d29b3c02546ca645d7034161f0cc7a087cdbecbedb4779d724fef9a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781837200, "uuid": "ba74be6c-b38c-42f9-9ffd-87c4922a1342", "value": "T1B5230187B7FE1C25C5784AFB491D832B1201AB38A1F2716E11102772F8E2F1D95B9D6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781837200, "uuid": "8e956a7e-3d55-41f3-ac14-15427081911a", "value": "768:Oib+oiDtrPunNW2aKddJ6tkGaboFLHb+qehGJ3quclUa+taCs3Uoz2:F+NPuXdM6GaERvRxclVh/z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781837200, "uuid": "28849ccf-1086-4cfe-9b17-857d8f349856", "value": 46480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781837200, "uuid": "0463ead3-8c36-4b9b-96ba-dc69009abab0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781837200, "uuid": "c97e2050-b532-4475-96bd-92ef01f75ac8", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d125bc-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883625, "uuid": "ed7ce302-ea9e-436e-8024-7b37a27bd348", "comment": "Malware payload (Mirai)", "value": "edb1b9e3d6be75fb52c9167a8556a356", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883625, "uuid": "d86ed6a8-b5bf-44c0-931d-40e1ef1c8659", "comment": "Malware payload (Mirai)", "value": "a1d44b0831a84664bb04019cb8e71a09e4a43adddedb55bfdc99c9f745058f06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883625, "uuid": "1d3ff1ae-490c-4128-ac70-950bebae2a1a", "comment": "Malware payload (Mirai)", "value": "75cf919b75d43223d3511b7eb6c91b4f01cc52a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883625, "uuid": "1879126d-c04c-4c27-bfa2-55d5b8d1787c", "comment": "Malware payload (Mirai)", "value": "7d1f01b47f0e9482f34d27d1a38c0eaa39efe475acdd2a873fa52ba2d2c362f54b3774b2c5117b6617de81c2ca480191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883625, "uuid": "e1b31799-3860-4506-bf6b-1803eb00ffed", "value": "T168B38E05B70C0F57C5631EB4293F27E1C39AE99121B4EA45390EAF0E81B2D72998EDDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883625, "uuid": "ddb01a99-fcb0-4d6a-b8c6-b666e8614d70", "value": "1536:eQv8Q8Gg+qkG4ESQYdO1MZODYHU3xliUrNI6R/qsykWuC8LQPo+yjZZNMxt+DKSR:a1NSU3x5Z79Z2xsTsFBZn4oK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883625, "uuid": "a0a6d149-abf3-474f-a35d-d948cf11d38e", "value": 112228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883625, "uuid": "53746b6b-f2e8-4392-9033-7a903ec61bad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883625, "uuid": "230ccc02-ab1c-47bb-ad25-3fac05d513da", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4559a67c-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781882800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "d4d01a18-2c10-43ff-bf84-30462b98f044", "comment": "Malware payload", "value": "719e039afa3f9f37780aa62258675593", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "a02726f9-03c4-49bc-80f8-645b64d63c8a", "comment": "Malware payload", "value": "a25ae8f7c226cb4fe3a3b278cdf708d3fe22b45652f8ec9f78bae6c1d76fbca8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "32f6deb3-8569-4c49-b3a5-2aed667004fd", "comment": "Malware payload", "value": "f3079caf4c7b1bb3423cefe82a6e8f3ce7e751b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882800, "uuid": "6572d1aa-cbb5-44ce-8d68-64cb690769a6", "comment": "Malware payload", "value": "82606ae30e97b6d49764de3f5da997f42f81ffb249452abbdde4aee5806b384b7ccd44067969a998339972da06e3457c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "8e27d10d-88ab-4e0c-b7b1-3835081e1ecb", "value": "T172F02BBF346060345636D86893BD42A1B5065FFF44402F24384FA535AB6D21070E87DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "04132c18-81af-44a6-8427-7932a1355c08", "value": "12:fXtyThzKttNFHJhzKtBFlAPLRq584D/ZV5nNYlJmLF:fXtyTBKPN1JBK9ao7/7YlAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882800, "uuid": "ab013403-82ef-4223-be00-6fe0b8844f74", "value": 441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882800, "uuid": "83c2b15b-0391-4fae-9761-330c15844825", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882800, "uuid": "3bebef89-15f7-441e-8eb3-295c918a7d12", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374e0c33-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875905, "uuid": "e7e79f28-fc6e-4074-b6eb-0e8de5ec7a15", "comment": "Malware payload (Mirai)", "value": "4f5f4fdf921eedf989d4b96d9cb52a39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875905, "uuid": "71ba12e4-ea91-4fc9-bcdb-2fd0173552bb", "comment": "Malware payload (Mirai)", "value": "a281c4b7cef17a2522238d3b39bb0850e1de4102543ea1b1db427a2d8eab69ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875905, "uuid": "2b530de4-76d8-4c89-9efb-e381cb4b9469", "comment": "Malware payload (Mirai)", "value": "36433888b00ab987afb30fb2d4e231eda5679993", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875905, "uuid": "e65ba16e-5ea5-42fe-92a8-cf59e66e1f81", "comment": "Malware payload (Mirai)", "value": "c0ea1ffce84313b9ffd53a294317118a0fca643cb61f392310a82f04330c5b75eab0f70954b93a18b7d9cfecd5dae20a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875905, "uuid": "f439958f-7504-4789-a729-f64c9400bea0", "value": "T121C3AEA7B79714E1C8104BF047CB9FCD2E23A1129D4FA8F36E4D663B287A2CB1915791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875905, "uuid": "abcee15c-baf3-4b8b-8044-705e4b154948", "value": "1536:scLgeob8I2O8zS60gtXXjQUZRe06LMhCIk/xuqXYgMx6/LWL:HcQLOESBgtXz5Re0VCIbgO6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875905, "uuid": "70c2a1fb-066d-4073-b40e-4a2f78ceeae2", "value": 124056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875905, "uuid": "4d45e51a-36a5-4e7f-9aa0-22abcaff502a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875905, "uuid": "4a68f5db-8aa8-4ece-b0bd-348e888f5d3a", "value": "dtjogcysu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1798d1-6b98-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781843701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781843701, "uuid": "93fdfb80-3c84-4bf1-a026-6eb29be1f33a", "comment": "Malware payload (CoinMiner)", "value": "2ac73c1076f16c6f67a6e416ac859bfa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781843701, "uuid": "16787427-762d-4e63-9b02-864397298841", "comment": "Malware payload (CoinMiner)", "value": "a2c042f9db2a3e0634378ad4ce85269f97167438754e5e9f059a3c58c25b1cae", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781843701, "uuid": "a8e1b5c4-631c-4b51-a5c2-fee6da7cbb77", "comment": "Malware payload (CoinMiner)", "value": "2842cbb3142d7836d76a805afda2df66266f350a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781843701, "uuid": "03446494-a637-44ef-a153-764ab1c1ddc3", "comment": "Malware payload (CoinMiner)", "value": "b091b0448cc9ec907ccf649c621fa705e2d17f104309498e7d4a47fe1a3d80c16f2a8f48381109a6fa6ab826bd37d927", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781843701, "uuid": "b243311d-dddb-41dd-aefa-b083e8323489", "value": "T150F533D2540821F8DAE5D132C687EF846339B3640FA57FDB24F651D0193ABCB6B36A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781843701, "uuid": "1a48d917-b91f-4d52-a651-b6a40dd08fa7", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781843701, "uuid": "79ca5e54-2d37-4cf4-b9ac-6a9a12ff62b9", "value": "98304:W83cp3XQPXulZDHHdXNYAVYTfDqaH70ATRTSgSq0:dQ3XQPQfjVYnqXG7N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781843701, "uuid": "8d7f700b-d6e6-4f5e-aae0-2d9e84b16937", "value": 3445736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781843701, "uuid": "40e03c5d-dca3-46ac-bffa-7d621b86adb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781843701, "uuid": "f10fcc0a-9b5e-49d7-95a3-5a0cd63417ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367528f8-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781850134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850134, "uuid": "fa2e40cc-45d4-4a6d-9ead-ce0cf00cb616", "comment": "Malware payload", "value": "15942680614d928f198cda1600450a88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850134, "uuid": "54454aea-f69a-4f84-9600-d77e8c891fe4", "comment": "Malware payload", "value": "a2ddbfd8ecc410a2c28e4087cefb720d8064f7488e2d2979cbd31729c8340257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850134, "uuid": "c7a13650-0385-497a-91dd-08b04d95829f", "comment": "Malware payload", "value": "7c1478841b3ac26fefb61ca6dbb9ad9abdee5491", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850134, "uuid": "7f4978f6-3d01-456c-9d93-166a73c59d71", "comment": "Malware payload", "value": "c82aaab7f2d05e32d58e62e29ff4ce73f7af85add5d4c307fdafba0122dbceff6ad1e11c3ad7ddff0a8b27ecafdfe25d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850134, "uuid": "1af46cce-91b2-44fa-83a1-b7a9addb784d", "value": "T1AD762A57B8D24982C4E43A77B8BE81C433630EBA9BC716576D05EE383ABE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850134, "uuid": "db560a04-38b5-4f0a-beb0-922790edc3f2", "value": "49152:ni3936vcofw4yTYpLRjcmeY5er9HZ1sLHkEh/+MtB1dr+54c+5Eu:ni4vN/RTeY5er9H22yr+54PEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850134, "uuid": "bbe5ba35-4f12-4bb7-b34c-88f7a4d970ec", "value": 7209144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850134, "uuid": "337854e8-8cc6-4c28-8b01-a0234fa767db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850134, "uuid": "781b5ba6-3d20-4955-958d-34cce7fb6c7b", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d14cb3-6c14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781897208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897208, "uuid": "00b83910-5c6a-48a5-ac07-7de28441be65", "comment": "Malware payload (Mirai)", "value": "97614e408553811b39e964cb6675f41e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897208, "uuid": "b560104e-335d-47da-86e5-2fd5e39fa68e", "comment": "Malware payload (Mirai)", "value": "a40fb29ac53233de5e77499447f524e96974630eac6155d78a26c448ed6c0856", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897208, "uuid": "843e792a-a523-4a45-8ff0-24f403389701", "comment": "Malware payload (Mirai)", "value": "0d0ed415e0dc7563bc11b4ef5fde43b95abb4c69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897208, "uuid": "ac4a7382-5aa2-4676-a1d1-7b54ecaba222", "comment": "Malware payload (Mirai)", "value": "0d1e065434ca8f6a1edd53d8d160978a5802b8bee21dfe9b0d5c76701fb4f364e76b5790b6649be349de2175487aca3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897208, "uuid": "505f43ee-369f-439a-b040-3033b8017f17", "value": "T1B8C3D60FBE619F6CF3A883314BB74E35A68927C627D1C546D27CE5105E6024E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897208, "uuid": "e3ce8ed6-507d-4ba0-afe2-d4b71bfbf700", "value": "3072:F24TnXAJ/yB+U9ejsb7hlk4JN1zjaOY5HHQ:F28H1zmZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781897208, "uuid": "0c5b02a8-7403-4817-949f-65e9a92f66fc", "value": 126128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781897208, "uuid": "ea0f2ef5-e603-4a1f-90db-55f92e6c838a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897208, "uuid": "ac112cd1-caf0-4624-a295-a643ec00bbde", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3a9974-6c22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781903107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903107, "uuid": "9a7ce2dc-d52c-4c61-9aed-8f33ede5046e", "comment": "Malware payload", "value": "55be9f819eb37868fa3034c27bf234be", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903107, "uuid": "70c9109b-5c40-4e0c-bec7-d012094bacad", "comment": "Malware payload", "value": "a4fa89459c397c5b38cbfebab5bcd9506fb42e26ac43f85c84153a3be074a206", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903107, "uuid": "2a087e4d-b244-4622-a90e-d5c0ae498f7c", "comment": "Malware payload", "value": "a48810bb559ab57dfc0d5caccb4eb493fd42348a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903107, "uuid": "be82a11c-c871-4606-bb9d-1273b7cf709b", "comment": "Malware payload", "value": "3cbc00189fd904e690fb93922cc14c288d21e09612e5726717f68dba5010bcdcb0726ac31a2b532a4dfd58e25405fe35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903107, "uuid": "859794f8-c54f-46c9-9c23-8ddacf5df3b6", "value": "T126D0979390338030205548A8F2CA6C50B8608B3F8CAEC22EBF1730300F40A8CF2C0760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903107, "uuid": "845d71a5-3184-4f71-99c2-1414cd1bced7", "value": "6:hTqQ3NtxcynHjFmTIkDIty+bAulNXYq9DG+NjVsNXYrkJ:VqQT60H5msHBbPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781903107, "uuid": "32cb57c7-a5cd-4285-b44c-f0d26aafd60e", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781903107, "uuid": "7ab66b88-17a8-47d7-851c-2710fb9b867e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903107, "uuid": "f0f45bf1-7a25-4618-91b7-8ce7a07e37c8", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d372a474-6c1e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781901507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901507, "uuid": "081fbd9d-5d1a-4108-b2dd-8780b164fa94", "comment": "Malware payload (Mirai)", "value": "f96521a7a2b38bc49666716f18441769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901507, "uuid": "a9ead2c3-95a6-442e-8a80-48045655b602", "comment": "Malware payload (Mirai)", "value": "a5a33c858c1cc9f3a76d1febbb95375e8b1fbd06f5084770c7430af35ea78016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901507, "uuid": "98180079-170e-49bb-9f2d-acc132a8b195", "comment": "Malware payload (Mirai)", "value": "ef06b64b7f46b0cc7b80e5bd2d392321f42df52f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781901507, "uuid": "cd4579bc-6458-4324-a46a-d846e74b6d3f", "comment": "Malware payload (Mirai)", "value": "1d4027a5e37b8ca1f5c42d6d0fe96f478f3e1f0166b694276a2d623741a22764e402c831afa7d741f8f64e4232149356", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781901507, "uuid": "7908e619-fc6f-4adc-85c4-54d26732d0b2", "value": "T178F37DC1F743D4F5D85B01B020B7E7328B72E939102FEE56D7A9AE36AC52601951B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781901507, "uuid": "79932f84-aa2f-488d-bf95-e31eff935ceb", "value": "3072:XWsOmRHGO3wWNW6WwjLryWxr/231RjPYyxqzDyIgQLOmLYWbdmCoPOOaGN7Wla:GqRHGO3w0W6WcLGu/231RTYyxqztOn0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781901507, "uuid": "33db8369-3a2f-4ecc-a29c-f413a011736c", "value": 163752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781901507, "uuid": "adc6b76a-b7c9-4bed-b4e8-bf718e4c4aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781901507, "uuid": "df5c4e0f-b762-4c02-838d-61a5abd27033", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28febdda-6be5-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781876740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876740, "uuid": "563933ff-266e-45e5-9bbf-3112f6758c2c", "comment": "Malware payload (LummaStealer)", "value": "1cb69eb5942642ec41e157d817226572", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876740, "uuid": "ed94ccee-a085-498f-abca-fde4bd4e5240", "comment": "Malware payload (LummaStealer)", "value": "a6feb3ea4e8dcff0eaea4c8b89b3dc728e0cfe7ea2729c5e25d1f0b6bbfc3453", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876740, "uuid": "8c9836e3-8d8f-4c5e-91f2-569f2715d7bf", "comment": "Malware payload (LummaStealer)", "value": "5745317a0da55836e5dcbc03950e6e208b23e687", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876740, "uuid": "1f8648e4-8849-4111-9c69-82ff03db0cc3", "comment": "Malware payload (LummaStealer)", "value": "11f434e0875327b9977f27264935d8e076dcbb26f6762498ead412b08da482600de08396d9c67944eab4f0dccfd97d83", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876740, "uuid": "bb340722-c4f6-45c4-a474-f6d39bd7480f", "value": "T1B0D56A01EEC748B6E443563259A7A2BF2338AD050F36DB87EB443A79FD772D51826309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876740, "uuid": "4e995f31-a262-4ead-9595-223890dbce74", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876740, "uuid": "7b48d456-2b68-4565-9f92-186335b8fcad", "value": "49152:3/4YXKJHHPVwc+n5euaXlhOjcQaNLouJjdWh+bQ/pTM:vrOHHPVGEnOjcQadfjdWhV/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876740, "uuid": "5b0d12ea-f383-4d92-adf2-92cdcd9e7386", "value": 3003904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876740, "uuid": "b7bf5eec-893f-4c34-af4a-eb287bd2166f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876740, "uuid": "988677b0-6b60-40cd-8c8e-c2ee985ceb06", "value": "microelectronic circuits 8th edition pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de09c999-6b7a-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781831088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831088, "uuid": "100ade1f-0bb4-4de3-a414-f806eb3236ea", "comment": "Malware payload (CoinMiner)", "value": "ebd344ee32f89a1d93a70cf06d4da149", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831088, "uuid": "e7f77c52-8dea-46da-ab00-907ee820c9e4", "comment": "Malware payload (CoinMiner)", "value": "a7796186e4c40f5a257b952e16d1964b3c9f20a1f2d9d09d3047293d6f71c921", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831088, "uuid": "c267c7db-8452-416b-b20e-4421975e57bd", "comment": "Malware payload (CoinMiner)", "value": "53b80df6c93b4bfab5b16c783b117cc5f72dddc0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781831088, "uuid": "cf69b73c-cd65-4274-8715-95c907e67317", "comment": "Malware payload (CoinMiner)", "value": "5d418d6f94e120c7595bddac324313b9dae54bd5884159087337dd095822aa3528bd916d1cdc4b2a74059e2eae5a29ed", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831088, "uuid": "5334c962-1dc8-4162-80fc-3f639e481896", "value": "T1E3F5334CD9365061EEA943740ABE5F983B2D2539D3852FEB005BF4D13A22AC537B987C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831088, "uuid": "56d71ddf-a542-453e-89b5-2c40b5528da8", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831088, "uuid": "375b9223-3998-4ce5-b87d-e3c63752f833", "value": "98304:VvnEGKs5LcRyrULLgDD5MynRe5+5XZxW6Tp:ZEG9LcRyrUng5RnRe50XZxW6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781831088, "uuid": "3c8e3603-8a7f-4dbe-81b1-41e211028e9f", "value": 3446248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781831088, "uuid": "6a740adf-50c1-40bf-a31a-039385c25b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781831088, "uuid": "f07d594a-7580-4efd-b40d-a86a982ce149", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a358994f-6bc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781861483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861483, "uuid": "cc5b33a6-0a2c-4bba-85f6-bbb1fff1f783", "comment": "Malware payload (Mirai)", "value": "79b04de5b3100ff38940f6d8d452711b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861483, "uuid": "0fde9edc-bf1c-451a-bebc-c4ee8812b02c", "comment": "Malware payload (Mirai)", "value": "a973d9728ecc4cadd5447f6e532b52352d04c360838f8fa17528f8b4336e34b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861483, "uuid": "fe0dbf89-3cd4-45ff-89d9-32ee93261548", "comment": "Malware payload (Mirai)", "value": "ab7610daba09b2e1e1a3b7b9c07f7627213b76c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861483, "uuid": "42849a96-eac1-4ba9-8cae-59dd416233c1", "comment": "Malware payload (Mirai)", "value": "83fbe283cf85303d0fa9b9dd631fc025637422562335a6f7364ea4f319933b59fb02582e4910f57ed7410959abf59176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861483, "uuid": "b0030deb-1ad2-4bcd-b7d4-28259df83792", "value": "T177F3995D2E228F6EF67CC73147B74A25976823DA23E1D684D2ACC1142F6035E641FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861483, "uuid": "0a77e8eb-408f-4c88-baef-55b991ee27f1", "value": "3072:SajwPm7dIW/iIvLAPf8T41HUPFWUvJFby:SiwPm7dv0Pd1OFWQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781861483, "uuid": "59f66d43-b176-4dc3-8d4b-c5f50432ba1b", "value": 158564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781861483, "uuid": "853fda09-66dc-4f1f-94e9-c1009930fa1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861483, "uuid": "632ee478-65c6-4a02-aabd-03ff7ef90db4", "value": "hmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d43323-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781881058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881058, "uuid": "21412597-6617-409f-8697-e2b2c514feee", "comment": "Malware payload (Mirai)", "value": "31557ee9486122acad174a7c0ca3ab24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881058, "uuid": "00473d2c-dc84-4a14-8fd6-ddfaa18695b2", "comment": "Malware payload (Mirai)", "value": "a990e69b5d4fc2e544dd47edbdfeb7f592fdf0e3584b3c4e394e6446dd6bba98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881058, "uuid": "f9a74553-7182-4cd1-81e2-9b95111c3b50", "comment": "Malware payload (Mirai)", "value": "052c0b3ceb55bdc93c1b0d0ba1193c59875c988f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881058, "uuid": "9bed10bf-0902-4d82-b52c-0e4d99bbc475", "comment": "Malware payload (Mirai)", "value": "dfd48f691ae1301b9970caaa76a31b26e00c0268ed4bc1c4591de55e2f69fed6e6a00c0bfee6bf5db097c58e366e2d5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881058, "uuid": "e9e0621b-a5da-4995-8d1f-0170a796892f", "value": "T15DB34A02B6D194FDC1EAC474872FE427DA31789802313A6F7B88BE312E75E71166EB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881058, "uuid": "f5fc32a2-be07-4415-88db-98bd34d45348", "value": "1536:6/8edpyXxAHsTKWYUwEqdPZ394JeE5/f1swW3q/1Sl4GY69Z90ZmUrO8:6TeXEhPZt4bsh6M4GY69Z90pO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881058, "uuid": "2d291097-7eba-4f30-9f5b-a3739da226b4", "value": 116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881058, "uuid": "56adc3e0-50ef-4078-ab53-f8b02adb26a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881058, "uuid": "b5c08b8b-e98c-4481-a7b5-0571dca41474", "value": "monero.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad04caa-6bdb-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1781872475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872475, "uuid": "c4808da9-88e8-43e6-b9fa-1d260046ffa5", "comment": "Malware payload (SnakeKeylogger)", "value": "a0f0074dd3a759f51be6f4a6e064f1f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872475, "uuid": "639075de-759f-46dc-8dfe-7d1a2637864d", "comment": "Malware payload (SnakeKeylogger)", "value": "aadfe021f937eddbb71eeaa4f109221cce0bbb2607ef26e41ecd6a31e06b5509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872475, "uuid": "75bd7e4d-e6a5-4d6d-ba9c-927510e15f0f", "comment": "Malware payload (SnakeKeylogger)", "value": "239e79026c6074570e73d706719827b2895d32a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872475, "uuid": "eb1ffeab-08ac-45f4-83c4-6ffbf8e741ee", "comment": "Malware payload (SnakeKeylogger)", "value": "5813457d73fe32451f27a45b8487af3323defdc10651718c4b6fcb10bf82e3e373c61f28d2a55f616ba6aa1a0e32656d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872475, "uuid": "98604eaa-64cb-4668-9cd8-0ba79c8557af", "value": "T110252305224C4623D0E667792E72E6382773ADAD56A2D906AFDB3CDF3632F440B10B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872475, "uuid": "bfdbd40c-817e-471e-83b3-4f577c928b67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872475, "uuid": "ced68a22-1114-4d8d-85e7-cc966e7bb99a", "value": "24576:FO1VoNzf5T+yafZMFNycuphygQ2PpM7G6ejSvtwv:UKbeMCc2BPG7A8twv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781872475, "uuid": "0bec6266-b795-4cce-aaae-12b6e91a7354", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781872475, "uuid": "c0f09707-bfea-4b5b-b6f6-0a38469223ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872475, "uuid": "5074f97b-b216-4151-8537-4f33a9372418", "value": "Tele_Advice for SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62af616b-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875978, "uuid": "980f494b-74c7-402d-bb1d-bb6434fc4e86", "comment": "Malware payload (Mirai)", "value": "9d686665245e6a2e89d830e2d2c40979", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875978, "uuid": "66979436-0f72-443f-b77f-11a3c64c5768", "comment": "Malware payload (Mirai)", "value": "ab8f27b6e2f1a2310f64a8e4280797ccb9e69b703e3b883d1b6d1f5ba27c7fd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875978, "uuid": "d2c8c479-d33a-4e9e-94f6-58dd1d8d8d66", "comment": "Malware payload (Mirai)", "value": "45ceff170a1cde189e39ff4dc9ed37cebf1d2cc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875978, "uuid": "97b14dad-5f37-48a3-ad6f-6f57b9346afb", "comment": "Malware payload (Mirai)", "value": "95ee43055103d4fe4699355f68a9ed7b3d8707bab895e9519732d22a7ee381a9378a7977a4ed5f635407309531463a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875978, "uuid": "fc73a7e7-4ce2-4d81-873b-bb7dade28201", "value": "T129930947BC818B15D5D116BEFA6D528D33230778F2EE33129E18AF2127CB56B0E6B446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875978, "uuid": "7ca4e8f1-c934-4026-9dd2-794b311f3b0f", "value": "1536:czZnsl5xl9PdRVzZnTbY96a0gxlzCbd8i3Nd+hk+78f5/YUwu:cer91RXbY96a0GSNd+hk+If17F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875978, "uuid": "b4d35783-a582-4df8-af8d-2c4fd3726957", "value": 91268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875978, "uuid": "704b9358-65de-46d2-a77a-e81da0aff734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875978, "uuid": "f74a3ba9-3ded-4365-a013-407f70cf2fbc", "value": "obmsxxvnc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50aeeb64-6b8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781839870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839870, "uuid": "189670f1-11db-4aea-8414-47b62a2ffef9", "comment": "Malware payload (Mirai)", "value": "b473f9494096e649b3f7ba43ebce1b9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839870, "uuid": "a7dc29e3-612e-4a0e-853d-aff275bdfc0c", "comment": "Malware payload (Mirai)", "value": "abc28a6636e50d9c7456eb26621b06485dfa39366091c7dd0696c044a68fed7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839870, "uuid": "0da2f89a-2436-4f18-bcca-8e1affb2c0c2", "comment": "Malware payload (Mirai)", "value": "a4916de37a5fb8dff317f4673af10341b2a4c126", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839870, "uuid": "b88e1124-39b7-4bda-95fb-6751209287e2", "comment": "Malware payload (Mirai)", "value": "ccf26e4d24d76c7ff3eb3834840f7e99190261b41e1a8e2957de1f2154933b594af5a47284b1d62b19f4c101a81f6298", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839870, "uuid": "452e9214-c3d8-4db8-b033-530491ec9da2", "value": "T1AD149E63D8787ED8D620B8B0B0F59F7C1B53A55182471EBF66A6C67440C7E88F9083B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839870, "uuid": "6e00e9e1-21f1-4b48-acf1-4a70e8e9f87d", "value": "3072:Qk3UPadIX4k/m14RHVcI4SSyfdpe+Wso0qrmybw0:DGvR/ma1cI4d/rsu6yT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781839870, "uuid": "a0bac930-4a5e-45de-8bfc-5c90040940f7", "value": 194468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781839870, "uuid": "aab352db-2c37-4edc-9555-3c149b0d22cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839870, "uuid": "8e183c96-6a90-439a-883c-441050852cac", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a84b650-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "b026aab5-b885-4c13-94d8-d98c256a20f3", "comment": "Malware payload (Mirai)", "value": "7bbd60ab2c5daed90d7eac90dab1aeb0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "dd06e504-0297-4562-8980-8cb7248139f6", "comment": "Malware payload (Mirai)", "value": "ad4b26e1f99b7d6b87441b12d857007badc19708305b19759bebb371f2b9028a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "3cb63024-ee2f-4f0f-a108-0fa851262d64", "comment": "Malware payload (Mirai)", "value": "54d3cd8ebe9e2958004745e9e9e447fc82e1c69e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "5a83bef6-e921-46a3-a929-4ab6fd93c938", "comment": "Malware payload (Mirai)", "value": "381136b8592931771dcb61297b1c80a1cb18bdf32af2accc4b1490d5dd0aeed3e640bffe5b5eb8e1a6a0a9e47dc19217", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875910, "uuid": "d3b42b45-d4f6-4c26-a61d-a58369f3b2f4", "value": "T130F2021706E64306CB8C51B0686FF60675499381157CE1F7098369BF89ABFB66B0CF8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875910, "uuid": "6991e73a-e05a-48ce-bc19-5be0d4e9855e", "value": "768:MkOPNcEboKgYTkD6rUqIrKmDBSUZKw6VOfoTJkvYPWQ9/Imd3nbcuyD7UHQRjF:MJNcEbow26r7PN7LT6vY+QZR3nouy8Hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875910, "uuid": "1938628d-29f2-494f-8b03-9a2f00e6b6e2", "value": 36252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875910, "uuid": "fb96d565-27ab-4f05-a1e3-4134d4ba8d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875910, "uuid": "d32868d4-07ef-46dc-8c3e-de2d22e3e2ba", "value": "ytaabxcxa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea7e276-6bd9-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781871569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871569, "uuid": "be9044c8-f198-4e95-a3f4-49faeef140ae", "comment": "Malware payload (SilentNet)", "value": "218fd6d7fbd61e9e2f073833aa583de6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871569, "uuid": "462b56ec-861d-42da-8a65-33763d8b4e79", "comment": "Malware payload (SilentNet)", "value": "ae5e2fa0ba8ca37c07236a8d540f453a1fd07f8d8873a17a1ae26f19ee90cbe6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871569, "uuid": "ea5415e5-6537-4589-a206-1b7ba36ab628", "comment": "Malware payload (SilentNet)", "value": "f3d53089c46b999ab7b224fff28bf9d2a00194d6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871569, "uuid": "274f05c8-4436-4909-af6d-e671f4fb474e", "comment": "Malware payload (SilentNet)", "value": "96558a8413725c113af040a7a2dcc85ab7f32d1365935ed9e26352e8de58359170f603f03e791d6ecb8a9f7bcc99bec8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871569, "uuid": "f218091a-d0f4-4c29-a39d-a6741df2b983", "value": "T145B73324D56E065EC32B9637FA24655AECFC4AC6D812815EF93D8C8F48C78CF078467A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871569, "uuid": "ab37d465-5992-4481-b6aa-13a21203f262", "value": "786432:4DFwf5QUXpuLN/9vh/Q4ISyV91UMziwMwOu12rlIaROlHzfKcR+zOdyn:4DOBJXpkrh/Q4ISyVgbwOucCGOZz4zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781871569, "uuid": "b90574e2-a233-43e4-bf20-b350710d0562", "value": 48647178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781871569, "uuid": "ba687b90-3e32-4d8d-bd99-5bdb0f9df4db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871569, "uuid": "69d02078-a435-4845-8775-1f9522efc947", "value": "liquidbounce-1.21.1-v2.0.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966f4bc3-6bf2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781882507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882507, "uuid": "1dd10adc-070a-4428-9a40-6142c766c7fb", "comment": "Malware payload", "value": "58eaba1c4ef27b32a7cbf8984d82276f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882507, "uuid": "bc086fd3-945e-47da-8292-cad739ff412c", "comment": "Malware payload", "value": "af23c631df2357f85558c3a3413a9e0b4ae06a0c1e67ae3d757e46696f49dc7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882507, "uuid": "ef3884cd-c8c4-4537-a5bf-f8d692d4cb2e", "comment": "Malware payload", "value": "90c5aed51ae0e5b6d9748963e26e93aeef3678ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882507, "uuid": "6aac4caa-928a-47ec-8290-62457a7374e3", "comment": "Malware payload", "value": "d63dc7ef8394c27719fd1fa3b19a8267487aa74c100fdb72e7df6820323e48fa4fa717bfea6be4a1868094f8da97cfdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882507, "uuid": "536fb609-c560-460d-84e9-7ad32ebc80cd", "value": "T1DEC733532290D536E51D0DBA084DD5E24A7A7E318BB5D2C39FC65D083E701E2BE3AE4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882507, "uuid": "55061148-8efe-4364-b44c-443355c952e1", "value": "d619eda1a774da262071361b928bb2e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882507, "uuid": "7c5d17fa-c752-4487-bb69-96eb7bf44526", "value": "786432:2k/KNVALxLA8PxUMK/a37pbo0W+oa7bb2ZF7+1gWwr+7/S9ZCahZ/0:UuxLAeOaLpbHoa7bb2ZF+1gJq/S9swC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882507, "uuid": "3d9e5bf5-d9f2-467c-971b-7466bfe0798e", "value": 53011904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882507, "uuid": "4cc2147c-5b8b-4ded-8fd2-ce56d93a438b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882507, "uuid": "66aead03-d27e-48bc-95c3-e22c63e05461", "value": "SafeguardPDFViewer_v3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c6ae87-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886932, "uuid": "2f4d0ae8-4452-4af2-be5f-11accb55a899", "comment": "Malware payload (Mirai)", "value": "070933b27d2a12043e12c3846ba3c52f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886932, "uuid": "5b12665f-12da-4006-9724-c18fd8205d67", "comment": "Malware payload (Mirai)", "value": "af3c955832e1ff3b755fbbf7f5d5cccf688e6ce9fbad3a2a2ebc77d215915f41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886932, "uuid": "84147542-6043-43b4-b855-c1caae32b0b8", "comment": "Malware payload (Mirai)", "value": "0a851eb7ae15624bfd6446ae8e9c26858f8948ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886932, "uuid": "2fe70c6a-0af5-4ae5-b4a0-b87cc2fe9b37", "comment": "Malware payload (Mirai)", "value": "0700fbceeecc3f9babb4547b8bc6b66891698d73cc15a53f43c5f85fb2de3084a214b6fce051b00f66df574f438914a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886932, "uuid": "b40dfed2-4587-4946-b435-48efec525b27", "value": "T103046B16B4C194FDC8DAC1B88B9FE13AE972F01D5134B20F27D49E262E5DE206B6DB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886932, "uuid": "7f6869f8-11f9-4b02-9d2c-9bec6e296037", "value": "3072:C+dJGKnjhA6UFdhYC62jUEVQ1RQoU+cio5mFPg7VIv7/sP0:vHn1AVah2pVemo9pHT0P0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886932, "uuid": "f23d35ac-2c1b-477a-bc25-3632c57ebc2a", "value": 176808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886932, "uuid": "136fefc9-6317-440d-b976-bd615022b68c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886932, "uuid": "2be31db2-1280-4d82-996a-5f9c44f12be6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533753da-6bbe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781860060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860060, "uuid": "6ae59f29-c46e-4475-92ff-3e8f059f3374", "comment": "Malware payload (Mirai)", "value": "43034d4e73218f80cbac3d4150d3968b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860060, "uuid": "343b9356-95ab-40ac-9c93-193aab6b44ec", "comment": "Malware payload (Mirai)", "value": "b0835ca2c814ccd5167636ba33c53cb09056bec04f7764471d1b863da1c65ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860060, "uuid": "fd42e505-ec33-4ad6-975c-395a17482d4b", "comment": "Malware payload (Mirai)", "value": "467febca828d65377882d8288c92530e1a36b1ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860060, "uuid": "a40fadf9-0f56-4bae-828c-5f3031e2f3b4", "comment": "Malware payload (Mirai)", "value": "c4ca28f7d50cdaf41ea873278370766ea7d60445fab270cfc9f3b5709bd90e6c99281540b948c805399b3a319e0f8ce9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860060, "uuid": "d086ddab-5b2a-474b-a0d0-ff0fa3dcc8f8", "value": "T1C273496978819F57C6D2217BBF5E435D335A27DCE2EA3103FA142F6C768B4290E2B045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860060, "uuid": "249b7e63-7bde-4f39-8610-641f0a2dfe56", "value": "1536:mbLiZOOoCNxZbqA++H5o49TwrgC4/TgeV83Oh1FAZ0U3bk0e:m8OA/+SnZwrgC4bgUgOfFAZ0Url", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781860060, "uuid": "e3e47fa9-75a5-487c-9a39-2cedc45e9c5d", "value": 75308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781860060, "uuid": "e968b745-5b3f-470b-a73e-da6249cc78f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860060, "uuid": "17f21506-8e87-41b6-b8b8-db45c1a3b31b", "value": "EIxV", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad6b9aa-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875911, "uuid": "fe9bf5b8-87b5-453e-9c21-caee99e9b019", "comment": "Malware payload (Mirai)", "value": "c2958b29b6f2bd70ac7a87cdfcac1ed9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875911, "uuid": "68a113d6-d450-4047-9beb-e1f14e76a9fd", "comment": "Malware payload (Mirai)", "value": "b0b3576c0d41ac070cf51ef8ddb4d4619d00625afd5862cda422895815d30d50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875911, "uuid": "15e11745-6422-4cd4-9ac6-ae8fca7013fe", "comment": "Malware payload (Mirai)", "value": "2e477691f039f4f552a5dcf0f1b04d82e28de7c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875911, "uuid": "9ab4dce1-7c04-41f2-afde-54f0b5e3e804", "comment": "Malware payload (Mirai)", "value": "193a167979da3607e2d049b9816aacf25643ab8d2fd2dfc09bf3bbe8cb706f67195cc034136ec45df79d4d9c8e118c0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875911, "uuid": "b98bb135-b5f3-46c9-a54d-fbf0ed3ad41a", "value": "T1E2F2E1F0A9BB3AC0EEFBBAB4DD44CB901B610BC4979985C6B5C1672223725032D44EE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875911, "uuid": "010d5d38-de66-418e-90ef-2d0d1586597f", "value": "768:bOjRkcg8LqTUAKg0qxHRClotXT8mb2EcTKDmtv4uVcqgw09uPd:bktcXrx9d8PEu4u+qgw09uF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875911, "uuid": "9ca98654-74c6-4676-886c-4089306fc077", "value": 36348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875911, "uuid": "912a72a8-025f-4278-8512-c32ee3f23400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875911, "uuid": "098e96d8-832c-48bd-b782-c24d4490e0bd", "value": "zlkbnkpmc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bc3233-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913055, "uuid": "dbe9259d-f85e-41cf-bb0d-8e6d1b83c859", "comment": "Malware payload (Mirai)", "value": "bdc46ec0b5c05ad14a64562d1619e2a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913055, "uuid": "91f796dc-227a-42e1-902c-a4e2ee6f2a97", "comment": "Malware payload (Mirai)", "value": "b0dca3a0a722ffd3b59456a5ead60a31cdecc29d726d4de230a25cd17afd75ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913055, "uuid": "4919cdeb-2dc5-4293-895c-388ef84328ef", "comment": "Malware payload (Mirai)", "value": "d8a422002a9a783da890b7f99a3be682468ee5c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913055, "uuid": "b224f87c-d0f0-4fe7-a081-f91f259577ae", "comment": "Malware payload (Mirai)", "value": "2c2ffd17851fd668ec46ab382c03c88e948ccc5726f96bacb5d447618a18649cb4e99cfde1970d9a1500759ea0ce3979", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913055, "uuid": "66e3cb90-141f-4ad3-a71d-5ff527abf268", "value": "T1B8C3FA42BD429B13C5C322F6F7AE42983B136B79D7EA7102ED247F61278B4DA0E27511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913055, "uuid": "5578fb32-bf32-4b42-8bc1-ba384d7cd14e", "value": "3072:Vf5wLqjw74jwlNn+CmE3Aw8iDYd9C9NAS:S7Kw/+CHAw8iUq9NAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913055, "uuid": "1d837627-48e6-4073-b8f2-25214a007384", "value": 124968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913055, "uuid": "cbcff2ad-c5fe-4a24-af24-13ff4d7df630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913055, "uuid": "01e75077-16f7-48a4-b971-0702041aa679", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29585460-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883613, "uuid": "83c8e364-4ede-464d-8662-c4cc2e2b3d24", "comment": "Malware payload (Mirai)", "value": "dacf06e45073e20ebc328488900ac0af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883613, "uuid": "b7355080-d995-4054-8ad3-7415e36ace64", "comment": "Malware payload (Mirai)", "value": "b10a49e2587b457bd05f1f3096d5be22cea340496bc7ab0bb83f25adab173f1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883613, "uuid": "7a0225f9-6a55-4211-82f9-600eb247d681", "comment": "Malware payload (Mirai)", "value": "022d34b308fa477ef2cc20abcb71fb2c714eb823", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883613, "uuid": "4c477fef-2b52-4e67-a04a-ec14ace42217", "comment": "Malware payload (Mirai)", "value": "3b7418ba4c4806d640bcb4d687bfa4cbc3027019173c68c43c0e9d9fc32a313579046498ab63d0c2ab8588306b2551cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883613, "uuid": "c5d06504-7f6b-402e-ac6d-2ef107296f04", "value": "T1B4B36C32BAB9182BC8C4657926E74330F6F6078624B8C92E7D610F5DFB5462032677B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883613, "uuid": "64e940b9-6d04-49a6-864b-34970419d090", "value": "1536:6qIIWNBBvEOXi3aVjcXGu0yAo+q5OkLt8YEotfz+ZnjH7M:6FIWNBBPSq2XKyAotOmRliZnTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883613, "uuid": "aa7ba720-aa0c-4202-895a-491ced43f136", "value": 116244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883613, "uuid": "127d77ab-bf11-4e5e-acd3-507ac2161a52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883613, "uuid": "08d87dbb-9a75-4cf1-9e63-1e811685d8b9", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be21abf6-6be5-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781876990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876990, "uuid": "600fa8e5-430f-4faa-9aae-c089d1009f1d", "comment": "Malware payload (ConnectWise)", "value": "c7d335f29cbe4c1d87166fb6cff973d7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876990, "uuid": "1176690e-2f16-4118-88f4-ed17c0548e1f", "comment": "Malware payload (ConnectWise)", "value": "b1460e658a27a73d8ef45b2cbfee000b6dcf11c4c574f1c299a036a02631a971", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876990, "uuid": "1b843683-ca89-4e3b-99b7-702890ccaf0b", "comment": "Malware payload (ConnectWise)", "value": "d2d6f45869428072f6fbf806ae9955dc298ebb53", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876990, "uuid": "d1ace2d9-ca7d-46b9-abec-0e7c1c61a4f9", "comment": "Malware payload (ConnectWise)", "value": "8fbc0b15262c45d82e51c75e5bd293bb5b6cdb9ecb631d3f69dd9e0a905865f1cb0dc7251f81726d43ee3aa07fbff821", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876990, "uuid": "afa9bc41-9706-4c08-8f37-6aec8efb6c5a", "value": "T17746E101B3D695B6D1BF1638D87A52656734BC049712CBBF5394BD392E32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876990, "uuid": "dc62ea2d-f52d-4736-ad01-b174437d6bc2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876990, "uuid": "85b2669c-4ffc-43f0-b937-2e0d967f930f", "value": "98304:ezIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlf:ehfefPtHxcp9ym3nltDUJVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876990, "uuid": "80530ae2-918b-4817-81c0-bf4d4fbe68b6", "value": 5671312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876990, "uuid": "38613193-cd86-4e49-b554-cab7628da444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876990, "uuid": "4d0d6e1c-c033-4118-b8bb-3a59f9ae1e27", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b0ac9a-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875974, "uuid": "f859a3a3-d6b3-4a33-a0be-3d401b433d99", "comment": "Malware payload (Mirai)", "value": "c2d13574ebdfa433af8c6fc549e4092b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875974, "uuid": "106afe01-b0e9-4ffd-aaf1-1e1c802df41e", "comment": "Malware payload (Mirai)", "value": "b28b836feb16100ed027ebd7c9ef2a3485eb53285e5e1581ef841be82b2f0fd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875974, "uuid": "a7e5faa9-30a5-4a7d-b308-66c7b18fe4a8", "comment": "Malware payload (Mirai)", "value": "4cae9b93e11309ba4bfe650bd638f58a3041c6f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875974, "uuid": "90c638ed-746d-4f08-816f-8d053b1d8623", "comment": "Malware payload (Mirai)", "value": "5ec9fc32adbc3608f999e430d0dbff4a72d4385204503eef61a3deca7ceb1052e9d84e4c748eaf0d186c0f676a23ab04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875974, "uuid": "2dd1c13b-4ecf-4c9d-b58d-b862b789ff08", "value": "T1C6332ACBB8C19A5FC5D0537AA72DA25D3362A3B8E2CB3713DD1C5B15768220F0E9B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875974, "uuid": "fb7063af-1361-42d3-b01f-9a16bab7d4e8", "value": "768:cvUkXKpn2wUqounbHVWer7ecWm5EYIHrpAhY6Rb/3DedpqJkD6//sBN2wvaoedM:cvh+aqoUbHV/+cvCHFAC4bCu9/DwEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875974, "uuid": "b607bc6b-4f1f-4adb-a18e-a15f1c8dad82", "value": 50440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875974, "uuid": "53847566-30ed-4b61-bca0-c3dae69c44fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875974, "uuid": "969d1d6d-c11d-420b-b25e-31d93da09cf0", "value": "morormcey", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db2d6c6-6bda-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1781871997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871997, "uuid": "d61bcd31-35b6-427b-8d13-47d7795222b8", "comment": "Malware payload (Gh0stRAT)", "value": "523a2b9056600ea66910b8326bd287b3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871997, "uuid": "6afd57a3-95db-45fa-b953-fe8c5a8707ec", "comment": "Malware payload (Gh0stRAT)", "value": "b28c2832db2275496441568ca94960333d143b363e911d087f41e484f04fb515", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871997, "uuid": "1e3124df-6984-43be-ae41-83e1ba1aa0f8", "comment": "Malware payload (Gh0stRAT)", "value": "9f39653c69012d5e73097b4dcb749833b4e9041d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871997, "uuid": "777d15e7-6319-45fd-a4c9-824d772f84aa", "comment": "Malware payload (Gh0stRAT)", "value": "a13230a0ccc1baf30cd3b1e3b58fa075e2d9e9f4d6b86153cbb44c47fd7d4e78d8b45d9b019b1363805ac2c5d4da476b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871997, "uuid": "5a00d015-4853-4233-a647-1dad83faa5de", "value": "T1FC3733F7CCC8053EFE2705B4BF2599BC17C4F1C8A7679205A4B0D9E962BD566CAA0708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871997, "uuid": "d103ebdf-32cb-45ea-bdd4-27370b3eecb1", "value": "393216:dQNFXyszSKkpBs12X0RZMiEb21+2BsBPbDLrC5C+CM9fsE/bMUfbChmrTA6V:Okse5xUmN2KBHCe+BjxPrTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781871997, "uuid": "10ef0569-3102-4afa-a492-f8eae9fe23e4", "value": 23146976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781871997, "uuid": "81f32bf6-20d3-4aae-9871-ab696489bbe1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871997, "uuid": "186be38f-5005-45c7-a063-612f0cd7d942", "value": "19_06_2026The_Sihanoukville_Strike_Force_launched_another_major.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b570445a-6b8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781839609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839609, "uuid": "99545fb2-2693-49e8-87ab-f41423b6373d", "comment": "Malware payload (ValleyRAT)", "value": "b010d1d702672ae6f9e8c1d0ee88f3bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839609, "uuid": "5451bf4c-9642-4f92-8828-8a1897d96118", "comment": "Malware payload (ValleyRAT)", "value": "b37ebc9801fbd25c66d48bf254b94044c24952eaed80747bde1828d85a10f167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839609, "uuid": "ad2f654e-709a-45c8-9c18-b8098658bcf6", "comment": "Malware payload (ValleyRAT)", "value": "932e4c04ba5d0e1499c0da8443e799c244db32ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839609, "uuid": "54662eb7-48c8-4814-847d-14c37f27e0ea", "comment": "Malware payload (ValleyRAT)", "value": "2af0e2186cd11c9273feda55496315d3d5781b3787ae7e366d2f62e3af47a1284517bee9fbd4512f9a642578b87a4b39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839609, "uuid": "f0571cf2-d3f4-4518-aa7c-d50834df0c4e", "value": "T10D08F816B7468DDAF4299334889B4F50B372E8B157B1871323B423289FEF38C5FA6654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839609, "uuid": "d08241d0-f942-423c-acd3-4e687b6959a4", "value": "380560563ebacca1589d8d38ac610187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839609, "uuid": "c7c9e3f4-4d8e-46a4-8025-8266f9ab9cb4", "value": "196608:ZNnmx+fMeDrR91QJBqtiEPFNPy9iRlQTn2VMrqNU8kQmHZspvUED:HvfRba9i4BrqNhvUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781839609, "uuid": "aff65b3e-7608-49f7-b656-256fd619def6", "value": 77527552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781839609, "uuid": "f8a0cbab-8e4e-43c3-b8c4-e9d1c97c7b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839609, "uuid": "818d2cbd-cc9c-41b1-bb22-77e57f689b8f", "value": "ainstaller-86533012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c573282-6bb3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781855324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781855324, "uuid": "81e522ad-d114-4e1e-9c46-cc2282e55b95", "comment": "Malware payload (AgentTesla)", "value": "795c7267c612a35f45b70120fc3d5682", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781855324, "uuid": "3e1c99a0-8401-4c4f-9fa7-dded26c131c7", "comment": "Malware payload (AgentTesla)", "value": "b3e6f481349149ac067e61cfec7bc07d396dcb106d373b7d99f94f71d72a6509", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781855324, "uuid": "946f6f1d-741d-484e-9552-3e565c6b80c5", "comment": "Malware payload (AgentTesla)", "value": "10a2c80109cd7240c1106b59f581a1aa30eeff0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781855324, "uuid": "c6c91319-d362-44bd-b7f2-7f35f3ccbe09", "comment": "Malware payload (AgentTesla)", "value": "c9f9bf72b4d4aac09413154834358f8945e5b9224af8ab43e9186ba886142863339df15308fe846b8f0e485d7b3ab1ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781855324, "uuid": "fb495a31-68b2-4344-a8df-365ef1352952", "value": "T1F4B42225AB65C5B6C83A0531ED66C6FE57A9ED13E0F2270F63903D077834F82582B2B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781855324, "uuid": "903c0278-5400-486a-b495-fea8f38c2d8d", "value": "12288:8X4Qiq8MhMwvww3r/6TPHWElAWoriCykqlOFVtGF3rP:G4QCMhMwvf3ryTPBpoD1QOFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781855324, "uuid": "93547632-9c4b-4510-be58-8c948b5f6629", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781855324, "uuid": "c22e5191-84cf-4958-b052-d7b22435e4b2", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781855324, "uuid": "c8126b82-a49d-4084-abaf-78a9da7d6cf4", "value": "Commercial_Invoice.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f742e9-6bca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781865295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781865295, "uuid": "c25d2b4b-833c-4f4f-bb40-f06400770c65", "comment": "Malware payload", "value": "7a11cfded1619090ab1def9b8315cdd0", "object_relation": "md5", "Tag": [ { "name": "a3x", "colour": "#3BF377", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Eimeria", "colour": "#2C63C9", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781865295, "uuid": "d5aff61b-2d1c-4467-a69d-5a196fb676fa", "comment": "Malware payload", "value": "b4d2cbf5afd599d7a833cd7378019744bb310987ee51e4e40ad5619fbf79e8b5", "object_relation": "sha256", "Tag": [ { "name": "a3x", "colour": "#3BF377", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Eimeria", "colour": "#2C63C9", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781865295, "uuid": "286087fe-251e-4884-830f-e47dacd3819a", "comment": "Malware payload", "value": "64a449fe372f7b25644d9b2836c30ab3ba4aa757", "object_relation": "sha1", "Tag": [ { "name": "a3x", "colour": "#3BF377", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Eimeria", "colour": "#2C63C9", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781865295, "uuid": "4a3e83cd-1396-4c60-ab5d-6e9a1ac00e22", "comment": "Malware payload", "value": "60c44e06199d65dec0dbdad572f81f73bc369c2357a2bbf0fda673b18643b6426ce724a34bfe8711a725ffc5aad342b3", "object_relation": "sha3-384", "Tag": [ { "name": "a3x", "colour": "#3BF377", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Eimeria", "colour": "#2C63C9", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781865295, "uuid": "adcc5f88-c272-40e4-a71e-df10824de46a", "value": "T1FC0633B39E05972F3FC51449A525D5B96C2F884E733EA5E1F4A7C114C2F6C28AD0263E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781865295, "uuid": "2a37ab6e-79fd-4070-b153-59d619d35469", "value": "98304:rR2EIuKkyK1W+4y4YBwLNooLwwIyK7FnwEtIZZg2uN:rRXKw8+TsbDIrFn+D1uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781865295, "uuid": "2c147219-b940-4f1a-8466-8d4e22d1d68c", "value": 3967774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781865295, "uuid": "2eeb45e2-fe91-4322-89ed-fad9050b119e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781865295, "uuid": "76b6479e-0c53-4d41-959b-161b428fc67f", "value": "bMgXiqSim.a3x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8871bf-6be6-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781877120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781877120, "uuid": "f559b031-db66-4c4b-b79c-61aabb4cdd07", "comment": "Malware payload (ConnectWise)", "value": "e04024b78d295389fd13e0579cae0d41", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781877120, "uuid": "c51ab1ef-2695-4b84-9190-eefa860bf869", "comment": "Malware payload (ConnectWise)", "value": "b4f73c85e92211bc86134c8ca4731983a42ed901fafe16e59640018281ce4d15", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781877120, "uuid": "3c5fbe94-19eb-440a-8094-95b5a08fb519", "comment": "Malware payload (ConnectWise)", "value": "f66fb3b1337c7d4329ab9fa0889171176ebed36f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781877120, "uuid": "62a2ee76-408a-4cc3-bce7-5f368f8b60d4", "comment": "Malware payload (ConnectWise)", "value": "912615db9896c4408719cff2a76923c52e606692eff181565d5cd7a44b87a26e2ec02ac5a2baba2ee3e8be6596ae0d54", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781877120, "uuid": "791ef357-0478-4a9e-9afb-b1ac2cf1d94d", "value": "T11C647C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781877120, "uuid": "15196c90-64d8-494b-a76b-849262f74a8e", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781877120, "uuid": "15c068aa-6309-4533-9645-0878f2458311", "value": "6144:gmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9c:r1iw7gryNkSV1hy1Z1u2JLu9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781877120, "uuid": "36402136-b065-4b62-8fd5-2b6d57391dcd", "value": 313928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781877120, "uuid": "55bf8ff3-f4dd-4c57-b9a3-5a702da615fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781877120, "uuid": "21e0eba6-ff3d-4f50-aab0-dcf4fe0d95dc", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a4c3d9-6bec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781880091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880091, "uuid": "1ca43b0c-acaf-4adb-ba44-81d0785b0ac1", "comment": "Malware payload", "value": "a70f6a381ca6407f1539bdfd6ae8ec38", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880091, "uuid": "09a321c6-8171-43d2-8d47-d0715900cd67", "comment": "Malware payload", "value": "b57c3186303f4a56ac70699bdef1aede047db5a118370f93df0171d9d2add0d6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880091, "uuid": "a362f8b9-f55d-4d73-929e-27aa935d7376", "comment": "Malware payload", "value": "a523085c74e35e8df5ef7f18eaefbb6952bb8b66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880091, "uuid": "cf08ee5d-5343-408d-9b62-b2169c66bd82", "comment": "Malware payload", "value": "8f950a351c982dc9f131c1fffdb615f56a045e9c487abd4cb3f33e880e2a918d690b039e4087189f8894e0dbfd76cfa7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880091, "uuid": "bccbdfc7-462d-407c-b456-bedfa3e9ee96", "value": "T12B01D043F63B9A6FCD5176C99120535CEA828F9125038677BA9D4C0C4313D1743474CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880091, "uuid": "6360343b-d66e-441b-8d85-fe695532ebcc", "value": "24:ynDmOMGvol0Q0MGvkf80KhRzp5mH5uTLmOD5uwXecT0VZ/qajWf:ki4oxH4ksft56vODhiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880091, "uuid": "9fbce7f8-8054-431d-a191-91db24f4eee1", "value": 791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880091, "uuid": "77e22384-7a55-46e0-a006-60c2393cf385", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880091, "uuid": "83ab1b06-2f35-4cf2-b48f-b30760c5519b", "value": "System3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcfba44-6b8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781839868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839868, "uuid": "59a8959b-2c60-42c0-ae0c-3bf390770805", "comment": "Malware payload", "value": "886a2596fb1666dc0b2d2877f9c9822f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839868, "uuid": "7bae239e-0546-4205-9254-421bf7f5dbe8", "comment": "Malware payload", "value": "b58a6ad7a227cb3765a027aee97a5b32e96caac737743bdcad804ef3970f2897", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839868, "uuid": "610c45d6-8f11-42a4-9d1b-ab199c134c79", "comment": "Malware payload", "value": "19f36d490d581ebbdca7ec47e43aac9a62cb631a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781839868, "uuid": "7feda149-2436-4ecd-be8a-bf0718cac935", "comment": "Malware payload", "value": "0aeb00fae8f22a7764faf4b859759bd26e683902e191ff9c465256eaba75f0861618db9f46aed56909b2cbe2ce25ac9c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839868, "uuid": "32ea4f36-edf8-4593-b43c-bb57a43f9ae6", "value": "T1DF137D6956817C24AE99883B1C7E2F1CB9A983E1310851EDBFCB3CF58C496DCD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839868, "uuid": "e0d5af82-a111-43bd-ac21-a17239466491", "value": "768:4+49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:4+lcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781839868, "uuid": "a11e352c-5412-47dc-af75-162300a7ca53", "value": 45212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781839868, "uuid": "11e4158d-b65f-4bd5-9f2d-01dbbe388b85", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781839868, "uuid": "97e76fe2-2d43-4a73-b828-fdbcf1800eb5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c4cfcf-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886242, "uuid": "04d3ae06-3cdc-4c8c-8285-c9c63aaf8f92", "comment": "Malware payload (Mirai)", "value": "1d1d157f573e4942ae7df42cca607f5c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886242, "uuid": "118de2a0-fef6-42a7-aaba-37055972422d", "comment": "Malware payload (Mirai)", "value": "b65e6d8f3462e09d4cf550239857e3c6bde1e99f8968d89f084880e6eeeda324", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886242, "uuid": "887a0560-0db5-449d-a3b8-70e886eeca37", "comment": "Malware payload (Mirai)", "value": "2c841080cb29046213ce64d708f6df92d39c7413", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886242, "uuid": "b6f5c1b0-4805-48ee-9fb3-1707d76f833d", "comment": "Malware payload (Mirai)", "value": "d318301f829674b3ddb6b905030f50e1f189552a829a1b18bff163c49bb5044f3c202a06140811ed1e28810532cbad6f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886242, "uuid": "38720107-a2a0-4f3a-9783-2a28dd6d6292", "value": "T196A34B36B874192FC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886242, "uuid": "78746041-2383-42d7-b1f6-7f9560de0316", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0oSj:bbbmPTO930bkbRl886Sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886242, "uuid": "194b0d3b-aa2d-40e6-940a-3f011de326d7", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886242, "uuid": "b934681a-2136-4209-8589-e046f6b54d59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886242, "uuid": "02cf116e-b4b3-4c1b-8172-e26a914e5b7a", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322ac65b-6bac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781852274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852274, "uuid": "c7dc1120-7bca-4236-aae9-8a7232b766ac", "comment": "Malware payload (Mirai)", "value": "48db706e556b1b9220ab4dcaf777a1bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852274, "uuid": "15210574-4998-4cc0-8ae9-71917d6902fb", "comment": "Malware payload (Mirai)", "value": "b6879f66c164afdb98d084b660bcf9e2297d70c1fe616007da9538f5d48cd6b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852274, "uuid": "7be650d3-d99d-4759-9744-e0f3c801d48e", "comment": "Malware payload (Mirai)", "value": "1a3ba54a948f59ef6af9e5ae06b6a6b335fae0fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852274, "uuid": "11fa4ba7-013c-41b4-8c91-6125f08be6b3", "comment": "Malware payload (Mirai)", "value": "2715f3c8f3ae632ae786c8423a143f208c5418e31eadb38171bc6c74f333398e1e37299b7eeebada5184bb99834ba1d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852274, "uuid": "22ff1d94-74bb-4a36-87f6-1ca94a84584d", "value": "T1AEC3AE97F68B20A1C86146F007C76BDD2EA361119E6BE9E76C0E767B097A0DF1C063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852274, "uuid": "4fa8d37e-3de6-4bcf-a2bb-f56d8e11bce0", "value": "1536:cZFXqobBgRG6+SiIZYte/LabWqGwab2mIW8fSVCLxZJOUghy/LWg:cZFX9fzSZite/Letq2mITSVCEUghyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781852274, "uuid": "38d0f060-6446-49f6-8a93-432e5981fc0d", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781852274, "uuid": "d535d70e-cd55-41bf-8ecb-2fbbe5d9dabf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852274, "uuid": "841ef69e-a781-481d-b354-53a9abc074fa", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2a7934-6bc5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781862978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862978, "uuid": "fd17f7e8-ef43-42f5-9627-10a7028ada0d", "comment": "Malware payload (RemusStealer)", "value": "8577828ae34de7b83d589043bb264d8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862978, "uuid": "0ec8e285-1c10-49c5-85f1-744f0ea28490", "comment": "Malware payload (RemusStealer)", "value": "b699a24254fdb28c85fd40c1019703c40fce07ec4bad324bcbc891aad28159b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862978, "uuid": "203b9df1-5318-4eef-99bc-782682de62cf", "comment": "Malware payload (RemusStealer)", "value": "4f55c0fe431faa1e0372159590cdc884077f806d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862978, "uuid": "12df6bea-8d2d-4c2b-9a7a-e2f1f619d8b9", "comment": "Malware payload (RemusStealer)", "value": "2f993cb166fab67c57282a7d98205cfe8fc24616f27ab8c5fbf4e6e4520cb91ddb56c80a58122c202a7e5cdadf30e506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862978, "uuid": "3182fc1a-2e1e-47e1-af53-56f481f03791", "value": "T14AC54A07FC9108E9C49AA33189B79296BB35FC441B3227D72E90B3782E727D06D76B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862978, "uuid": "c5e1b7de-8032-472e-add7-dc403852baea", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862978, "uuid": "64af4dab-f199-4ffe-b844-465b8703b9e7", "value": "24576:VoI5NQVPLpFFKluGGx8o3PctJrh9E+RX9ldy7qJ03ZvA2Bele5IK2udbuLDJtSfY:VoI/mjpjeuGA8iMTt8q0Qo8IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781862978, "uuid": "ab1983a7-0052-4e3f-a630-e6ac2cca7684", "value": 2602360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781862978, "uuid": "5f430c26-7fe9-4900-8860-9e7f996a2220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862978, "uuid": "edcb70cc-bb0c-4d84-8cae-869ffb4ed078", "value": "S\u0435t_U\u0440 [U\u0420D].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303828d1-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850123, "uuid": "f3f812d0-6d9b-4890-b0d5-b6ca36d26168", "comment": "Malware payload (Mirai)", "value": "dd58be6b2f33134fd5dfb1fb98a3a51d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850123, "uuid": "e16be71e-392c-4dda-964e-8a6fe5bd1c6d", "comment": "Malware payload (Mirai)", "value": "b6c043e74a1309bfe4c52057145604a8f1d4e9c3cd3c70d8093b1985833738d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850123, "uuid": "f15648a6-edb7-4950-a5a0-929968188da4", "comment": "Malware payload (Mirai)", "value": "2315b84ad13a42e21c94a79efa0e574edfc06bfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850123, "uuid": "69e49152-c47d-4292-a3c9-60c1376ce3c1", "comment": "Malware payload (Mirai)", "value": "e9c4a510dd706d4a9695653fda996f5896e586922a12fd3761badc454e013b4096936498a584278d0e64f544ce8797b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850123, "uuid": "1ffb5cc5-b031-4aad-9be9-2598f01dd546", "value": "T1BF430169C5D2DEF0F21236B3CB15C9989E83293AD5A9BC9B3A0118A47853F9587D4CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850123, "uuid": "7222d30a-ec35-4d3e-9d66-1a582e90d7c4", "value": "1536:pPS4tGxWZ8hK+RukmPRx6Ti9okxu7YYH9rd:pPltGmt+FmB9LoYo9rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850123, "uuid": "4a49735c-f976-44ab-b87f-0ce231af6e35", "value": 59164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850123, "uuid": "87cc2560-8c7f-4564-ab58-59e1f3933edb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850123, "uuid": "2ec38671-f0ba-42a3-b130-2c9f0cb6974f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2fa2ff-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875964, "uuid": "36ea1649-c84e-45b6-adf4-c3c661aca7bf", "comment": "Malware payload (Mirai)", "value": "d95c95f2c9b90da7a085962afc3922e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875964, "uuid": "ae2b5972-ec6b-4321-a850-dc559c2a6bca", "comment": "Malware payload (Mirai)", "value": "b88d377c96205efccc5e74768f1596e04e75fcffee005b3418c83aad6a5a116c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875964, "uuid": "7c0a19a4-6f85-4ce1-b9f7-d844700536a1", "comment": "Malware payload (Mirai)", "value": "a972715219ee1ace30431bd9538c89f425fdc91f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875964, "uuid": "a79a48f2-01b1-4d1b-bb1b-3c758556f455", "comment": "Malware payload (Mirai)", "value": "4d983771d4d514c03c2910c7217c3960c772126e7946fc7f822b9269eede011b052e05d7701d83914b09246d3f6e69f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875964, "uuid": "f7df1962-faba-4470-96d6-bc032bbc771f", "value": "T1E5832985B947C5F5E8AB483051A6BA3FD371ED281069C65DEFDAEE31DE33400631239A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875964, "uuid": "bbe98757-e9ec-40e2-a83e-bfc86415218b", "value": "1536:WFOkaCq9Rcrbm63oG8rr+R3LG+Wrhm6y8RIoRjU2fYfSqxRTX9:QZdMRcr5orrE38r/FRIoRQ2SxtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875964, "uuid": "53595c92-52bb-4af3-8fe4-bfcfc99ac3a6", "value": 82868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875964, "uuid": "22392fa8-cd89-4bdb-8a8c-4f49bc211f88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875964, "uuid": "2bbe959d-b60a-4aa2-a467-778d97233a51", "value": "evpyuqbis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c17a0b-6baf-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781853696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853696, "uuid": "b01234a3-d0ea-407a-8658-7c4e5815cd67", "comment": "Malware payload (Gafgyt)", "value": "c0f7226af7f35de01ced4e95cf1e54fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853696, "uuid": "9ead0f16-d8ca-4ae8-9390-a147880c3d2a", "comment": "Malware payload (Gafgyt)", "value": "b951c92d9a0490201ecd3bf75cb9ddc792f3b6ca2d4140cce413d819053dee58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853696, "uuid": "e7787c7a-502a-49b7-8096-a78ecffadab3", "comment": "Malware payload (Gafgyt)", "value": "d8971224fa1398718dc26c4e18fcfa300f8a2bc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853696, "uuid": "7384d703-1249-4311-baf5-0e19eef3ab9d", "comment": "Malware payload (Gafgyt)", "value": "503d29654a5a904f499e4e00756f8e2bc4b8cc0829d631340c7706a2908038bd28a6e1038f16d7b727dada9f262fd999", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853696, "uuid": "462a57ce-a986-4509-a2be-cf62fa29ec78", "value": "T1FC749523D8154595D1615CF322273389AD0B87BF89E732D3EE2A59A0BF2051F52BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853696, "uuid": "049c9647-a5c7-4c9a-b2d3-0dbe68a31606", "value": "6144:cYCHtb55g9wjotAXOrGmy4PaQCCW6iGzNb:9CNb5qwjJXmy4PanCW6iGzNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853696, "uuid": "7805db93-9f7b-497c-906e-aa392dd19875", "value": 356287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853696, "uuid": "af4723d5-a56d-4238-933e-356b806ed4a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853696, "uuid": "da325116-10c8-4c5b-9726-26608f667aa0", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6031fbb2-6c29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781906038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781906038, "uuid": "e6e24c13-8f26-4a34-8841-e41c7a7632ac", "comment": "Malware payload (Mirai)", "value": "302554c73a2313dee937dea154d65ad5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781906038, "uuid": "bc4cb517-8629-4030-8010-67f8713b513b", "comment": "Malware payload (Mirai)", "value": "b95e271fc0e02a2900909967ef7ed6f0aec529b5cbc82a124adc92fa62ab89cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781906038, "uuid": "e5ccece2-c63d-49e4-bc38-3ea339634777", "comment": "Malware payload (Mirai)", "value": "26de4ad832c570299f997ed020f1d5abc4852c3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781906038, "uuid": "7e38bd96-0488-447c-8111-0ba9e194700e", "comment": "Malware payload (Mirai)", "value": "5c52a281e73ec85f8823c2128074ad239e54b4400d0c99c7c1d862acad6684acff515a44eee833311f0750c75bdfc7b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781906038, "uuid": "c59d0a07-9006-4f09-b632-c9792512ebbc", "value": "T14E730241B912E43445FC6FBED62CC1D7774271E072C0B93F741A0AEAEAA970765F2528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781906038, "uuid": "6807915a-5594-461f-943c-d8ab78fc14e4", "value": "1536:mqTUXYi9GE491HXWfcXs7aX26q2ACyvw+H1Lfav4c3ywOceI3fYXzV:mwy4XX87aLq2ACcFSvfGTXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781906038, "uuid": "26c5e835-e3b1-47ee-85cf-d45a4f7b9a2c", "value": 80464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781906038, "uuid": "8f49f752-8cf0-438b-a50d-656bb1917cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781906038, "uuid": "9910bfb4-e811-4a0c-87b1-7a1d29c7b3bd", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98559f6-6bc8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781864554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864554, "uuid": "b399d895-6d2e-46f5-84f3-016e6527ecca", "comment": "Malware payload", "value": "183f9e622a28eed22aa02f757acc8689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864554, "uuid": "7a307a10-58e7-41cb-88ec-fef7a2438aac", "comment": "Malware payload", "value": "ba8778eef14be1bc9ce58ca8d06c279a82b8da49ca716fde8fdc787d23c27c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864554, "uuid": "51c52952-2ee5-47ef-8257-dae839b53fb0", "comment": "Malware payload", "value": "0fd45996d30d90da7c0a498cd795270f687906d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864554, "uuid": "dfa919f0-09bc-47a1-8664-ea324227d282", "comment": "Malware payload", "value": "67b60fba9904864e673c800d1a6a92a867ee8a31e3596ad3ef5a4407309e83317a3c05af709e4e3a7d29b48130af6d4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864554, "uuid": "d845674a-92b8-4fad-ac2f-7d96998861d5", "value": "T126575A05B3D0FABCD11AD534CA639B32C271B8DD1737928B1695D60A2E33B9D4B3AE11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864554, "uuid": "1853f9b0-7258-4926-a29e-4442260c7573", "value": "6a71197838babad857b54a6ecae33094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864554, "uuid": "46e25bc3-25ca-4dbf-9988-39434c908e1b", "value": "49152:TYm3YCEU2fLT8aQJC8PQTUAsCMwQKmzurSJvfw+:KrU9PQTUAsCMwQKmzurSJvfw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781864554, "uuid": "58e1e179-5621-4edb-955a-e14706f29a25", "value": 29147136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781864554, "uuid": "e11320cd-2e09-4286-bac3-23885f1912a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864554, "uuid": "07a9cfe8-3ce0-485a-9fa8-314cbf9e4969", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c4ab5f-6be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781876337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876337, "uuid": "fa796a3e-3c88-4107-a162-9a9cb61d2e00", "comment": "Malware payload (Mirai)", "value": "fb90842962c0e06066fd46c542df8974", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876337, "uuid": "71ad525a-8403-4384-b338-83aa2dfca471", "comment": "Malware payload (Mirai)", "value": "babac9e43b45d51cfcc4e6e92123474fc1c2ea206f40b08c0b85518ca3aa3cd4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876337, "uuid": "117e6245-489b-4a51-be09-c2fcfe3902b5", "comment": "Malware payload (Mirai)", "value": "2cd3de288849ca3728e2abcf5f02ece89f571821", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876337, "uuid": "bf1dd13d-be2d-4731-9dbf-df633012c39b", "comment": "Malware payload (Mirai)", "value": "14d21aebef14cec2e6a765a9da8cce97e822401117b234f3915ba0900d92fae8c28613f1d87b319e4abb4dc70ea0ae51", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876337, "uuid": "12815b76-9dc4-4134-aebb-2773c0cf6d51", "value": "T1ED157B233B11DFA4E355D6B008F3CA9156E521A21BE24089A27CC7187E61A5E6D1FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876337, "uuid": "22323b1f-b8d6-493d-8275-320b2371c112", "value": "24576:Qtx7dU4G8uFxBrXtvgXI6huURWxLorjR+Deqh+j:4C4GJJXtvgXI63rN+Del", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876337, "uuid": "26909b97-f374-44c7-bc7d-21a877c99765", "value": 946672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876337, "uuid": "f3b31b1f-d36c-48ce-9fed-eaba3472ee42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876337, "uuid": "e2c24ee0-0fbe-487b-975d-d36d64c0d079", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4696ff3f-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "4ad29dc8-a426-4f48-8108-88dc40ac993c", "comment": "Malware payload (Mirai)", "value": "73898a233282b5ae9a9bd5bed31d33fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "f9c89da3-f35c-43b6-af64-d0d14accae95", "comment": "Malware payload (Mirai)", "value": "bb2ec886896b86da3c7d8374414cd6ba7c5c1a46aa673ded0321f05972b2571a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "bb598354-2a95-48a0-9c06-a79f6bb48724", "comment": "Malware payload (Mirai)", "value": "f585e7e52828322d092d2c8d2fde09e413f399aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882803, "uuid": "602fdb90-7de5-4453-abb7-974cad40e306", "comment": "Malware payload (Mirai)", "value": "7a8760593897093d6e2c6c493f6698d5d084efa85538976026bc5e4d36823e050d924bbbdc6a0fa30684cd72df45ae5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882803, "uuid": "0dcc25e8-4f4c-4622-9cbe-0ee7c60e0cbd", "value": "T19083AD32EA292D44C0455570B0B98F395B73A5C083476FB666FAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882803, "uuid": "ce53d963-cd41-4ae7-8a2d-8a737632764a", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7f:UeAsdukuhoNJVwbmuUqjLjwWif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882803, "uuid": "ec2fb52e-e3c1-4e4e-8dc1-d763458d4c7f", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882803, "uuid": "dbba55bf-b1db-418b-85d5-7242e1eeb3b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882803, "uuid": "972b5599-08d0-4649-b4eb-ab3b3cfb5980", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0c3912-6c14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781897205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897205, "uuid": "86c4d749-2b92-4bd4-b0e2-9e6d214d155b", "comment": "Malware payload (Mirai)", "value": "37ea1c8113f76ce7fc3c339cac154df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897205, "uuid": "8f33221d-588f-499c-98a6-9f665f538eb0", "comment": "Malware payload (Mirai)", "value": "bb5505b5051a656647c47d774084898fec1da2e50b061964a987affec36a5d6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897205, "uuid": "03272cb9-ef8c-4cb1-a679-b40b3bf12e0d", "comment": "Malware payload (Mirai)", "value": "1f1decdbb9b401a346070cff9928e17001a11026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897205, "uuid": "a8f6a98a-09af-48ac-a981-37e82dd6b79d", "comment": "Malware payload (Mirai)", "value": "07085fced9a931e367a22ff0254b06d10c5494ab21f7841b9958b12bab6a748dbc583635a53de8871f1bcbcaa165c40c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897205, "uuid": "bb275aeb-de78-48a8-a144-433a85d6c672", "value": "T1C9934B46BD81DB02C6E82376B95D82CC332603F8D2EA7106DD266F6137DB91B0E7B654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897205, "uuid": "fb6c1bd5-05db-489b-9d39-6a2f68504a0c", "value": "1536:UFEHrxOAHGUpRbbiLfHOaoqR7qW8lnDIU0eifWXj1Wm2cdMFT48YV0r:JHEUPbbiLfHOaoqtqW8lnkU0ei+YcuvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781897205, "uuid": "a9c4dedb-83d6-47e1-a89d-8d9b6605e324", "value": 95548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781897205, "uuid": "bf9b511b-92fe-42ea-a6ca-14322d60e152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897205, "uuid": "da8515df-8e8c-466d-aec0-5f17ba425a83", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354b0d90-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1781850132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850132, "uuid": "21e8136c-2eed-4a8b-a11b-312a5d952815", "comment": "Malware payload (DDoSAgent)", "value": "7afbdc8779326c60fb2441c7fddd920e", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850132, "uuid": "3d3b065d-ac97-4d0b-8510-661a482a4f28", "comment": "Malware payload (DDoSAgent)", "value": "bbb1aea5f2871ecc233fad92ae0dc9667d8ef226bdcfc56f71fe3562dc2dfcf9", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850132, "uuid": "f683d6ff-4899-4bcb-a443-543f04aa3b93", "comment": "Malware payload (DDoSAgent)", "value": "a8b0b51725d08b998e98322216d663ad020813f7", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850132, "uuid": "0c7c0a3c-28b9-4c6d-adf3-d4c501cb3163", "comment": "Malware payload (DDoSAgent)", "value": "7b77eba1153832d7f138168cc3a4e761d00fc857ee1563229365cad39e7bdc8a28bd3f594d93500cba56b893c1f46af0", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850132, "uuid": "ef52719c-d219-485b-a3c6-1bd4f95100ec", "value": "T1AF8639637A1DEB0FC62861345DB2CAD4276A1C9602D79557B381F319FAF20AC496ECF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850132, "uuid": "cdd3b717-c4af-4d1e-b9f6-0d17ad664db7", "value": "49152:3howQC1S0aZLwPA9g1eDYMtU1c4394vFjQWQS2Pbg2jvfIx0kdWMVpsIKpUhlHHg:t1O2hksr4nUjEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850132, "uuid": "dd8d80b8-9302-4dc9-9525-4bdd2da700e1", "value": 8061143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850132, "uuid": "3bd34b86-a64d-43ce-bb4e-09ac253382cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850132, "uuid": "29ab2b29-a5be-41a6-9413-4c9950551080", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2fe9a2-6bad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781852878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852878, "uuid": "1f9ae421-be83-42cf-a903-1c1758d297ca", "comment": "Malware payload (Mirai)", "value": "466be7d2f39d28fef5d6672dd77d5faf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852878, "uuid": "22759bb0-65f7-4f8b-9a08-e1af050a54e8", "comment": "Malware payload (Mirai)", "value": "bc66fdecf9f5c390d56817ba043d3fb71629692a921883c5895ec6dca885d54e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852878, "uuid": "978f4185-6063-4a00-b50d-a97be8c14eec", "comment": "Malware payload (Mirai)", "value": "9b22f62912966bcaefda37f5108290115e9d20e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852878, "uuid": "37e645e5-643b-4e67-a5c9-67d058941a7c", "comment": "Malware payload (Mirai)", "value": "8c7641e1d49f908bb9875f5f3657847d1d073d48c9089807d3014358b3263e085de62d60ac7ab373209166f3beebab17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852878, "uuid": "bda7401e-0388-4c68-9849-d3117d534888", "value": "T1DA63029B42DAFBA5F87BA2B0B00E942E1C13D1760D55CDAF4E64913BE564A118CED3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852878, "uuid": "e79f73b0-ba81-4179-8bb6-0641e7d94e43", "value": "1536:l8qZC5XIQOEgtnQQsJzbojKWMixJBWBWlAhdiGDzo0ALnouy8ryf:l8D4QOReobWBWlApzo0AToutQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781852878, "uuid": "8bf7f865-5173-4015-813f-ee0764bdaad0", "value": 68484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781852878, "uuid": "3c3b248a-8b57-44cb-8823-09ed07fd0a88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852878, "uuid": "fce2127e-dc8b-4d07-9aaf-1a1192cf7a63", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252f0c73-6bae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781853111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853111, "uuid": "bcfc3457-76f6-48c0-a0ad-d741002086ca", "comment": "Malware payload", "value": "f125f59a8cc9305bdbdf13190e23c9d5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853111, "uuid": "16df5dea-cf22-423d-968e-b9cc55aa6b6b", "comment": "Malware payload", "value": "bc786c43d85ae98751e34a655df52d53e0819b7add763b8ab348037aec89e47c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853111, "uuid": "6f0ce6fb-9c64-40f0-b208-d27ae73416b6", "comment": "Malware payload", "value": "264ce6142dcac9b53f18be8c4ddfde50c1834860", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853111, "uuid": "61fe66da-2357-498c-8448-9ee4f68da7a4", "comment": "Malware payload", "value": "2417371a717352a56c1ca54d2731555a92e4656565c7e3474226670e6af8a11c7566e41258884743e55fb2c00025b91a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853111, "uuid": "06a86dbd-3bd2-4b2b-aa15-76d31d8f5021", "value": "T1A6016BDA4650A9004039DA9E76D751D0B521C3CE468F0BB87FDCAD3EFB88D04B066F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853111, "uuid": "2276e631-eb62-4631-b29b-4c8ed5a8a878", "value": "24:kXCKysE2hi0ziQvZoha5kSeeL8n6mSUu7:e9Qp+Ms5kSBYn65h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853111, "uuid": "a1b4875f-a8d7-4a49-8a62-0b462f4e7ed7", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853111, "uuid": "0964e16e-b575-4f18-be56-cf7a576495da", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853111, "uuid": "3e4b2181-78aa-4539-867c-17104f43eb79", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc80211-6c10-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1781895186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895186, "uuid": "8f8ccba8-34d8-430a-8a30-ab23e410d3f1", "comment": "Malware payload (Socks5Systemz)", "value": "eb1f57528b27d4b3e082c2319ab48c83", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895186, "uuid": "280e08cd-3ef9-4104-ade9-f11f1d96fee4", "comment": "Malware payload (Socks5Systemz)", "value": "bd1d53a32cafbb590c460a0a0933690733df7219d5640437ca4e80f91b7802e5", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895186, "uuid": "e005c05e-62ed-4f7b-94ce-6737b101ae5b", "comment": "Malware payload (Socks5Systemz)", "value": "afde2e9f7478a53948eea4a431fcae09eb64f6c5", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781895186, "uuid": "6b474227-584d-4b4b-a609-2debee6c7d4c", "comment": "Malware payload (Socks5Systemz)", "value": "c367cf0e3eb2afbc04634d19af923e5d1c05c93e5cab082134d8887744a3d6a442efe6862521d9ed9b6eae8792a49948", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781895186, "uuid": "7af120c3-d6f1-4ebb-af8a-f78a37424995", "value": "T146F53325A2B44D34D69B5A78CE55C52447336DBA2C3B21C7332D9F1DAF632C1C417B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781895186, "uuid": "1ff8c909-bd3b-4e06-837f-8a537839cd84", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781895186, "uuid": "f8434686-7b34-4b1c-8b94-64e026bbd1c7", "value": "98304:NhjycksJfsoXerIgujV3d6UlGoypkt81PZkzJU:HycksJfsCvt0CbyP1BkzJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781895186, "uuid": "ef0aa439-89e6-452d-9db6-3ad0a567a2d9", "value": 3373071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781895186, "uuid": "2b4b024d-1c35-4390-aee6-ebbbd104d9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781895186, "uuid": "599bca3f-d2b1-4320-b5a8-908884c955a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35a2398-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913050, "uuid": "72acc9e4-a9e1-4401-b14a-739c6afdc6b7", "comment": "Malware payload (Mirai)", "value": "b98442dc78c700c24dba7d0d163f5b39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913050, "uuid": "720c7de4-9200-414a-99db-f503c1ad5a28", "comment": "Malware payload (Mirai)", "value": "be317ed9610733a09710965b1c2d43ed5ecb16780dac206b972be07bf7fabd10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913050, "uuid": "8efaf9fd-3528-426a-a6c2-6f86c9126a91", "comment": "Malware payload (Mirai)", "value": "078692b11eb728131281fe244830ec00f3f5d957", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913050, "uuid": "ac497b30-222c-49a8-a8b8-fd6f0807c387", "comment": "Malware payload (Mirai)", "value": "e461a8d56e0f495ff92e61e6b6a7440e279c0d6158688774921afcf82bd801e0498c73937eb9a2111a1a679e88a44026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913050, "uuid": "8f5140a9-b230-4fd2-81c4-dc54fff21f7c", "value": "T126D32B16B9518B12C5C325BAFB9E514D33132FB8E3EE32129D106F64678B8DB0E7B512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913050, "uuid": "e140c31e-ec83-4939-bd17-ad214bc70925", "value": "3072:IxLde8Q9K3uG6hhqFYx4tCJFGwox3apemWXlElDIPzeQby:Iet9auG6hhqvoFDo1aUzlEEzeQby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913050, "uuid": "8425288c-fe9c-4985-99d9-5cff83574b34", "value": 130716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913050, "uuid": "7c446e3d-dda0-4569-8dbc-a4165615807e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913050, "uuid": "0c6a9912-cabe-4567-a7f5-61dad6ae545f", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c4c9eb-6ba6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849817, "uuid": "e4cc725e-49bc-4a42-83b4-f943187d8988", "comment": "Malware payload (Mirai)", "value": "bc2067c3608239ea0b8ca940a175c26f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849817, "uuid": "af5db7a5-9763-482f-bac8-160de0408b8c", "comment": "Malware payload (Mirai)", "value": "bf24bb11d0dbdacf7e077a68f9db56e563a2c32287194f7c63c7f1a061aa177a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849817, "uuid": "c1a58057-722b-4604-b294-c9aa88739b39", "comment": "Malware payload (Mirai)", "value": "6e67a105300989df0f8c7212dd902bf2c9399480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849817, "uuid": "65c5d5bd-f6b0-48a6-829d-69deeff75688", "comment": "Malware payload (Mirai)", "value": "2ac1fc482de3ef2b051c90aed21de60eae8417bf03c45cff1426fc7842179db71309cc6569f3510773ccdbcc09befc6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849817, "uuid": "94b44604-d4f6-4c43-9f15-0226e4013749", "value": "T11F13F2439322BCEFC2E21932FCDA4F4BA78A16BCF6B4306512951F54B57594843BDC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849817, "uuid": "4c217c52-f78a-407e-9c38-e22d3a5f8f67", "value": "768:771EEOGtzkkoJhXOoapehk0xi+uLaaBs/BAdZejEbz//Xvb9q3UELAM:7xEhCQJheoapei7Laj/BAdMYv//iLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849817, "uuid": "426e55c1-ada8-4dab-97c8-b13df4f15202", "value": 44800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849817, "uuid": "f57c5ea2-f5e0-4a69-bff7-f9fd2e7bbdea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849817, "uuid": "b1088344-ea0e-41c4-9c26-f857855c5722", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6c4c32-6c01-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781889015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781889015, "uuid": "08cfa72d-f1d9-4793-81b2-9700f34cbd07", "comment": "Malware payload", "value": "95b857cc3c3b8f196c8ba5a6d6596d64", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781889015, "uuid": "cddb2c20-85cb-43d4-b16c-d9d9c037fe12", "comment": "Malware payload", "value": "bfa3f019c9caee8ac62abe1d68d8f8d1826ad79408df3821d90989497181da35", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781889015, "uuid": "05b4fd10-2117-4879-8a4b-c36eaa10d777", "comment": "Malware payload", "value": "15cdc8dc1788584de2c1f151d5644b454ca0005d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781889015, "uuid": "e2408805-fcaf-4966-a3d9-1af25605c182", "comment": "Malware payload", "value": "5952dcb0d87e636b70b296a40dca4867a37c559b972a85a3e03b794949a51c844462c9dd7aaf99e110df0c59c8a5d142", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781889015, "uuid": "da2624ad-92d6-4a0f-8117-e63a04674e0b", "value": "T1FE069D03EDD249F9D45AA33089B74186BB35BC041B3223D72EA4B7782E727D46D36B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781889015, "uuid": "ca8c2964-0b82-4f38-a605-100f015b0ad3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781889015, "uuid": "56bf5987-6251-4d99-b261-072e30cebc84", "value": "49152:TtuwYPs0xwrIuOpugKckm1/3sMZPjwBbkT2Pq6IGXzNI4FoZlbwhjXC/tRDkDJFZ:TSvIRA/8xjtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781889015, "uuid": "5582d8a9-249c-4e4b-a48a-40bc40cdf27a", "value": 3682696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781889015, "uuid": "9ca519b0-c6ee-4f90-adf6-450ac80fd0a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781889015, "uuid": "7020958d-c028-4097-8e99-edb9be1722e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6382fb99-6bdb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781872543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872543, "uuid": "d2fc8a18-160d-4241-875a-ab7f3b070fb6", "comment": "Malware payload (AgentTesla)", "value": "2a94d33ed5e5084e149b12e91c31d1af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872543, "uuid": "f41aae12-d097-49c2-8a36-a1a0685f2432", "comment": "Malware payload (AgentTesla)", "value": "bfbb0a7e74db621c6e76fa399b664338394b84796d152a4115045eb80aa9b706", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872543, "uuid": "3ab5f383-a88d-4b10-8431-538a2cda94ac", "comment": "Malware payload (AgentTesla)", "value": "430fbe70ec6a641c5646e25430221433e5073281", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872543, "uuid": "499876c0-d054-4e92-a842-74042603865f", "comment": "Malware payload (AgentTesla)", "value": "199ca80e13a53cbc91ae14c0e9e85f0d760dbdbd1be705a0505af126ae1e228d74b06870b37632584254a45a060f678f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872543, "uuid": "b59e63b2-f4fd-456a-a028-95462cd45894", "value": "T1400607905B61A13BA559C7ADA037CF70980F204356E9CF48301ED218BE59E8F6399EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872543, "uuid": "2ae8a57c-656a-4de1-95f7-778f49099a39", "value": "98304:/qdLu41EPHBi7bFr3yIMIgDvkzbdvLK3eCi:0S4wuVyIMZDvmGuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781872543, "uuid": "aaaff960-219f-4848-9347-e9a74ffc6cb6", "value": 3779760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781872543, "uuid": "f8dca740-8755-4d39-b70c-ba3b187750ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872543, "uuid": "f1d46210-c400-4546-a43d-b18459c82dad", "value": "PAYMENT - INVOICE .NO. QFB-18-06 - 2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bdd969-6c01-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781889025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781889025, "uuid": "238d462a-01c9-4cdf-a7e4-1d3ab0b1f5e2", "comment": "Malware payload", "value": "e1501366637b059110ba4ea7df10b4e8", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781889025, "uuid": "49b40658-9c21-4d34-a8cc-c35ded9409d7", "comment": "Malware payload", "value": "c0b80247df5cf4516e9ce54455426681d020a80c54abc25a9d46edb6ff6dcb93", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781889025, "uuid": "bdb4dbfe-f9fd-4b2d-823d-2238ec9d6c20", "comment": "Malware payload", "value": "c6e911abd79fd4ee080e61b5564a1db16daa40b4", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781889025, "uuid": "df55eebd-8286-46e0-ae7c-8d724ca8061d", "comment": "Malware payload", "value": "2be5630700d96365e0c15d7aa0c7c5f98c73978899d21d81eef9cd7784b11e98972b72b0d9f13d0306ac20d5229eb9b5", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781889025, "uuid": "b1bd47e5-4a9f-426f-8e06-6bd25b7f74a8", "value": "T1F7F52223BF54D556D10A2E7A9974C3F52320FD84EE6A874734C2AE1BBCDA6D35D022C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781889025, "uuid": "30a1bde1-8db8-4600-b993-02893db9b835", "value": "fd58a0a623207f17310b91d0844de66f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781889025, "uuid": "ec83b9ac-8307-4b67-9dfe-754cddb9d88a", "value": "98304:KWmBL6rI84pgNcdwzn9/3TnTorwJLGtx5:V0L6rgct37TKALe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781889025, "uuid": "68bc9830-e460-4ed4-88f5-6a05b554854f", "value": 3543632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781889025, "uuid": "16269b33-7804-4db1-aa4a-ebf45e3b6cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781889025, "uuid": "5c46cc8c-8bfd-4375-8a55-f2b7b5769207", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0618fa-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850120, "uuid": "af8e4b85-b218-4a49-aaba-6e21b6b8a996", "comment": "Malware payload (Mirai)", "value": "a3e6c612fe124c9603299abc2b859597", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850120, "uuid": "fd9f6783-9b8c-49e3-9be5-49dbce45d389", "comment": "Malware payload (Mirai)", "value": "c2633cdc3e20fa2abbef1d5f7b8c6040ea06f7b014ad2f5bf4ac028da6af3593", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850120, "uuid": "573c64e3-4b25-45c5-981c-2dde5f58c2ea", "comment": "Malware payload (Mirai)", "value": "fb7f233977d83973c63b145edb6e0aa4f665fba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850120, "uuid": "f7c39066-1304-430c-85a7-d17415353ee6", "comment": "Malware payload (Mirai)", "value": "86030b9201770aa582e1ad74ff3c9d16e1326705acf63d45ac408e5cd69b33b85e144a4d05c20bdd2c3c16b2b924ae36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850120, "uuid": "6623e39a-6e4b-43ec-9439-c445bd06f9d1", "value": "T186633A81B9815A53C6D112BBFB6E01CE372613A8E3EF72078D266F21378781B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850120, "uuid": "f6ea94ef-65c7-45b7-a3e9-1fff87ce3c38", "value": "1536:g1NnhydU0LklPV8jst+Zo82Op3GlO9NUVyZvXo:g1N0Ybt+yHc74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850120, "uuid": "c6677495-3e1c-4321-9bf6-1531dcc0ac59", "value": 73348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850120, "uuid": "b2e47e78-6d39-4cda-a677-8c9509abb72f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850120, "uuid": "5e1e0efd-a9ee-45c8-849d-9da27983d2fe", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d72042-6b8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781840152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840152, "uuid": "a7b07b25-eca0-4222-9298-249ff8031752", "comment": "Malware payload (Mirai)", "value": "5b77587bbb8d7e2631372affd34af6ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840152, "uuid": "27b7cf68-357f-4c32-bbed-907d6f4fd712", "comment": "Malware payload (Mirai)", "value": "c29585b234c1fe56725558319d151ba9d2536603ef05fccae8a5a788c26408a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840152, "uuid": "35e1984d-c2dc-4f59-b282-0c6056e6ef0e", "comment": "Malware payload (Mirai)", "value": "2925817516a5643ce04adce041be1e3eb03538d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781840152, "uuid": "e7e68188-5f6b-4a3f-af3a-6c55a3fecd66", "comment": "Malware payload (Mirai)", "value": "0bd227b6a7e02c6bc3ad895b5551a37d26366946c130aa88432a7963ae7f05547cae44145832a60b43f3f50c165d2138", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840152, "uuid": "604c8e4e-baed-4c01-ae32-d80f2b923165", "value": "T1A854F80AAB610FFBE8AFCD3742E90B01258D645B22A87F357674DA18F54E64F06D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840152, "uuid": "367a8d61-7f5b-4095-88be-491c12feeba9", "value": "3072:ZOP4VBPepjkQuZsDGbJ/7TH5inDqMlO7DOoPLKNv6ADjtAJIS63WPl:9rdLSDkJ/35iHOf/PLEHJAJIS6ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781840152, "uuid": "daa92615-a56d-4bd0-bfb6-8f446dc3c80f", "value": 283448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781840152, "uuid": "c9bc9058-9600-4ded-85f3-0666af2411ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781840152, "uuid": "bccb9120-411b-489d-a949-badc3efb2696", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3e4285-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "3c8a3d4d-15b1-4ea7-8f4f-f171b60352c5", "comment": "Malware payload (Mirai)", "value": "35045a325b4eb79ec1065ec35e912090", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "e57e67cf-58cd-4d2b-94de-2ec57dcdb160", "comment": "Malware payload (Mirai)", "value": "c313e708d64bca8bd38f40267305ffba0a0cdd0a5a03b76caaf469c673bcce97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "f74c0251-a529-4ca6-95ab-145ed974743e", "comment": "Malware payload (Mirai)", "value": "6c1979fb53cbc5612b21e774aa639f646f2a4bf6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875910, "uuid": "29807bbb-18ae-4374-af03-c621c946e68f", "comment": "Malware payload (Mirai)", "value": "31d221eb9dc2eb2c869cd5e78b06244dc25914e7ad00f93b74a4ad68e4c1e767757dc74534525d22c10f0e4fc7807b90", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875910, "uuid": "c390d08c-c09a-48d5-b3a5-1280ba436801", "value": "T1E603F17647051827E79690BA07D80BB01CF20AC3F63356D1AE65E6B14E38DA87DEBCC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875910, "uuid": "3a7110ed-52f2-43cd-91c6-7c4ef3ef3ba5", "value": "768:jzKDu0UjZzlu1LMr0f1q16Bja8f42rCEhfA6kHzXsv8891eOjpJgGlzDpbuR1JY:XKDel5uJXgkzAiRhY6acU89PbVJuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875910, "uuid": "f50ddb39-2680-4faf-b477-ac22d82d262f", "value": 38756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875910, "uuid": "a6081743-97ec-44c2-bdcd-87fa16f4ae08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875910, "uuid": "4c0854ed-b54e-43b7-9909-05bdce614756", "value": "uoicjoyug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c676547-6ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849446, "uuid": "bfc602f6-e82c-47a4-8952-6955ec8a3556", "comment": "Malware payload (Mirai)", "value": "adee881af04aa0413d6eb6a2be3af29a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849446, "uuid": "c931a32f-0b2c-44bb-82d8-99b7e7c1b647", "comment": "Malware payload (Mirai)", "value": "c53349de2a26fe73d2efe8d26dc75140cec2f16b3d5e6861314c86c37d82a18d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849446, "uuid": "0d0b0197-fb64-4587-9f62-58cf31dd63a1", "comment": "Malware payload (Mirai)", "value": "26f8d2ed6fe59c3d04157369b6391d3a7ddae948", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849446, "uuid": "f2063f68-022b-4c0a-a1f2-6383fca76a92", "comment": "Malware payload (Mirai)", "value": "9383cfb36b1149e508c612370d61dfcff5cedae3919f5b3f5062bdd3e19c03751221a75d06d10bc37a23da6574b26e7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849446, "uuid": "fb24f623-006e-4f48-b52b-a3071701fa09", "value": "T14E933B45FC919A12C6C5137BFB2E228E372663A4D2DE3203DE296F21338659B0D77751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849446, "uuid": "0bb9999d-faed-4836-b8cb-9bc055dc561f", "value": "1536:zXVEE9kDcQgEE34lryMEejAXkPcPYuF4Wt8gPUpi3d1pvlL:zXVEEmcL4IME/PPYuFixclL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849446, "uuid": "99c91dcf-82aa-4f21-a5f4-c2976aa1ebac", "value": 92176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849446, "uuid": "0c2240b2-3db9-47e7-9e87-e421ce1a83f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849446, "uuid": "f3f215e1-b036-47a6-81c7-bb4fdd7c8609", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc33c43-6ba6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849634, "uuid": "b19c3357-e83e-4af6-8053-89f16f3253f3", "comment": "Malware payload (Mirai)", "value": "d5f91fc95e3790abfe3d85ca6b4d114a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849634, "uuid": "71537b1e-c4c9-4332-bb9f-c4a4f7c1ac2c", "comment": "Malware payload (Mirai)", "value": "c544eee59638d1d3441f2626e2023dfc92c7c44ed88bdb08bef0ea097eb8728f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849634, "uuid": "0e5ef828-1b7c-49c5-9d69-989c4a859134", "comment": "Malware payload (Mirai)", "value": "056b22f02fec7732f0da6b9429ad71469fe35334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849634, "uuid": "993d8edc-afe7-47f9-8fa7-a9edae092fea", "comment": "Malware payload (Mirai)", "value": "7cd65e809d25f4d631e9f40f2808f1e48bcffaaefda68ccc124cb35c8d0ea84d4d3f498e0a3a98b80b1c7d8bd6c70126", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849634, "uuid": "cf9c697f-9896-47cb-bdf0-0b6f9a44f720", "value": "T11B03F16BC2695E90DA2DD3309EEAF11E7831F6298336C21078D034669CBD9D1353D7D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849634, "uuid": "87aca925-512d-4a2d-a1e0-abe323b4f456", "value": "768:kKHoLnvmog+t5H9079Q98Vr3dLGecSIwSnbcuyD7UHQRjO:GnvmopN07a7eJIwSnouy8Hyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849634, "uuid": "83e8513e-d126-4c0e-9bde-dfbb5bc418a8", "value": 39676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849634, "uuid": "b8691732-dcbd-4a83-bb51-225bf0a821ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849634, "uuid": "8f32f029-5ca9-4117-a27f-bfe8d53dfc48", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fa4b49-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913054, "uuid": "241f0039-dc4b-46ba-a3a6-2ca16e75824f", "comment": "Malware payload (Mirai)", "value": "6a288dce71e9b37d9be08cb9b021eef2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913054, "uuid": "baec48a7-4548-444b-8a4f-f4c3532c3979", "comment": "Malware payload (Mirai)", "value": "c61a5815b66f13b0683d380961f3f9fce3dff83a5776aa3eb9b6d778842651d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913054, "uuid": "8e4f0cf0-9de5-4497-9c9d-1d39c433facf", "comment": "Malware payload (Mirai)", "value": "92c280c616f538de51c820f8313be00c1ba7558e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913054, "uuid": "915e1d16-efa5-4386-a623-f78cc50d5405", "comment": "Malware payload (Mirai)", "value": "b68fc4c150acd7b3fc26376339071010731b1fb2a300bfede614edd0e7c7560a382a106ab82244c2079994aa58f58f31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913054, "uuid": "05472a10-a4f5-4d63-a586-3ea467640c1e", "value": "T169E47D9DFE4E3C42E2D7E2789A4987E1721B71E0D32391A37982430CD5C69D9CBB1A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913054, "uuid": "c41ae992-f612-4fff-a6f8-c719c4bfb755", "value": "12288:Meu5lt4XEigMx+A/MXBqQcCwyzpWbAfObdBG4yeI4IcBmw5DOK1/V:lu5UXEiJaBqQcC5zpWldh0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913054, "uuid": "ca14b58d-1f58-4934-bddb-10091c19a770", "value": 680624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913054, "uuid": "92583079-99a1-44e5-b48e-3e5fae0de31b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913054, "uuid": "496c5108-a077-42be-80b9-f69eb903d5d8", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e5a053-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781875975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875975, "uuid": "d7c7650c-4328-4e32-91b4-062562248cbf", "comment": "Malware payload", "value": "4df2be13908d4b0c5e0d2881747cc357", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875975, "uuid": "854cd942-1392-4f61-9c8a-43e246490f82", "comment": "Malware payload", "value": "c7e7fff9cb09288720d717c9bd989ac56961c08aeddc718f4772eacdbf66f206", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875975, "uuid": "584af018-c393-45fa-8d02-4c5e59c47315", "comment": "Malware payload", "value": "3f9d91c330dfee55af3ed114b079090bdd2aaf4c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875975, "uuid": "5a5090c2-732a-4c42-bc31-d2b9e499b9ba", "comment": "Malware payload", "value": "fb8546a4f4cff883c544b96248fd6087360bd3ad632cc06b41a21c02ae2245f97dc75b8d4cfb412c9baac347bb3a2ce0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875975, "uuid": "3ea7377a-3c0c-491b-9b74-a05eea2159f3", "value": "T113F73330723579D9EA2FA37FA0A91FC5807074E0B31BD56B63787FB59A9124660F2843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875975, "uuid": "2c977f2e-4eb3-4273-af54-b2c462714889", "value": "1572864:+fcdZNGFihaO0CKyjvaabkmbOv0ZOafxWnhPlpp54VYt7qJhPYFmMZ:NGFzOXomCAOaGVlppFt+JFpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875975, "uuid": "a362e5db-1ab2-4105-bf56-1a7398d81458", "value": 72094720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875975, "uuid": "d4db62ef-c74b-48fb-b9be-2a558b4c6a0b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875975, "uuid": "9570258b-a5be-4459-835f-3811d9a8c7ee", "value": "huorongSteups-win10-11_6.18_nusvw.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cf728e-6c0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781892646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892646, "uuid": "3e550c1b-9823-47d4-a130-ead8af659dd6", "comment": "Malware payload", "value": "e8fd3e778e32b7dbcca44128cd15744c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892646, "uuid": "3093dd32-7d4b-4cbb-94f5-c682a8cba14e", "comment": "Malware payload", "value": "c8844ac426e19246c8a73b9952deda131b6bb452fafe4dbb984a8895914a9046", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892646, "uuid": "e5292fd3-828f-4d18-a1cc-97d861d15020", "comment": "Malware payload", "value": "0af4e92937c9f1a8376a56e2445d76e5156e8eb7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892646, "uuid": "1a9fc115-1835-49e0-80de-881985bcd1a9", "comment": "Malware payload", "value": "818e2d69d689bb6d614128b05e3fd9479411e56d1f14ac71032291c7736ebf9221ac1566b4d9f31866995ab070d6d1f6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781892646, "uuid": "bc00ebdf-101d-4ea5-bcef-b287026b17be", "value": "T178A194727F916B303A99C11C8A9ED252766B38BB36103868705D31907BEC71E51B2F74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781892646, "uuid": "01bc7732-8a70-4309-99df-dd3b67a66c12", "value": "96:IzLiPYa3jvvc9TbHlLYYLOwJmwvwSmt7rzzw:I3iBT3+TbFBywQwYSYnzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781892646, "uuid": "5db56ac7-b6db-49ae-a473-980a12d5849f", "value": 4863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781892646, "uuid": "d0c9e9e4-9f23-4f7f-95a3-3718adffed05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781892646, "uuid": "c5214a02-1b43-4791-a2ff-3505735e1a28", "value": "watchsoftware.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373c7720-6b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781832955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781832955, "uuid": "c9012e60-d26e-4a16-a4f1-9c33527cfcb9", "comment": "Malware payload (Prometei)", "value": "aafc3a2dce80f8e6320f04b4f3e2599e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781832955, "uuid": "93447e3b-a567-4edc-a9d4-f132558f013f", "comment": "Malware payload (Prometei)", "value": "c949ac977d557d58529d098862ae8a257474f2600b4afedac0c8b5b543d07035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781832955, "uuid": "8f53332a-ae9a-43a1-b6f6-aaf969f1d297", "comment": "Malware payload (Prometei)", "value": "35532250177c30fb6ce7caba19718c446a983a14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781832955, "uuid": "71cba669-381f-4576-b308-b902d4361df0", "comment": "Malware payload (Prometei)", "value": "131805ac93e094ff4ed4d77fed8f0ac63b95f71afc6d383cc519dd788aa3374dfdee96a2c4f1e04bff69e30aca32394e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781832955, "uuid": "9e1cc291-3223-4834-82ad-bb459bb06ec2", "value": "T1C2565B73905514D4D2AED974C6152213BEE8388B673863DBBBC076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781832955, "uuid": "fbd7e19b-cacd-4c30-a204-d9dda4d94137", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQL:cqYUQuVDt0TZEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781832955, "uuid": "43209737-ee00-4967-9b2b-ba4f8c046890", "value": 6422528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781832955, "uuid": "bbe92180-75f7-4bfe-ba22-6143f06c5506", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781832955, "uuid": "ca355ef3-6dc4-4f09-a856-c1ac3b9cd73b", "value": "c949ac977d557d58529d098862ae8a257474f2600b4afedac0c8b5b543d07035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9495491f-6bfe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781887658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887658, "uuid": "168b69fe-43a9-42da-952b-ae346721f56d", "comment": "Malware payload", "value": "3268072194bac5900af0ef321afd0ee9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887658, "uuid": "e42541f8-e644-4391-b360-625d8b42028a", "comment": "Malware payload", "value": "cac977b50d2505405e729e623025a03b60a58e92b0b75c272242592139985ddb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887658, "uuid": "8e04479c-5fc9-4072-939c-9f85e7763b43", "comment": "Malware payload", "value": "ab916a12c7cc793a942f709d13b9f9e7be2012b1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887658, "uuid": "c6c65e5c-a60f-416d-9cec-ddc4e2a22fa3", "comment": "Malware payload", "value": "1a685f394fa967ba3cccb82a0b01df526d0e4b6b588ebd63f96194680ce9720b0e96b41d2c2fb170c79b2c15f16fd40a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887658, "uuid": "902c11a3-b241-4b32-b0c6-1db0751a62e4", "value": "T1A9825B0FB8424726D0E210749276877BDABDA872338414DBFBD489E90A686D6FC3311F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887658, "uuid": "745e3215-d649-4359-96f1-76f3b6db15dc", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887658, "uuid": "1f7ab4c5-adbe-43d7-9330-7fc84a8889d3", "value": "384:0IqQ1VaFPte/SZCvBu9JgwHcev4av8U9c6F:CYUIE9r4a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781887658, "uuid": "4f35eedc-d4f1-41d7-b300-20de98a8ac88", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781887658, "uuid": "530a8033-1766-40b7-9f15-c313c351e01c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887658, "uuid": "98d2079e-7133-457f-8b49-55bd5afb6df6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b70425c-6b9f-11f1-a769-42010a9c0008", "comment": "Malware payload (XTinyLoader)", "timestamp": 1781846626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846626, "uuid": "b8251145-4877-46cc-b060-bb34c3b47b18", "comment": "Malware payload (XTinyLoader)", "value": "234ce8b2531070f273ececb213be9366", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846626, "uuid": "4d2ac9c1-f7f5-4247-b674-4edce34bc8fa", "comment": "Malware payload (XTinyLoader)", "value": "cc11ed29c8244abc04aa05618154317c550f90a519809849b7cba0aa8badc7c8", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846626, "uuid": "01284b1e-7e98-476e-932b-f78ab6622b22", "comment": "Malware payload (XTinyLoader)", "value": "d626aa5c9870c9281c613d4b064a5a84585958c9", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781846626, "uuid": "3c414846-6bf0-47fe-9bf7-3617c5e43513", "comment": "Malware payload (XTinyLoader)", "value": "c065efb8bd2b873dcb1db8fd588862bdc30ccfbe6c877d619f21db38453dea6ebadb49d17d77617a533199616c897389", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781846626, "uuid": "0f90545d-d048-4e1c-b75c-81e7318a0f63", "value": "T10E34CF5BB3A034F9D5768278C8145A06E776B8350771DBAF03A043A67F232D19D3EBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781846626, "uuid": "588b89e1-788f-4aaf-aac0-975735f0e326", "value": "3026ee54c6af015fafd94f2b564c4ba9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781846626, "uuid": "9dcfa611-5817-4ef5-a0bb-aabccb0aa989", "value": "6144:q0WoKA+vzDrCztDMcwW00M+wbv2dB+c/s/kO:hyzDrCwF+Gv2+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781846626, "uuid": "407c5327-97dd-49de-affc-9cc8940018e8", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781846626, "uuid": "603bec85-2513-47e2-8d27-3fafdba0fb08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781846626, "uuid": "9bfd5015-2ec0-482d-bcea-bd05f2f6384e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2dce48a-6ba4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781849054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849054, "uuid": "a446c2b8-02d0-45d2-8ca7-671ae10d76df", "comment": "Malware payload", "value": "1d542748517c0582a77d7ecde3fe9103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849054, "uuid": "e2fc4d5b-e605-4c5d-b412-ec944293b678", "comment": "Malware payload", "value": "cc9c0ac45fa90d174b9955f081fc2912c98d77376e3697d9c75986efc79cbe4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849054, "uuid": "6ed687ca-bd20-47e7-a375-93dac27c4028", "comment": "Malware payload", "value": "1a8038c1d5d9681eac82e8dd55b1c9e0dbcf61d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849054, "uuid": "735485b4-138f-41f7-b4f0-a46e110b9d1f", "comment": "Malware payload", "value": "cadcf6f19f8b024d57587388fc625af08feeea3d1684611669a679197ac0c5064499ca0731477530f34e679e71775cca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849054, "uuid": "2d2cda8f-06b3-4cdd-8380-cce47ba4aa23", "value": "T17A7533FB6011199AD79E4C7D6F270FABDF345C07E423590AC096AB368F4AE3E586048D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849054, "uuid": "3e4b8d9a-2d25-42ca-8f46-66e09dc98aac", "value": "24576:aqtmh5a1v+vjMDiIqAdsBjYw8xTrq7eug3456dughVk7qCHbxp1CZMRjrhVMLBwh:SG+vjwdq+suw8xSSI5aRT9Mbd9XhVMLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849054, "uuid": "55ac73df-58c5-4836-813d-96a8fe31aa05", "value": 1559260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849054, "uuid": "a8da8c34-02a2-417a-99fb-d323a70035a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849054, "uuid": "4280af35-3f5f-458d-bb68-299c560c1a6d", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb68fe0-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886839, "uuid": "8736396c-dbb8-4f69-b03f-8c012dea876d", "comment": "Malware payload (Mirai)", "value": "181b76b2005df42ec2e51881a1d94c1c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886839, "uuid": "844bdb7e-59fd-4e1e-8d7e-bee92fd183cd", "comment": "Malware payload (Mirai)", "value": "ccb09f957b809bf771d13657ac6dcec0ff7bb74f446c32ee339a2b88101636d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886839, "uuid": "70e0cd96-5abc-4663-917d-24ac05fccc70", "comment": "Malware payload (Mirai)", "value": "3feb00504e6f537e121a5edef351ef0a2dcb2cad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886839, "uuid": "1ea39a19-b9d2-40f5-a57c-383a0362bd5a", "comment": "Malware payload (Mirai)", "value": "e949f29c311c978b44c978922d2e3c7a9d6a879a13f5192e75281ffb054dc0e21f5934f1f96a000030adbf06d53a3c27", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886839, "uuid": "0f75be54-fb6c-4aba-9ece-ca5a21b79a32", "value": "T180143AD7F900DDBAF80AE7378993080AB130B7A104826B776217356BED7A1D91477F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886839, "uuid": "90c19221-4199-45aa-850a-2e3ef2c048f8", "value": "3072:sXQwPbvFXJ76+MGoi2BgXLIcHoy4HgGapq2D4ZIu6XwC9yVjjbitL5Evjah+a:/et4QXEVy4AGapqq46gC9nLyjm+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886839, "uuid": "4674cdd0-c175-48a1-a5c8-a5e19471bf5d", "value": 195996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886839, "uuid": "925811a3-850d-4783-923f-11caa49615a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886839, "uuid": "77fb2b7d-bf52-49cd-a4ac-f2cbf8b8c786", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc64ea30-6baf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781853821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853821, "uuid": "66927308-9ca1-48cc-9dc8-a40b4718228d", "comment": "Malware payload (Mirai)", "value": "bf23636cd05fc2e0cd12f0233cf0bfff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853821, "uuid": "502e3001-0ee2-4ff2-97e9-6e89ded5164d", "comment": "Malware payload (Mirai)", "value": "cdd5ced09559efecbd64575a1b7386fbe7c213b0c722ec66ca764575f578385c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853821, "uuid": "73e4691a-4603-4596-9703-e8cf77a9b84c", "comment": "Malware payload (Mirai)", "value": "0979d7fe1e42d065f3c3bf7dc6347df174729157", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853821, "uuid": "50e8a691-581f-4998-adb6-b863f7dfbfe1", "comment": "Malware payload (Mirai)", "value": "c921914bc58f2958964a3f2c53c597753c2cbe3fd86f7b7c97a249281ca1b2cafd9f5bbc82efae5254e9d69943ec7b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853821, "uuid": "ae6194e3-41d1-417d-8b4e-5800d3890a77", "value": "T1567423CD4C5BE59E9E68669D0F527E3BFCA08A364E29CCC8B385B27021D057987748C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853821, "uuid": "d85d7dd7-2735-4186-8fb2-b3d686ea5814", "value": "6144:yK7WqlxpWfLLuNXwX/hDAdLqmFEpv5eoUlr2XYQvZGwac3xwZBPXSsC/:FWqx6kG/2d5WPwr2XbvZB4VS//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853821, "uuid": "32481b04-8ffa-4fcc-b552-90414a236a8a", "value": 340496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853821, "uuid": "f5e69eeb-cb49-40c1-a582-447ae359f289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853821, "uuid": "dd49cef6-a2e3-4b3b-9fad-900f56623148", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b69ace-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882798, "uuid": "27a8fd37-ce02-4bae-b818-1214680ced98", "comment": "Malware payload (Mirai)", "value": "127ec4db7f6cd9df235d811f1fc031c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882798, "uuid": "18e2db53-9f44-4623-8d1f-8f73612025d5", "comment": "Malware payload (Mirai)", "value": "cf6405ea05d64b6fc24ea2b19a160b9584779c655f9fe0fd2bd96fd85cad3c61", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882798, "uuid": "a2686d9c-e374-4379-8153-041b7daab7e9", "comment": "Malware payload (Mirai)", "value": "d2e3ddca60cfcb6dfb6507f5101e2afd35be3b61", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882798, "uuid": "4bc1a770-5465-4c1f-ad53-84798a0f71b6", "comment": "Malware payload (Mirai)", "value": "f40b0a216d45b68db75780f22909d6cb142a600b73ae903fe61602affaee27b6402c4b9b29ffb1a3074366a6b6347142", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882798, "uuid": "ba0a04ba-6269-4fdf-b89f-ecbfbcc1e25d", "value": "T111C33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882798, "uuid": "7d29f337-1a06-4913-aad5-6b30558e68b1", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPTO:LzhWutxBaORaebXQd+mzBzlkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882798, "uuid": "15eca3bb-e35d-4cc9-98dc-4419c3641bdd", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882798, "uuid": "31160c8c-b8d8-4cf2-8902-5a5cda5c7bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882798, "uuid": "9347ba02-f86f-4393-81ef-49ff856b1091", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1939e0-6bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781852155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852155, "uuid": "4a8fbb43-2b0d-4503-8776-a1a442b64d5a", "comment": "Malware payload (Mirai)", "value": "d94153db9f4d3625463b58a8dc552307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852155, "uuid": "d7e7229a-69a0-4dfe-9161-95cd398055a4", "comment": "Malware payload (Mirai)", "value": "cfb3098418d2a062b57be1b6d4b4a1f6975530eceb211ba9bef97c0a0a80e964", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852155, "uuid": "537dffbf-859c-48d4-aea2-955e70339480", "comment": "Malware payload (Mirai)", "value": "d50c83f937d8c2a92a698ef99b1e845975343873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852155, "uuid": "31abab05-ab12-46f5-8ce7-ce01e5063109", "comment": "Malware payload (Mirai)", "value": "992cfb2598f38073a584b364948fcc269d765941674952dc9050dfc0a499a5f90fd1b4e94b030dd59e445b9b9bf5202a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852155, "uuid": "54f0f241-c16d-4d88-8aa3-9dd477c909b3", "value": "T19841CA0FEF80AD9AC8284E34018F85433243D1E505C5DB1F566AC59BBE9F78C8D63998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852155, "uuid": "aa56d4ea-51c3-4dfc-9463-55c66075a034", "value": "48:0T2JiLT9acN6sXPhvPZ0PvsiG7l9Iu2p6tsGJ:M9gM6s5JgvsiG70s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781852155, "uuid": "ea6555cb-b9e4-4713-81ea-24115ccfebeb", "value": 2388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781852155, "uuid": "dbfee101-9ea6-4de5-97a7-5f71fe5a64f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852155, "uuid": "2a688fa6-b528-4e2c-a763-a84578469d4d", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5436232c-6bbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781860062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860062, "uuid": "5cb6bee1-defd-4b73-b046-58f45ff6c57d", "comment": "Malware payload", "value": "d1c252bae167b121c7ecdfa9802bc8c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860062, "uuid": "6074f40e-89de-4df5-ba56-f6175b3c7846", "comment": "Malware payload", "value": "d0575c2b0434271395a70a2251900f46fcbcfdf039885b0bc2170f5e0dfd3911", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860062, "uuid": "3e453c11-a1d4-40d8-835a-c7c5c1fa1246", "comment": "Malware payload", "value": "10f3333c6175352372adfc51e37a14f79a7367ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781860062, "uuid": "8a6d5481-51ef-41ff-87c1-610cdc9e37d0", "comment": "Malware payload", "value": "d5c828ff6004cf3a6b32f0e851dd756dbf41b01fee37cee9b7e7d73312621aede1dca18f4d3649ca79855fac78f2c49b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860062, "uuid": "9836a5c3-fad8-49f4-a682-fe3ab8f5e539", "value": "T1CD73185AB9819E51D5D1117ABE1E534D33532BACE3DF7213FE042B6C3A8B56B0E2B006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860062, "uuid": "c85a9fc7-33b9-49e3-898c-87e237898b51", "value": "1536:4fncJr+H8XNoBag+Za/8w6qJQ4V5DfibnQEeqNk0e:f8c9QcZa/8w6qJUnQEeqNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781860062, "uuid": "9c6877fc-5e4a-4283-8515-e39de9d96d82", "value": 74936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781860062, "uuid": "2b81a0b9-35aa-4473-86f0-e2b9c648d4be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781860062, "uuid": "e9c2c093-3554-449d-bec3-ff706cf49ebc", "value": "TYiQ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3677b18d-6bdf-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781874186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781874186, "uuid": "f3e020d2-9188-4315-bf56-9cb09d19cbfe", "comment": "Malware payload (RemcosRAT)", "value": "c4da5cde63e5cf64635055c57f40d83b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781874186, "uuid": "a61292bf-4b0b-46b3-b955-ed3b5d4bf679", "comment": "Malware payload (RemcosRAT)", "value": "d113f72b9248e3a89d72d1238a8465af7857822b82951681cff22391ffff3039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781874186, "uuid": "5438ca0d-0a50-4962-a529-4d570828476b", "comment": "Malware payload (RemcosRAT)", "value": "a6b2d98e90ef3bebb68d190f9754cf950c91b5ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781874186, "uuid": "05256511-41a0-4cf7-b554-478527b29c78", "comment": "Malware payload (RemcosRAT)", "value": "1839813057765e4d9cc29956a2d156e0ac0dd36ea06d38c6eb8dc9ec4f41b0d9419b78abe7883295c84db180afc5de7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781874186, "uuid": "38a78f79-d281-4f9f-a787-b42c556aaf2b", "value": "T1F4C2BD369FFD5B5B76FA6F126E1E0890E90DB3081513891C368ED7C741CE6801263EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781874186, "uuid": "c575ce00-9191-4b4e-b06d-ef734fc92375", "value": "96:BTpoMrILqKgXyV2GTLfgXyc+BnOEpfp6NEXyErlckWISYOOcNjf/aWES0VjfuSrX:RpWtTZF59uqetdt7axGLOHKPDiURqRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781874186, "uuid": "dfed5569-ab1f-4bc8-bc29-46954ba7ab64", "value": 27707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781874186, "uuid": "b9379feb-42e6-4404-80bf-067f492f0f04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781874186, "uuid": "54be5bd1-7cd6-43d7-84e6-9898e38d7d12", "value": "seriouslyworkingontheprojectforbestresults.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fc2395-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875988, "uuid": "d023e4cb-6118-42e2-8796-e11106a452ae", "comment": "Malware payload (Mirai)", "value": "5f85cc27cf89f4b50f2554cababf0c72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875988, "uuid": "092257da-4ac1-4070-84ea-3294a7e5676a", "comment": "Malware payload (Mirai)", "value": "d330b5c7fc9d6515d2685da7e5d7198598026fadee5b13e142a652737019932f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875988, "uuid": "a9dffd76-437e-478e-b8ce-3901295b87fd", "comment": "Malware payload (Mirai)", "value": "3faf45ecefa68cc29e2ffab76ef74dd95363d108", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875988, "uuid": "de1e4df7-8066-4270-9cb4-80eac30567d5", "comment": "Malware payload (Mirai)", "value": "8d5074ba5aa42159ba4360d0eec8cc59b684d0ea69b70729f1c1064c9532e9b747f7ad2084ba2028d068c62241b00283", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875988, "uuid": "bbfb12fc-8fdf-4802-afaa-98aee20211d2", "value": "T196735B0B7A8080FEC5EAD03953FEB232C93274BE537EB11617D1EE366D59DA00A5D921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875988, "uuid": "1a20dad9-a82e-4812-ac4e-2c74d294fef7", "value": "1536:PuEoy7J7KaXvvP68Lb0ILK/ErZMGvmvKSYnsfE7v5Xm:mA7J7x/K8LHsEr9vg5Ynsfw52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875988, "uuid": "38ce91ee-c1b8-48eb-b9d5-ef562038acfc", "value": 80272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875988, "uuid": "25170e8c-b6a4-46dd-b07c-0421198287aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875988, "uuid": "e582091c-92fe-47a1-841a-35e1c5eafc83", "value": "rubcopfkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f081c1a-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875998, "uuid": "f8da2ad8-2d23-4937-aad4-65d53bdf6b15", "comment": "Malware payload (Mirai)", "value": "4bd12161c1ae95d1ed197e88f2ae85e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875998, "uuid": "84f06a3c-5454-47da-848a-c2d790e87176", "comment": "Malware payload (Mirai)", "value": "d4a018af5b8f13f592098a226f53049b8df628167a9ba261c086431235b7f0af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875998, "uuid": "53e1f4ba-d0f4-478a-98bf-1ff11c2d24d3", "comment": "Malware payload (Mirai)", "value": "0013b1d093b248747fd151d4a4a653bbfce6706c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875998, "uuid": "fbdb2728-f11d-4127-9f27-f58f05cc8a35", "comment": "Malware payload (Mirai)", "value": "e076004711e40e5a731ae004b5999704aa733f13c3e5ef447c63e451bca559fa395f73d28dd908c522a243631d08dd0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875998, "uuid": "592c0249-e95b-4fa9-9b63-7c2d0c2a11f3", "value": "T10CB3C60D7F229F7DFAEC823497B38A24535933A227E2C689D1ACD6041E7024D651FBB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875998, "uuid": "0d7062d2-69c1-4542-8df5-571b27d16417", "value": "3072:NPE1AfoiuIlnpC2X+rcBRA78FN5Iueazf7cpbBArlXLjhgO1uZrhEq9vZBeNMXlA:NPE1AfoiuIlnpC2X+rcBRA78FN5Iueal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875998, "uuid": "07e04cad-2b95-4879-8b35-c8395a29a641", "value": 109212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875998, "uuid": "2e637f62-22fa-49ad-9cbd-06fbd41dad52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875998, "uuid": "7eb1e71f-24ff-49cf-b909-2a9721842788", "value": "uoicjoyug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d72d5d7-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781880989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880989, "uuid": "2cdc21fd-39ea-4645-8f57-eedf84b708e3", "comment": "Malware payload (Mirai)", "value": "eb9579122dc4f80be26ee5caee09142e", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880989, "uuid": "66a32c69-964e-4ea7-9c6f-7d4ad02f6379", "comment": "Malware payload (Mirai)", "value": "d4a7cbab265c80a26349ea916835206f31b169e367fd69ae0819ca7e59ab595d", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880989, "uuid": "a84ea628-dd61-4795-98b4-5e93e6aa3d11", "comment": "Malware payload (Mirai)", "value": "a62d55d7a39a302ac4948dcef99f010b556aa6e4", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880989, "uuid": "ecc9a9f7-9566-44bb-a576-b4fb32bfb2e3", "comment": "Malware payload (Mirai)", "value": "92974a141b930e728913272ab35c7e961b11a5e09f4fbf250b4114bf6933ca9a3d399f6c7dd1795ee0c0aaf1efe40aaf", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880989, "uuid": "29b39046-56f4-4c1a-ba6a-7d1d4e4f2b90", "value": "T1A583021D46B00321DD97DB72A851659A88BADE556E58CC96FB0DCDAC7FDB3030280F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880989, "uuid": "e589540f-8b4e-4e86-8483-0f3d481f7bd2", "value": "1536:FqvCSUdscVh+09bZil8eNnbZTQmbh29NSKVUsH0iJOILFokRLeb2neguB4nr+iSj:FqJwscVh+SZy7smINSmUHhBeL0g9iiaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880989, "uuid": "8af68ec1-d516-4d8d-9581-60188aae8b04", "value": 85676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880989, "uuid": "544a4b73-8f5f-4049-8571-c06a21ad4c78", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880989, "uuid": "a08eb99f-778b-41ce-ae8f-1684390c0ca8", "value": "monero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232429a0-6c09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781892192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892192, "uuid": "ec11bafd-4c30-4a97-9ef5-fdccb2506048", "comment": "Malware payload", "value": "176df146db2ee4a966769ee76c91e9a8", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892192, "uuid": "b57d4621-b22a-4659-907d-8f14ec8f0e95", "comment": "Malware payload", "value": "d4bf06a7ef1b1e029a68ffe1f36e06224c0162e322459a0ecf57702597410c9a", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892192, "uuid": "07ee2306-379b-44b2-8ee1-004927c963d3", "comment": "Malware payload", "value": "10cb81bf90d6685aafff395e8d757938e330b62c", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781892192, "uuid": "32f59485-c6f3-44d5-bf7f-e967556d488a", "comment": "Malware payload", "value": "2e5a928e59622978c6c1756f8626074c647fd562e717ed9d8e00db2eedb0a74bf78af682a33a25cd3704f59dabf6818d", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781892192, "uuid": "176ce11c-6644-40f0-aeae-8283d22a39fb", "value": "T155847AB9921290B8DA3285748B844B61B5F0379D8BF5A9F340C78B30150A7D6E7F7E36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781892192, "uuid": "3e2ec30f-9b03-478d-b96c-3cec9ab31e76", "value": "6144:TjVGk1LcZBN/iQ6bdsVxexaC4ozhIygTzB71rZsfIBlM8HliEtuI+aWijSJtG+D0:N2PqQ63x0sSrZsfb8HlztuIyW+D0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781892192, "uuid": "757c85ba-fdbb-44e1-a8dc-53700495d422", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781892192, "uuid": "2d769069-ffc6-4d99-81c8-709f89be646f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781892192, "uuid": "f92046f8-648f-45b4-9f8a-6a2c1e752427", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a66295-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886239, "uuid": "e4115ff3-3c36-4838-b358-da35cff222e1", "comment": "Malware payload (Mirai)", "value": "4e5b1413722f834610654c58f978f371", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886239, "uuid": "bb9e04a6-d15a-47b8-b19b-9b07b4ef3990", "comment": "Malware payload (Mirai)", "value": "d55718329886378ba7dcf01820a986360e287e6bbadcbe2c1ed15b91da920ea4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886239, "uuid": "bc71f16a-b6d1-462f-b341-c2b214f042c7", "comment": "Malware payload (Mirai)", "value": "499eff358d487e1a2d3a74982c71f40a6910bd48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886239, "uuid": "6e00bd2e-bf37-4b34-a818-a53f3996232f", "comment": "Malware payload (Mirai)", "value": "1784ccbe7dbfda29fca63e2babfcd93e4e51a0faec0adace9bdd6dd82efbe8d1c707b889ce61d938182647ff2eab015d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886239, "uuid": "6a16e0c8-2c17-4632-bc7c-a8ba4efdc2fc", "value": "T13DC33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886239, "uuid": "d1619bc8-66a1-48cc-a056-0b4e2a433683", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPhO:LzhWutxBaORaebXQd+mzBzlkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886239, "uuid": "edfca1d8-3c7f-4ad5-943a-ffb573c98693", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886239, "uuid": "af3fbff7-614f-4f93-9973-a344a2c417d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886239, "uuid": "7e315e43-3dc5-4d8c-8de6-27e4363504e0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f079d04-6bdb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781872616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872616, "uuid": "e2c80de1-1b72-4632-80ff-70ba9c3c86c6", "comment": "Malware payload (AgentTesla)", "value": "85dea697633ca621ff7761dc3778ff2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872616, "uuid": "e3be89d3-6fd6-4079-9844-781713b0826f", "comment": "Malware payload (AgentTesla)", "value": "d6447792486b2abbbeedcef93e06d60091b1786623099a2533a3723d5debf7e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872616, "uuid": "60075d72-49be-4703-a643-e041ea2283ee", "comment": "Malware payload (AgentTesla)", "value": "0ecbd3e26dd7461fb771247e26b6accad692c51b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781872616, "uuid": "b467836b-45fe-480f-9b14-5239bb6215a3", "comment": "Malware payload (AgentTesla)", "value": "9cea922d405edf4e84f0b269551cc94ea4aae29edba9e222c6260405c703a8e75fbd3990950c68c4baa59718b536b7ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872616, "uuid": "30dd9d78-6327-481f-84bb-07cd254482d0", "value": "T13BF57C844664FB4AD4A8CB719C0F6FE98A2F9447EE20DC03371A96798B09FC637445B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872616, "uuid": "771f8701-898d-4f61-aeff-294e026fe143", "value": "98304:FPGwgPBbMJ+ohAlYOLoRBXnB4NrckeJkx4mBmwa:1X66JC4mBmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781872616, "uuid": "c627d976-4159-4983-a5f0-26ea319f2e9b", "value": 3321761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781872616, "uuid": "481210a1-3856-46f8-9924-c37ae0ea2af9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781872616, "uuid": "fa2aeeb5-9c46-4bc9-bc8a-bc1660d56382", "value": "Remittance Copy.2026-19-6.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d5ad25-6c23-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781903464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903464, "uuid": "9e5efbc2-68b0-459c-9a4a-e71ac11740fa", "comment": "Malware payload (Mirai)", "value": "beeff151dd7f68e882b73df538adaba1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903464, "uuid": "1073bf9b-7ccd-418e-8498-122e889b41bc", "comment": "Malware payload (Mirai)", "value": "d6fb71feb0d0e757f3b77e08529f741889764ebd07a2ea2c2b438f5d91c00efc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903464, "uuid": "3a4caf02-5165-41d6-bfcb-7828fcfe2053", "comment": "Malware payload (Mirai)", "value": "cedce2414d1cc4f9d732193a0f33f56fbf0b2714", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781903464, "uuid": "e5e03583-780c-43da-b19d-43b1c184b949", "comment": "Malware payload (Mirai)", "value": "21af39eec5dd51b8a145d17ab0922495159fab402c465a1a22ccb91b9907417d22df5474e56ba982025672a68a9de624", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903464, "uuid": "069a090d-385b-4608-8113-0010c3067465", "value": "T1EB149E63D8756EA8C254A870B4F0DF7C1713A51083871EBEA6A6CA74448BD8DF91D3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903464, "uuid": "0d8a0629-fe35-4870-a5d8-52096ae10fbb", "value": "3072:Th712XZlsR4Y66tx/m3cLfl/whdJfYBbqNkWSXGUfjyXU:l712rsg6H/mO9/wHZd9SNfjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781903464, "uuid": "aa9468db-51cf-4c2f-9313-1c3851ca2c0d", "value": 194948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781903464, "uuid": "4e65aa01-0f8c-4eaf-bba7-c265822e1e47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781903464, "uuid": "9ba4229f-88d8-42a4-822a-cc1275968d1d", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b775c057-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781913057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913057, "uuid": "8523ece1-9674-4e40-b433-052c24846f77", "comment": "Malware payload", "value": "7ae32ec2fe2c250b0e1ca7a82fafb771", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913057, "uuid": "7ed33802-2d20-4cbe-a6a3-5e6afac54839", "comment": "Malware payload", "value": "d7fb05d68b2d41d4cb94e8e0572ca85ddb3d25684472d940ba04edbf73134a15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913057, "uuid": "b8cb39f7-b32f-4aeb-8129-1d23197bc912", "comment": "Malware payload", "value": "95eda3c5757fb526a3e742c9d9030d68f4c64b57", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913057, "uuid": "1cd035e8-77d7-4bad-9352-57bbe8474462", "comment": "Malware payload", "value": "d55e71ebe522022774788d549dec740c8a72dca700c525c726a2c354696bc2b671a2e6e84ca70e3d2dd093cecd7c6816", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913057, "uuid": "415b64b3-5448-4ae2-8671-9e46d135d3db", "value": "T12D416A8D30DBEA365A45BE45B2518894F509F2C718DA2E04FF49CD30E8B6AA7342EF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913057, "uuid": "b13b4fe9-3df9-43ec-85af-0cf3abcccc0e", "value": "48:OWlI8AvL3aWDSRpK4+qzSd81swfzISRpKtb4U:t4SRc41RcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913057, "uuid": "94bb89a9-be2a-4250-9b7f-f94d7613fb09", "value": 1954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913057, "uuid": "c3147996-50e8-4a04-af36-67848169cf31", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913057, "uuid": "3867ac7e-7320-49c4-bd4e-da62e2af5e2a", "value": "womp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23647a9-6bc7-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781864139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864139, "uuid": "d30327d4-b48b-4bb6-9f98-09b4645c6cec", "comment": "Malware payload (CoinMiner)", "value": "3240359528e8c5a03d250345110d8bf1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864139, "uuid": "df608148-b9c0-4f6a-8f36-e3d8f5132881", "comment": "Malware payload (CoinMiner)", "value": "d89ac69f086cb3029a8eac0fed1310d46142b3891d2d6874f5ed0a742d887c4a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864139, "uuid": "d1aac678-5d3f-4f5c-a336-ce8014d57ca8", "comment": "Malware payload (CoinMiner)", "value": "8ff46393cba51e0a1ba6a5b97001f1e04874245d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781864139, "uuid": "e6446367-09e1-4b0e-bc07-e0dc9f2545df", "comment": "Malware payload (CoinMiner)", "value": "60974b2810c915e5a61db9bdd0c177abcdf698431b676d8130372b6aa212c5d17665dfd9627563b8f53fdd46bc49317d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864139, "uuid": "e6bdbfc7-92a3-42e6-a55a-dff3bf86f291", "value": "T18B32A11E2E4B0321DE5009B4E575424A513C2EE37387EBDBE633D2CB4AD6E4580C0AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864139, "uuid": "ffd75931-19a0-4fa8-91ab-317f5e254053", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864139, "uuid": "6a42b524-cad3-40d0-a35e-2a889dbb2daa", "value": "192:FojWAcS5BQcxSHO8S59uvtPFJxTEZmFhquc:Folocsu3fuvtPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781864139, "uuid": "3317b2d6-bc19-4a9b-954b-3fe82846c797", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781864139, "uuid": "1517254f-c196-419d-8d33-8fe31a512d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781864139, "uuid": "9ca3bcb1-1536-45ee-b19a-cafcdc84480b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388d585f-6be4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781876337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876337, "uuid": "e135b4f2-c3c0-40c1-a919-87483c3c67d0", "comment": "Malware payload (Mirai)", "value": "82e62c99b9fff2cc073f99fd77c4759b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876337, "uuid": "2ecf8a18-2ea8-44f2-97a7-7a29bddc6af4", "comment": "Malware payload (Mirai)", "value": "d9465d322a4bd5c90a2fa737fe29aeae2821079b154fd55d9717d8e3b924f91a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876337, "uuid": "db746026-d86d-41ca-918b-da8a26989ac3", "comment": "Malware payload (Mirai)", "value": "79bdf1ca2d956b9e1576993732b7979777d6ad10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781876337, "uuid": "1f572b9c-381f-417b-9ee8-1247004885af", "comment": "Malware payload (Mirai)", "value": "3816f1858c3eb5f481f17994d1a34a126165b4f384c66a0d2b289b872dc252145486ac643297c3257757a70230859d95", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876337, "uuid": "8003f840-0537-48e2-8525-a433a0dd99df", "value": "T1B3055B16F8409F72C5E12576FA5F8268731347B8C7EB720699184B383BD796F0B3A681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876337, "uuid": "63b20ece-6486-46f8-84d6-150b4c17fed1", "value": "12288:E2CD8VifNxbe2RTvsS0XVcHnHNbQZufKK/UB8iDSZloJpDGC/ARbbPiWBv01h5Fk:OD8q7be2+anH6s/8ERsmztBv035F+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781876337, "uuid": "912b62e3-d0a0-4b29-84f7-911910281b04", "value": 833016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781876337, "uuid": "6abd6e3a-9f35-483c-ad72-777959a3dd6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781876337, "uuid": "7699df9f-2717-45b2-a564-20f0d6dbf4cf", "value": "bot_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773b021e-6bbc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781859262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859262, "uuid": "f1144175-9176-41ce-8ee7-ff22b2525dd3", "comment": "Malware payload (Mirai)", "value": "745e2170cf7e055f99683cd3cae2ae1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859262, "uuid": "25dc3685-6e0a-4138-975a-6ce6e1e6f71b", "comment": "Malware payload (Mirai)", "value": "db0257a4f1b496c4b0c97ba9f534bf508c19011fc9fc517a4b320570755ec382", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859262, "uuid": "3150a94a-cf59-4f11-8fa0-091f2208dc24", "comment": "Malware payload (Mirai)", "value": "a33e8660dbf41c21c85b483b17178c6ffa51057c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859262, "uuid": "b4510c98-76e7-4742-91f0-fa1bb48dff4b", "comment": "Malware payload (Mirai)", "value": "6857b64da7dc58411575eab59bd4091dbaa2da7b94b0875f533635ddc1368912232a45b6bcc2ed90db1f479f07bafb26", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859262, "uuid": "743b3dee-e95f-42f2-84b8-d195a61c926b", "value": "T14F01AFD5814069104429CA5E62E75794B421C3CF45864F747F9CAE3DFBAC518B026F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859262, "uuid": "31845d77-7960-45c1-8abe-260c95044aca", "value": "24:kXCKysE2hi0ziQvZohaZrFfL+vgNLZM25PjDmA7:e9Qp+MsZRT+4NlM2PjH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781859262, "uuid": "0c1fd0b2-097c-4e27-a565-0f027d63181a", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781859262, "uuid": "bbca5fb5-e2ea-4ec1-b6bf-162e866aa48b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859262, "uuid": "6d76fb44-a171-4226-95f8-296e2d6a2f60", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c688b548-6bf1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781882158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882158, "uuid": "333900f7-44b2-4e85-b0e2-fb46db039150", "comment": "Malware payload (AgentTesla)", "value": "cd66735e5e540b3ec4f0efe41a66e9d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882158, "uuid": "c18b0088-58f0-460c-9b50-80d94ee55b66", "comment": "Malware payload (AgentTesla)", "value": "dc12faa460faab18a12d8ac33fb3a3a96c95232cff2f124df15300475cc20486", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882158, "uuid": "f9c2b750-5881-4d07-bd4f-9d0925d5c259", "comment": "Malware payload (AgentTesla)", "value": "da51a8a9177dc8914f9f4d2c0af628b3e2391afd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882158, "uuid": "5956f7c8-1ea0-4505-858d-0d073279ee27", "comment": "Malware payload (AgentTesla)", "value": "037f10c2557b0dcedd3587b1fc8967120244a3d966a994a08ea58b0f961bd60da99050558b4b01f4c84d329fbaeedb05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882158, "uuid": "a8928edb-efdb-47ba-be09-f95ba17fe6cf", "value": "T1DDF528415BA4A5723B65DBADA13BEE30980FB01314D9CF08312EE618791CD5BA75CAF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882158, "uuid": "f222844e-80b3-4344-b7b1-67958987d16c", "value": "98304:7znwFPxo/CIgCzm7148+kh3thOwLcuYlf+VNi/zEHfGVWH/b73WcFBMyvq30bd:7bwJxECIgem7K85hJcl0VNW4+MflFBIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882158, "uuid": "5897a927-a3b7-4926-a903-7a14e057804e", "value": 3347257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882158, "uuid": "4947f41b-3c0d-4214-b2b6-291703a0a84c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882158, "uuid": "14cc17d2-796a-40d9-9718-5c449b49f897", "value": "P.O #77644..JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dbdf34-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882801, "uuid": "cbb136a2-5593-4c89-8d90-0d86f502bd79", "comment": "Malware payload (Mirai)", "value": "30cf51ebe61595585728cc9677277bce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882801, "uuid": "0141b677-c1a5-4b42-8817-c8a3ac12e063", "comment": "Malware payload (Mirai)", "value": "dc16186a96cb24f8b4baba30acfc0cda7ab12068b5fbaab13e59d823580b42d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882801, "uuid": "d0654d89-9196-4a6c-8b8e-abc9b6160006", "comment": "Malware payload (Mirai)", "value": "b21ef6544237a3c02aacb587e0a567a166372c99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882801, "uuid": "239043aa-df99-4350-b40f-72bd5358bbbc", "comment": "Malware payload (Mirai)", "value": "e80ef8b9070d2f9aa7f1a44fc6600e894fe7f3570a6650f6f0affd922a28029a848ef3f1a76bf8bdd15678c3f60b04c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882801, "uuid": "25131f68-3772-4c29-8a3e-e15766a477a8", "value": "T162934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882801, "uuid": "8d6db4dd-b009-4849-b184-d22a78188802", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JIN6S:XGptyz+VJzB7T9/bLUAx9e/SBJO6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882801, "uuid": "3042a10b-db12-4018-a1ed-6c1990a363f6", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882801, "uuid": "c9161350-c686-43cc-83d2-81e0425145b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882801, "uuid": "a455e9c2-d073-4e21-81e0-728af9fc24c6", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54157a5-6bf1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781882210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882210, "uuid": "3f3659eb-764c-488e-89b2-0324c3ff631d", "comment": "Malware payload", "value": "a16e1fdbcf7ce45576adb066774c1332", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882210, "uuid": "4582ca3d-b48d-4798-bb6a-fd6b50f19aa6", "comment": "Malware payload", "value": "dc337785b24075bf25602ae84381da42db3f6ae89c58cfc657e4fe381b735ee3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882210, "uuid": "86c9becc-1c34-4cec-9769-51d5b14d0c5b", "comment": "Malware payload", "value": "20e2ced71bb343dbbf60110230ee4da98402ded7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882210, "uuid": "d52125be-2ec4-4f06-9663-0ab767bbbc4e", "comment": "Malware payload", "value": "5e614f631ab7e137911f1c31cebeba3e62e8d3d36154e1d6582c6361e5dcdd7229f70c3c400fb7fb543a8def3b169086", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882210, "uuid": "62f53c19-1673-470a-9978-09f882098f74", "value": "T100136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882210, "uuid": "88acf084-73c5-499f-b411-7043d95d17f5", "value": "768:kXRWNGxVK9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:Ylxxcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882210, "uuid": "6dfadaf3-72bf-4e14-9b75-4ee39a0e9b8d", "value": 45224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882210, "uuid": "3f0e7d69-cda4-44e1-812a-e249914220c1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882210, "uuid": "0d3606d8-8582-47de-b726-f36c5ea367cf", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad070173-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886840, "uuid": "a0f99433-ad2b-468c-9ce2-f694d9abe79e", "comment": "Malware payload (Mirai)", "value": "8be7ce3fc833c793f7a0d07b8e6fc7d8", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886840, "uuid": "39f267f0-a509-460a-b5ba-0844dd0c6227", "comment": "Malware payload (Mirai)", "value": "dcb272646c377af9c77bfc64c71577c564924ca9c9955a0e3b2374805c1b0d11", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886840, "uuid": "366417c1-534c-46d5-8db5-a87940101d5c", "comment": "Malware payload (Mirai)", "value": "cd85db80d5c04285b854830e97fb8cf8f2c8bd2d", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886840, "uuid": "5d407d1f-98c7-469f-971a-4168f9fedac8", "comment": "Malware payload (Mirai)", "value": "9c9d2187cc74d3d6b82195255118095af8a66d20ecfe2f0582f6467fb35a45c0a7bd88cf4a9588fab9ce5357c54ea713", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886840, "uuid": "9d0a1a83-1b78-4220-b854-209144b76245", "value": "T1C573027E946BC0AACCA7D3BA63C70FA1457E0A74204B9D079CA5E95EDEDED51AC001F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886840, "uuid": "c8332048-25b1-4b69-be10-d40adba8f369", "value": "1536:QP+9YNB8h+WNtJC3IYagKbfLMeftUWEwVoRKpC5zR0WLkVEWK:Q5B8h+WNtM3IYjKfHUW1WRltoVEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886840, "uuid": "5d4e6a40-7b54-411c-909e-da6e58771825", "value": 76900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886840, "uuid": "dd449fcf-787a-4366-b137-382c227b8ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886840, "uuid": "d32b211b-3990-4bd1-bfb6-31968e9e2885", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5015fb4d-6bf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781882819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882819, "uuid": "eb75b7c4-e461-4e56-98e5-1d32d63adda5", "comment": "Malware payload (Mirai)", "value": "696f9fa65934d3037791aa9e574051e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882819, "uuid": "b66714db-044f-4673-8613-3468c6b3cd83", "comment": "Malware payload (Mirai)", "value": "dda830d96fb1efa7c935f69a8c047ac234b619218e283fcdfdcfe3189b9d40e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882819, "uuid": "21262728-dbac-471d-b0e2-f042ebc171ae", "comment": "Malware payload (Mirai)", "value": "f6fda391494a991b96bedd2b737457189a5db6db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781882819, "uuid": "f8a6fc36-9ab6-4e0f-a5bb-1f17e4b08f4f", "comment": "Malware payload (Mirai)", "value": "2ac95944d89316922e26ee9ad8d09617723e6e6f419f6a001f25e02b076a26b384d46b143ba75d59708812a9638bf932", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882819, "uuid": "f7c31c4f-aa9f-4aa7-ad9a-95cf98cb6367", "value": "T156933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882819, "uuid": "0b286fc8-1479-44cb-bd62-5168371a19ad", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+LIR:KvjLrKGG4syfcIhXiuxpUN48LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781882819, "uuid": "3bf9217a-44f9-4cb9-8f5c-03cf3cff4662", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781882819, "uuid": "79dc4432-fc4c-4fbb-b6f6-e212a0191201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781882819, "uuid": "b861b7e9-0178-4763-983b-8805b81bc48e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b529685b-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913053, "uuid": "c7549643-d660-46e3-bab9-30be1e211928", "comment": "Malware payload (Mirai)", "value": "9da1a2faacab87d711768c77ff3a0f44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913053, "uuid": "88587dce-305b-4af4-ba71-921ec48f6732", "comment": "Malware payload (Mirai)", "value": "dde931b5fc51762b7e6a7f010e839d31389a9c04fd276c7e89f1597ca35a7bf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913053, "uuid": "63180202-f873-41d0-8a75-04135cd20cdc", "comment": "Malware payload (Mirai)", "value": "868edf23b80bbad23bdbf732c8f0e92ea9bc9aa3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913053, "uuid": "2fc46db1-c73c-44c9-89b6-38d7903d4101", "comment": "Malware payload (Mirai)", "value": "0e5aa2b53c0f3755a3a76d307a8da84ae027236a7e930172a3627dadb2c1512e07c0f5d7394f5dd26e219fcd3a68fd7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913053, "uuid": "8d3ca381-1ffd-45a9-94ff-1faea26c40bb", "value": "T10F144B43EE890EDFC45BCDF086AF83AB19E765AB49C2B5F5547C8C0C754D28A06D3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913053, "uuid": "2bd36e95-0a65-4f8e-86cd-7504b77ccb92", "value": "3072:CfIcJuw5o/a3JFxh7qzYktOFR/gCG3VOzuYejsvP5F97roJfcscbtPPqN:jc4go5zk/gCGA7ejsvxF97S/cbtPPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913053, "uuid": "6eb982a2-33f9-400f-81ba-ba9bb886c482", "value": 208976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913053, "uuid": "213e1b38-eed1-4e82-aaa1-a5fb313a38f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913053, "uuid": "5431e2d6-3902-464f-8841-dac20c249a3f", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703437e9-6c29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781906065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781906065, "uuid": "44043fc5-90f0-4ce9-92b4-960a3f3edeee", "comment": "Malware payload (Mirai)", "value": "ceff069c23d770f60b5da183793393e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781906065, "uuid": "f21cab5c-0c07-427f-b12f-e2aade76155c", "comment": "Malware payload (Mirai)", "value": "ddeada67c2e5ad7eee5f06b2de8e44d3ab2d6851c9a9ed85c0e1a42016f72830", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781906065, "uuid": "56fe7f9e-7604-423f-bfba-58a86d2d1e9a", "comment": "Malware payload (Mirai)", "value": "23d8aa049db055bf8760b4d5e55d0b2fe3556ad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781906065, "uuid": "bda91154-b578-4db8-be29-6ac270fb3e35", "comment": "Malware payload (Mirai)", "value": "c613ed97d26af3d1e49f800d4df216d5c5f31b03b2e4fd71fc47b03d3205fc78ae7e72a2d57adf161e4c393c596c79e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781906065, "uuid": "4dd74e4f-3454-4093-969b-5bfe7c153a28", "value": "T1C3242A45FC919E12C6D526BBFA5E428C372A13B8D2EA3103DD165F21378B96F0E3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781906065, "uuid": "3a40ca1f-68a2-45fb-923c-42e32b36e872", "value": "6144:sl7ITHuVFBzoRxobJXl5F4rIUl7qU5KL3OZ57:slcLsFBzoRxgbF4s4GH7U7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781906065, "uuid": "56e40185-4ac9-4cde-81cd-1bec9e31bbb6", "value": 213248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781906065, "uuid": "979da6d9-e027-4780-9ad5-677181b53434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781906065, "uuid": "36bdf20e-fdcf-45d7-802a-7ae215d5f55a", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3864877c-6baf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781853573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853573, "uuid": "56e6ef38-6e50-4628-bc8c-65da5ea3afb5", "comment": "Malware payload (Mirai)", "value": "fc5fade01f3cfb6620a9699c64aded80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853573, "uuid": "b4eebcff-672a-438c-acfe-66eea75bd12c", "comment": "Malware payload (Mirai)", "value": "ddfec7291fb680c22db1d83d0923c7251580536308adf11ed7c4a235d064c0b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853573, "uuid": "37107c7b-6ecc-43e0-b997-83b6da479f1b", "comment": "Malware payload (Mirai)", "value": "106cdc9b4555bbc774ddd71ff27d45a8037c9ed9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853573, "uuid": "690e09e4-e51f-4765-9076-65b90dba3d56", "comment": "Malware payload (Mirai)", "value": "02075304003c1e48228a014a3b2cedfab10cd9de2edb6a2ca89d3d01d8d8f4034cb48c17a718b58e5851bb4956b1fec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853573, "uuid": "11680221-106a-4a83-a82e-b9704fb1738b", "value": "T1FD044D46EA818A13C0D71779B69F524633239BA4D3DB33069918AFF43F867DE0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853573, "uuid": "4af64103-cbc8-4765-9852-2608ea38c37c", "value": "3072:1dAiX4middwa6Z9PRd4V+IpuizCScZUFvGyX27M/9gOfM:1dj+bwa6Z9PRdA+ADCFZ8vGyXWM/93M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853573, "uuid": "cdf77bf2-99b1-4e1e-b9f9-360d84c82cad", "value": 176483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853573, "uuid": "ee8e73fa-7c50-4905-b2a7-bb532f25f4ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853573, "uuid": "145e538a-b1ba-45ea-9070-6a6b7e5621ad", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d1b492-6bed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781880419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880419, "uuid": "f58027a7-5442-4a7a-9e21-4aa728612909", "comment": "Malware payload", "value": "358b7414727702d07cef0d66fb7be5ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880419, "uuid": "e6aac900-3d82-4025-b599-0d25969a418e", "comment": "Malware payload", "value": "de060405828f25c5b16979b10d6b0b5d8922414a5a773fd88877063000a041c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880419, "uuid": "c485404b-558c-4960-a4e6-f22c6a0f271b", "comment": "Malware payload", "value": "3dfa3d68cfa8f3ce5ef49913699d0270bad1c7c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781880419, "uuid": "16d76ccb-361a-43da-8f62-891e63036270", "comment": "Malware payload", "value": "48aa3e1d55bf8f3ff77ac78c6212c56578ca710f88a3b0533a971ed22dcdd5ddaf718c13684af1089e87c02c66880366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880419, "uuid": "6d126e6b-b0dd-4cc5-b163-ed5eaaa5b989", "value": "T1ABE68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880419, "uuid": "76f1ab7b-0aaf-4ebd-939e-26694e271fb9", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQO:cqYUQuVDt0TZEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781880419, "uuid": "62349eea-2369-4644-a267-50d760f26526", "value": 13991936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781880419, "uuid": "eef99d03-d4b5-4754-b14c-1c473398a0a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781880419, "uuid": "6aba7652-6432-44ad-bfa7-94294f102be0", "value": "de060405828f25c5b16979b10d6b0b5d8922414a5a773fd88877063000a041c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb58d4b-6c25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781904395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904395, "uuid": "8ba8a8cf-d9cf-4ab5-8858-9e2954b5a7ac", "comment": "Malware payload (Mirai)", "value": "54aed4b804f2ce10c9771ae0c3b661bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904395, "uuid": "1edfd63a-591f-46e4-8c7a-4dd0199b030a", "comment": "Malware payload (Mirai)", "value": "de68c6ec4a27e59d667edbb9f60af5f7346b6c35d4984646ad822d1a2f2060a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904395, "uuid": "1d69a559-267f-458b-bf11-b9c14cf0742c", "comment": "Malware payload (Mirai)", "value": "ad81c3bd616800cf2d439ffc526116eb6981ad18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904395, "uuid": "93e90dd9-2faf-4d0f-ae58-f1ea8192574d", "comment": "Malware payload (Mirai)", "value": "e6f12dca83c5440fbc8ab87a726c056f7eef19338f1eacaaf5b9ac812dcbd23afb8732eab024681da26138122819b378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904395, "uuid": "cd2e34f5-75e6-4146-a998-c28db80e3268", "value": "T1B354C51F6E228F7DF369877547B38E34976923D626E1D6C0D2ACC2141E6038E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904395, "uuid": "16781b42-e623-44b6-9b90-90dbbe0d13e1", "value": "6144:IzQqs4CcjTisYlkdBKp0Xj5u5vx7QVph4Oorv:IdtisB9ovpOorv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781904395, "uuid": "b5be2a2e-5af0-48ae-a45d-cfa624af4bd6", "value": 279236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781904395, "uuid": "9893608e-ed6e-44fb-ba68-c1cbe97f8457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904395, "uuid": "3a14d6ed-6346-4876-9350-b70d5dca0934", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6072602c-6c20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781902173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902173, "uuid": "00c4c8e7-7160-4005-b5c9-c8db69762a05", "comment": "Malware payload", "value": "0d3398c9a828d832c72324ee97dc22ac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902173, "uuid": "a269a0d6-1583-4dd9-aa01-4a117aa493c7", "comment": "Malware payload", "value": "dee7280b9ec3ff17e82622fd920eb9fc2aa38f20085ba5699c442dc533922e19", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902173, "uuid": "211a10da-813d-42e2-899a-47adc8afbf1b", "comment": "Malware payload", "value": "53e26b6210f5b1569838bc0b0aa9b960aac4e551", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781902173, "uuid": "d7a1551a-68c2-4ce3-af59-69e2c9473db2", "comment": "Malware payload", "value": "389fc27e281b21a4a28c783a859065f43f78adaa1ec3a23974e4bbc0cd1fc0121e33716aae52a461618e268b857e3146", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902173, "uuid": "766f9a9e-88a4-4de5-ae66-bd834bf2af3c", "value": "T19931B0C411D218B03DE28C27626AD998F4C57A41FEC64E40A0DEF8F9988CF49B455FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902173, "uuid": "525f82c3-0d16-4ec7-9ae9-c31fb4192347", "value": "48:2RKhEcfEnsTE1hxjuDujPDtjtD3jiDajZfDZp:2RKhEcfEnsTE1PmG71VzaiZLZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781902173, "uuid": "693c5f31-9c5d-4609-840b-e90d7270661c", "value": 1667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781902173, "uuid": "1ce103f5-8f22-4f34-9bca-eafcf26ef4de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781902173, "uuid": "0fb6a4e8-f3fa-48b7-a3e2-1cad93e3db0a", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a5d6eb-6bfd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781887230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887230, "uuid": "a75e43a3-594e-4d3a-a1cb-94f0e30bf396", "comment": "Malware payload", "value": "5285c03009623a66df99dbc04b5bd1ad", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887230, "uuid": "269ab616-e71b-4377-840d-78bbce9e85c5", "comment": "Malware payload", "value": "df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887230, "uuid": "e3eabcec-b699-4f37-ad72-24b6087fc7ca", "comment": "Malware payload", "value": "59785eb0f54995c670340a177f481ea72127f4e0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781887230, "uuid": "a55c1d66-776a-4d0f-b216-6554a054da4f", "comment": "Malware payload", "value": "7ec9aeb029d5d2c2804e1d86ff2712191c8c5aee83f268cc180744c3805fc792c108a3e27e1a37651f314eac64cd134c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887230, "uuid": "4fb7fb4e-ae15-4e5b-9f75-2d581b695032", "value": "T14D825B0FB8424726D0E210B49676977BDABA6872338414DBF7D44AE90B686D5FC3311F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887230, "uuid": "538ed0b1-9465-4f6a-8f25-10a37cc1464a", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887230, "uuid": "7686f1c2-aa8e-4ba7-a6f7-e32e8bafa2f5", "value": "384:LXIqQlV6lvR+v0CvBu9JgwHcOv4av8U9cmF:LD80IE9b4a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781887230, "uuid": "89a16d7c-62cc-4875-b2e5-403ecdfb698b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781887230, "uuid": "0e0acaf4-d73c-41e9-a08d-ad9e7fd664cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781887230, "uuid": "634785fb-2385-45a8-a521-c0f2853f445b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9015a1-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883621, "uuid": "6ea0f0e7-6aa4-418e-919e-b463f432a4f7", "comment": "Malware payload (Mirai)", "value": "e439c312839f41b30683216f8dc8815d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883621, "uuid": "d53a8771-0e17-4380-9b8f-2d2d64fffef1", "comment": "Malware payload (Mirai)", "value": "e0075a69558494c5e5fe7f44ccad33a787c956fa460384d5f412b79db3273504", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883621, "uuid": "02c38db8-4fb8-481d-bf30-cbd5fcbf1e0e", "comment": "Malware payload (Mirai)", "value": "44be3f64617e0683663349abc736816b66d30ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883621, "uuid": "e4c2006b-25a7-4898-a857-96716a2e0a81", "comment": "Malware payload (Mirai)", "value": "1e6d79ec8868cb73b59cab37cb7becfdb42be0d739ccb04f82cff1caea07b1a8f10d962ab9478b62120834a6d3e5bd34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883621, "uuid": "bde2d970-b227-496a-8568-f5fe318cd954", "value": "T1ECA32891FA83C0F2E843A8B15467F33FA631C8444131E65AFF99AF7DDA23A02561579C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883621, "uuid": "543877c1-8321-4229-b631-f1bcb7bddc1b", "value": "1536:tfVoDBmPdYMbPMqL2ohq0hChREh5dSp8QWV6qyqKmslwck6xjqJ5LtGpk0AtBg:tABYBMqyV7ys4Kmslwz6xY9klku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883621, "uuid": "1faf6782-13e1-441e-b5cf-3127efb2be5f", "value": 103720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883621, "uuid": "fc18e83d-05dd-4ee2-9ce2-d33d058a8a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883621, "uuid": "9bbaea5e-cb3c-44ef-a6ac-28a54ffbfb62", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ab59e7-6bc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781862288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862288, "uuid": "cd73f6bb-7da1-4592-af69-d77cb3247b67", "comment": "Malware payload (Mirai)", "value": "512d502931ffa21784fc571d3a573485", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862288, "uuid": "fc48e60a-d23c-4ec2-b0ee-e70f03782917", "comment": "Malware payload (Mirai)", "value": "e2d5a41d8d5796c5523389135bf875488c151e660bc57d5bd5b2cacd24764564", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862288, "uuid": "ce071215-1725-438a-a7e5-c6090b970d1e", "comment": "Malware payload (Mirai)", "value": "0a598d872f2efd43e81cd2a88b6c9f399f707741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781862288, "uuid": "9e69560d-7844-4610-8177-53570b6b1187", "comment": "Malware payload (Mirai)", "value": "57d948c6e52459b39c194e9664c157bdbe04f460b88e501e09a040c22e8ae93a04d07266a9116341da97e9c5ea1fae87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862288, "uuid": "9b790d3c-d13a-42c3-9117-5b1064138683", "value": "T11193F60AA9429F01D59731FAFB8F425933536FACE3F97101DA246F6423CA9DB0F62512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862288, "uuid": "12b3830f-d439-4600-98ce-9cfb726ba8a4", "value": "1536:TPnY509p0TotaWcQTh5j0/afwH46xJzWgmIlllsVic2LqMYwgbZJoYvrc:Ei9pUwXJF5j0/afwH46xJoJ2LqMUJoyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781862288, "uuid": "116818a1-07c2-4e2d-855f-d0a7c2cc26e8", "value": 96624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781862288, "uuid": "55b227d9-be9a-4399-b514-9024425e9847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781862288, "uuid": "83d43413-c8f0-414b-ac23-d30fbc88ad81", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1b6e69-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886838, "uuid": "cab9d999-29ea-4c04-85dd-fa0cb82201a9", "comment": "Malware payload (Mirai)", "value": "eda4a7c4d95909028652380adaa8d72f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886838, "uuid": "47a29904-3cbe-4fe5-a907-f7171ed6d651", "comment": "Malware payload (Mirai)", "value": "e31ec4a33f2a78f262f3c265302e2ca58ffcac1d9e371ca5d0f0d023ba20f555", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886838, "uuid": "4040ec45-cc23-49a3-ba0c-e1b2832533cd", "comment": "Malware payload (Mirai)", "value": "ca46d6f6f1de08b8f896cd3d46eb6d15838ace45", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886838, "uuid": "6ecdb19a-89f1-4e60-b4bf-90a79bb2da96", "comment": "Malware payload (Mirai)", "value": "bbe28d690f6fad4b1c3b0a5f5304bf2eeb6dcdb746a7fa9ba665cb1196b4943ee94e6260d101f17c36edc5ec35d617b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886838, "uuid": "a34a786f-0c42-4711-a290-67e892eb4b25", "value": "T15C53F2A693C516C2F3BF607145273F9E0925772D3F89A1518F9C0A3386BA7391B2C649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886838, "uuid": "40951ae1-111b-4c5a-bc34-bbd5182cf881", "value": "1536:QDbQp+t5W1c/vNTr1iymTsV7dI4W0nouy8ou:i8+uiv+ymr4Xoutou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886838, "uuid": "fd25bee0-992c-4bb5-b9fc-d34e752c1e6a", "value": 62672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886838, "uuid": "336961c1-a412-4c9d-b398-a5ffd99d528e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886838, "uuid": "2b0a403a-6c93-4ef2-8004-2d11569340b1", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6032e967-6c14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781897019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897019, "uuid": "67b08050-5404-462e-a25e-e6ec31e23f07", "comment": "Malware payload", "value": "2cd4150a721a5ca47ba32a9ffeeb6d09", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897019, "uuid": "7113cd20-98ff-4d75-be3b-394aeb198296", "comment": "Malware payload", "value": "e509bef525e00f69354c2d6af41839bde34f1b5f1de3bc4cd7541cdec5fefd48", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897019, "uuid": "a4fd0654-f545-4c4f-b3bc-c7a11dd40ec1", "comment": "Malware payload", "value": "0d54c404877c052b17c183278436a879e7bcef15", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897019, "uuid": "6806b937-60d8-4c34-9dad-a1a43e5cb57e", "comment": "Malware payload", "value": "d132fa88f69c265855185a02f393b492c54eaabfc901b792e687dac2a71c8c0b50571cd99ae9f2a6f73932dfeeb1f847", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897019, "uuid": "cc41fda6-0ae8-4165-803f-3274123ca99b", "value": "T14B115AFC2464B063C5C25F0BF932A311B1DB3BCE7785E1DACA68AD61816CC94340BA34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897019, "uuid": "e4b24c5d-f400-46a4-adde-269875268d1e", "value": "12:2HM1Hu8d8mEyhHF1H1293VhK1AA/3YIjhZ15uAMAgEyhqT1q/O5OKtOyW:2YO8RhXV2HhSAAJhL5uAfByh0aO5OiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781897019, "uuid": "98aa6382-83d9-4b83-9934-458b43a913bc", "value": 929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781897019, "uuid": "b2a8de44-6f5b-42fe-9c0f-ea39ead30d7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897019, "uuid": "164c790c-1ab5-4c3e-808e-337f71299b51", "value": "giga.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9897c0-6bf9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781885470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781885470, "uuid": "60347ed2-25d9-4ed0-b592-f0324d76f956", "comment": "Malware payload", "value": "fcb38afccea374ba4d6d7fafe2f66d0d", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781885470, "uuid": "d020e4c8-28e7-43b0-ab91-6bf9f1a7da87", "comment": "Malware payload", "value": "e54f95f0bc433c97026d8dcbabbf25181ac9199581f6f6365594243e2b182690", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781885470, "uuid": "5e0f31f7-49eb-4741-8f3d-6ada1686289e", "comment": "Malware payload", "value": "7f5d2a40db9e5c98500b43d621450c505f29d59f", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781885470, "uuid": "7d05019c-a699-4c9d-a5ff-3790c66bf09d", "comment": "Malware payload", "value": "d0b44c0dcd60772f9f7825977ca667c46c35f20f5a9300537621e2b3865b025329bf42920dee612e436d6e5a146cbde5", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781885470, "uuid": "8901ce11-5e55-492f-9912-d46f9454914b", "value": "T17A03C95B8509C6863B6062BB2BDBD5C73A04CC6D00A5DF86F5BECC3AB305C1D72A4A1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781885470, "uuid": "e7849f82-0878-46f9-b17d-2acb370c6ed9", "value": "768:AGmHGFqqwxBkohRw2Rx+Jgmx0+o2p7o/hcOZ4tjjD3IozyZEuDDh9A+Zzc3WlyOS:kBXw2Rx+Jgmx0+o20pc1+g1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781885470, "uuid": "755feeb4-34a4-4fe0-b799-868e3e5b7123", "value": 40404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781885470, "uuid": "e19cfcfc-7cba-4024-a8d4-12605223ded3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781885470, "uuid": "e925686c-2a8c-4740-af48-91c4abba6b54", "value": "5vyvx4z1.mhq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4c65a4-6c25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781904346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904346, "uuid": "7ed305cf-e0d4-4d63-8c5a-db9b604bd897", "comment": "Malware payload", "value": "fe750ba1f62d400dbe9e89d7da92e56c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904346, "uuid": "3313e383-43dd-4dc2-9857-5aba2f5c4573", "comment": "Malware payload", "value": "e5805ff244a08ce995fe238c0367adcec7fc90510e0ac674584074928dc5982b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904346, "uuid": "bb86a616-e03a-4383-bd9f-668a6e8c0a5e", "comment": "Malware payload", "value": "8b4d97d6431a26920622873353d3fbff11cb6381", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781904346, "uuid": "2286496b-ddf8-4aad-914e-20c1fba9b977", "comment": "Malware payload", "value": "7fbb24b0c56384eb1ad89ce306dda6955fd0cd991eadc89f4544174c647feb79e54a29d8f32ea2be2ef08a262aa7d7cc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904346, "uuid": "9f0164ce-9dd6-4fc7-aecf-3427898b9189", "value": "T11F0159C68A00A9145029DA2A73975590B410C3CF4D8A4B647FDC5A2EFB88D08B22AEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904346, "uuid": "137d0c35-c193-46c3-b3ef-b8764d8e308e", "value": "24:kXCKysE2hi0ziQvZohaZ8q/LW+FAHjWN7:e9Qp+MsKq/LW+FAHjWN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781904346, "uuid": "a5269615-48e8-48d0-a61b-438fcb304780", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781904346, "uuid": "48395f52-012c-4d63-ab84-1de7dc2bcfa0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781904346, "uuid": "492bf76e-906e-428a-ba18-f5ba79145d24", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64100c47-6bd9-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781871685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871685, "uuid": "db8d2aa2-34e5-49a2-84c6-aecaae301841", "comment": "Malware payload (SilentNet)", "value": "c919f1683bff46ca6a7cd406a3ed9fe4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871685, "uuid": "2063e1cf-e9ab-4e89-9850-00efd93395a9", "comment": "Malware payload (SilentNet)", "value": "e654b182de4e813ce7d03a1033138b9fb989f61ac102f03ca3694f6746a71f16", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871685, "uuid": "f515914c-942c-4e3c-9d97-00ebec2a2028", "comment": "Malware payload (SilentNet)", "value": "26c392ff4d15c2b4523cdd6ae64705273e304dc2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781871685, "uuid": "d94fd007-22f7-44ba-a096-f05f9579b6b9", "comment": "Malware payload (SilentNet)", "value": "eeb894830cfe1dee5a5829a804e1b48e00c0931dd727187d02a9a8dda96dd221ef82bcb29d2cb3e20e75cdd82a49da16", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871685, "uuid": "9792c13e-cad5-4de5-93d1-b1eb1209f92c", "value": "T181F633A317B2080CCABD733472426FA744E546F0583E3C4746EC599B9DE099A9F867BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871685, "uuid": "b23df9dc-f454-4a9c-917a-904da08accf2", "value": "393216:SvzZuZlkRN8gIz6v/8C1K+39aZ6RblwPt9:SvN6uRNT7v/8C1K+tRblwF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781871685, "uuid": "c34bc15f-20b8-4e96-b629-02b9b5e2b697", "value": 15283304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781871685, "uuid": "b88ec921-209c-420a-bdf0-97574d1d9a0c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781871685, "uuid": "77baf885-b486-4eba-8872-d6fbc2716130", "value": "glazed-1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e45519-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886237, "uuid": "58fa0de5-d1e0-4be3-a69e-1283b6a3c23a", "comment": "Malware payload (Mirai)", "value": "8a9a667d4d4944a21e6e7d077d49c8a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886237, "uuid": "4ee59062-d966-463b-bfad-c76bcfe4012b", "comment": "Malware payload (Mirai)", "value": "e65ba4ad8af170f4811f6cd0f36998b9ecc58df6dc5dee5e827e083bc5fba08f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886237, "uuid": "5484fc5b-efaa-4ce3-91ed-c6926b755f10", "comment": "Malware payload (Mirai)", "value": "826780710aa99ac1a2556054dcc9fc21e5d46cc7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886237, "uuid": "4513e85e-1753-486d-a239-6f84573b0b05", "comment": "Malware payload (Mirai)", "value": "f011ccd17025351d6932aa686158beed2e32c14c8cf4bec643cff5f7fe36ded05e89e163e4664a17759cc56286b3204c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886237, "uuid": "7bbadd42-8209-4369-ba6b-fa051f00adb5", "value": "T138933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886237, "uuid": "7373e769-286b-41fa-bd3a-da8a5ad81300", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2DZ:eyxt7W+G+3QBBntmzg6d7WidDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886237, "uuid": "4ef140ea-6eb5-463e-9d7c-8e2029f8048d", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886237, "uuid": "1940b211-2b86-4356-a516-dc25ec50511f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886237, "uuid": "bf0555bd-a7af-4aa0-b733-1674dc686f30", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6511bc-6ba4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781848914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848914, "uuid": "7c4a93d2-c0fa-486c-b403-0b38f68754b3", "comment": "Malware payload (Mirai)", "value": "fc721817101e488cf1ce44f03f086254", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848914, "uuid": "c510a07e-7a72-4381-92f8-36b8dae86d5f", "comment": "Malware payload (Mirai)", "value": "e79f3b7ebc19d82946535e4521866d5658ef41111c9bc162330c470b19680877", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848914, "uuid": "a011c9a8-3052-4a81-a933-7689ca421fb2", "comment": "Malware payload (Mirai)", "value": "8a06162c77df9b0d3300a8bb1114728842f107cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848914, "uuid": "eda9fb97-d610-4a38-8864-41ef4a2a916b", "comment": "Malware payload (Mirai)", "value": "797885abddbb9c3084bd035ffcaac7e45d42d6d4ecda905943b663f9d4426484843c8ee3d63e0e9127018febb433d8de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848914, "uuid": "a1e18272-fcb0-4ca2-a0e5-fff4bba14941", "value": "T1E803F1D64478C39AFA14313449EF7A1E085C64906709ABDBB328343AE66CB446734FDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848914, "uuid": "8319ba97-aa4c-47a0-affc-f462bba526e1", "value": "768:sJEGB7YxBZsC7CKl4S9xoVRI4NuirGnp5FNFS+AstieQPbgj9lDNxFanbcuyD7Uu:wmxXYKlcbIcuCGnp5FjSmiPbgjPDNxF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781848914, "uuid": "a8f2b4f2-69dc-4f99-9d84-6536e07b6eb8", "value": 41320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781848914, "uuid": "9866da84-60e7-4cc2-8f48-064af672ab12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848914, "uuid": "ea2d8ae4-a0a0-4c13-82f0-c05eb0dd07b7", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c092d41-6ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849391, "uuid": "71264550-bceb-4af5-81f0-770ff1e7cd12", "comment": "Malware payload (Mirai)", "value": "961e597308ca6229b8d4599c778144f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849391, "uuid": "dc340fdf-4d41-47cf-8ce6-f8184407d36a", "comment": "Malware payload (Mirai)", "value": "e8f4b4cd88fa898539e4ccc2c2de14df5bdc78b5e2dae1053725574169dfaa68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849391, "uuid": "4fb2caa2-d3f1-4f90-a38a-ee919c83f9fa", "comment": "Malware payload (Mirai)", "value": "3bc950eb6444acf1e349833c9c35633a40b3964c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849391, "uuid": "91dff3db-557b-491c-97a4-1b092b44453f", "comment": "Malware payload (Mirai)", "value": "066e2581912ad04272c0c3182c61931fb713305f546b397feaaee784240bbf05aaa373062ff06c56db82cdfcb1890079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849391, "uuid": "d1bccc22-c77f-4d97-93c9-5c1797f447a7", "value": "T17D739E23CCAA1998D59842B8B574FF3A5773D41056831FF611AACA76A043EECF8063F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849391, "uuid": "680fb8fa-4b31-4c39-8fbb-820b8ef50c90", "value": "1536:s/8EGEhFnk9C01XKlM5m74ND9YC9leyAcsI:s0EGySC01alHcD9YKf9sI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849391, "uuid": "7551dc80-3399-42d6-9a63-595d489b8164", "value": 80336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849391, "uuid": "eddf9249-b17b-4ffd-94f0-f7e18bac6d30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849391, "uuid": "939fda16-06eb-489b-9dec-865e2654339b", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0103e63d-6beb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781879250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879250, "uuid": "2d2afe3b-fadb-4fbf-a3a9-5bd93385ab0b", "comment": "Malware payload (Mirai)", "value": "eea3c517efec06cd4535691d6dc73dbd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879250, "uuid": "6a7f1905-40cd-42ef-adf2-a72aa2e48448", "comment": "Malware payload (Mirai)", "value": "e9818affc9a17d3e111ce4959025cfadb7a290a32a6e6c72673873039b59c16f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879250, "uuid": "d22a3483-4ac0-4b92-8046-543fb5a30c0f", "comment": "Malware payload (Mirai)", "value": "59ef357f32930a5bb5244a632d65d72ee2f947a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879250, "uuid": "965b2a6e-9d1d-4354-a9e1-adc38a4403cf", "comment": "Malware payload (Mirai)", "value": "295afabeb0972120f79657ab24b39a25a0a1d310ba59b54e7d1ab6270306e93579ddcc18ca3ea900c7cbd484073e9a97", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879250, "uuid": "cc238ab1-262b-49d7-aa90-454ba72320e7", "value": "T1BB210AE8FC61A531358D862EFA9E4A0C6A825C2F6CE93504B04E9C34170CA9D7318B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879250, "uuid": "bd0e8a82-3ff2-4f3a-b5d8-494452ad2883", "value": "24:IrrHWHLmSrz10kIY1pIjB1A2UIAaYNahbsqtnSq5Af6Q:2WHiS/13z1py13R82TJ5FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879250, "uuid": "4c911d2c-4dcc-40e2-9cdd-9494f2271beb", "value": 1165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879250, "uuid": "db272216-94e1-4c65-a3db-9edfe29804e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879250, "uuid": "52b135b7-dd11-4f05-a61c-fafef28ff156", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff503f1-6c14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781897206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897206, "uuid": "f2255e16-aa4d-4613-b385-777c46ecb45e", "comment": "Malware payload (Mirai)", "value": "27f476a7dbcfe538ee59d8d156fd5ab9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897206, "uuid": "4dc63814-840d-4b75-a5cd-fd8c348dd4e9", "comment": "Malware payload (Mirai)", "value": "ea1f63e24fd6ac740765a38afa4419aa75e8d56208ec1aa3034571e915327bbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897206, "uuid": "d251b706-7b15-41da-96c2-fe5437c8e968", "comment": "Malware payload (Mirai)", "value": "f2d11e343a39be029ac96d39bb0f483988761acc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781897206, "uuid": "8a0ae028-1bb1-46e8-85b5-711c59099c73", "comment": "Malware payload (Mirai)", "value": "5d5a762a0e3118e1251dbe77d23264dd9d206e5873e9396f6f825de0dbcd5600f42e68492f1aaca1570ea2042ea1eac2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897206, "uuid": "5de4fa05-b64c-4f4e-8707-429b8ffd14f2", "value": "T10FA32A4ABC818B02C5D41A7AF95D51CE332707F8E2EE7216DD252F2177C791B0E3AA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897206, "uuid": "f8c69ccb-b3f0-4317-baab-08abf8044b80", "value": "3072:royK6r6gnMQ96F0k1opwVXG9GdFLViXqFPr:rnq1opoG9GdFL2qF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781897206, "uuid": "7625cf38-bdb2-4577-8dfb-b3c7c530caaf", "value": 104972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781897206, "uuid": "14de7d38-51d3-4ebc-aaa9-e07241138347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781897206, "uuid": "9995ceaf-7596-4aff-9489-8005d412d750", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba36ff3-6bb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781854196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781854196, "uuid": "6cb558e5-e316-464d-97fd-ce7c0a964348", "comment": "Malware payload (Mirai)", "value": "372e4c10d6dd6cdec59c2c0773f094c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781854196, "uuid": "37ad2971-94c4-4712-8e44-0d5265c30249", "comment": "Malware payload (Mirai)", "value": "ea36fff52c5a01bea1b7ee8ee9df0f75912de0a7fbf861117d8f1f8bce828720", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781854196, "uuid": "10507334-36c2-48f5-88dc-f4da0d17f2ed", "comment": "Malware payload (Mirai)", "value": "fe14ec2bce9573a3dda1b1a0f22621115394e423", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781854196, "uuid": "82175dba-abd6-443e-b653-0cfdddb5dae5", "comment": "Malware payload (Mirai)", "value": "017ba00ec0e8c14d18cf92de8e7429a4ff23a2dbd81311e086fe4baa14a14acb37fccf9705de2cac5343b3614603d00c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781854196, "uuid": "4f7adb49-184b-4ddb-9b38-82f2395debad", "value": "T1BE74C63399164992D0508CB212673356AC4BC7BF88FA22D3ED565DA4FF3145F22BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781854196, "uuid": "c89466ac-b24e-4e06-bba6-8eed34ac0f15", "value": "3072:mYCw16iSUBNP63g69UKwD4BMEbxiUC0vZUmX/VMso84ayTNb:mTw165Ml+wD4BZrumX/VMso84ayTNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781854196, "uuid": "b345e1b7-3a32-4ee4-a304-49b6f31a0d92", "value": 360114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781854196, "uuid": "b9abb3de-6278-4280-9dbe-901a7648f988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781854196, "uuid": "cc8904c8-c4b3-44e4-9f84-1b7e80f3a79d", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930448ac-6bec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781879924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879924, "uuid": "936efc81-793b-41fa-b065-697942308ccb", "comment": "Malware payload", "value": "1985eee3c393f665b8b9f5da716eab7b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879924, "uuid": "cf9e4318-8c59-4218-9e41-423e4f45878a", "comment": "Malware payload", "value": "eb2d5d13129b28a8250dfdd4c04001ffc888f7903bbf0a10c155eac8eebbb42c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879924, "uuid": "38ae080d-3328-4932-80fa-5825c3cff879", "comment": "Malware payload", "value": "3ebaa92b86e2a71d44bed2edea757eba7e990d4a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879924, "uuid": "01ec35d9-b429-4b88-86ee-36922fa1dc3f", "comment": "Malware payload", "value": "5901cf7eca85d3de9027106ed506365bbdf346d0d54d39017f6d41eb13f0222fd35b79d5eb17f8992a988a7fc6be3a0f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879924, "uuid": "7446c795-a790-4766-b46c-aa3369bdce93", "value": "T13D316EDF44095A395207C9CEB3723158750C82FB288BC7D4DC4C0EAA8688ADC7295BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879924, "uuid": "0d0bcfa0-f8ee-4684-9fcd-099bba161fe1", "value": "24:3w3sGXQG5K0F6Mx6Qjtjo9Bk5xipgeGl0Zpt3Y:NGk0QwJov8o2eU0Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879924, "uuid": "040005d4-5826-49fd-adf2-56c96c363aa8", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879924, "uuid": "636bd670-22b9-44ce-bfb8-29956bbeb77d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879924, "uuid": "fd180ecc-762a-421d-ae2a-ebbedd8e1a81", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e25b2f-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781850129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850129, "uuid": "e89139fd-e159-4e6f-ae39-072a4163776e", "comment": "Malware payload", "value": "93ee20af22aa2906b925e22fdfc01896", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850129, "uuid": "99db69c0-c270-4836-8eb1-5a18c5ff144b", "comment": "Malware payload", "value": "ec239434be819aedea1d73f89a1134e660a2e196537f2acdc6a0051b37a1e312", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850129, "uuid": "bcf4efb8-bcd6-4340-aa74-4ace6c03eed5", "comment": "Malware payload", "value": "30ee0266e91e5facfd28c1a9404fd0efed5cdb5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850129, "uuid": "f9d51930-0e4e-4828-ac8a-c4a5669b8ef5", "comment": "Malware payload", "value": "019373fcb380de93975e54ec8bcc6a1a8ef707347c55e8c35dbef4209fad30bb05dd783ba74fd289235f689eb002d91b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850129, "uuid": "0093f17c-06df-433e-9564-6df4bd93d773", "value": "T1A0762957B8924942C4E43A77B8BE81C433634EBA8BC712576D05EE383EBE1DA0E35754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850129, "uuid": "ae282ed2-0c2d-42f6-bfba-7624d07c57ca", "value": "49152:/y/ztZBVYnQDht7uxXi6G6TqHgrFS6rBEqhkscQJ71dOuYJpLM5EX:6/DIxS6G6TqHgdSe1dOuYJpLeEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850129, "uuid": "b49c6929-df6d-4e88-81b4-9dc97c3ebde7", "value": 7209144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850129, "uuid": "65537c86-05ae-4885-baca-c47c84bb754f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850129, "uuid": "fbec76f8-7fed-4c64-82bd-b217d581ac5c", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46eb5cf-6ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781849513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849513, "uuid": "45acf2ed-9c27-4122-91c0-f067073963a9", "comment": "Malware payload (Mirai)", "value": "88c6415fd18dc114b406b43ca797325d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849513, "uuid": "069b1be1-c5e1-4444-8f46-82ca032fe805", "comment": "Malware payload (Mirai)", "value": "ecd77437663c82b46b518c398a5dbe2c41c132822aa1d1a6c0fa8b3a94e32707", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849513, "uuid": "f3a25f24-936c-4b9e-abf6-78dc40215ac5", "comment": "Malware payload (Mirai)", "value": "3c28097f13296b511c66754896f28976b97a32e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781849513, "uuid": "58764eb8-40f9-4423-b826-678f9d627a6a", "comment": "Malware payload (Mirai)", "value": "c245808ff593cb97d2a5a66ecbb6beef80e074ad1fc3e00cc17b3fe3cef299784104f7f32dab82588bae16b0d344ad1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849513, "uuid": "ab280fe9-36f0-4789-a55d-bcaa6d09babd", "value": "T15713E1F71E150A7AEF358075C35643C01E5507D5FE80CD89BA66E76BDC81468F842AF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849513, "uuid": "93ab8d04-a4c3-4d4e-9317-bc0eaa22e2f5", "value": "768:chEJMwCMCeigoftQtC1xnq9l//EMihqQfGjDPHjuHEUWPwDtJgGlzDpbuR1J+:cL2CXgvKqfrihReXbCHWIbVJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781849513, "uuid": "f64fa847-92b0-4b7a-8f84-b1109dfb6d39", "value": 43284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781849513, "uuid": "3d3ff51f-b0e4-4feb-add4-25e0c6b7902d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781849513, "uuid": "04be96cc-6e89-4b5b-a494-7e5e0215c5f5", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47204f83-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886239, "uuid": "e2702a6d-5b52-4ca8-a13c-1110787415af", "comment": "Malware payload (Mirai)", "value": "3407e24b9242573ca475b0a9138fc0d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886239, "uuid": "0472d22d-fd28-40cd-ab45-1c85abdbeeb8", "comment": "Malware payload (Mirai)", "value": "edac8dfbdb2a42d88bac0839bf486d2d4da5d42dafb291ea9ae528748375ca75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886239, "uuid": "bd8b24d0-fb81-4ea9-9f9e-2c975290a77d", "comment": "Malware payload (Mirai)", "value": "2b1ca3c16e4535c61c0b07d30a3321670106e073", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886239, "uuid": "a2f8c429-4687-44b2-b257-1f18f5cd4c8f", "comment": "Malware payload (Mirai)", "value": "dda6ee592f579a320742b49ea2f6820d580d0b0795c7ebe74a95956778f2b0c0c82cc94357cfd1cc0544dd162ebdd46c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886239, "uuid": "d904fb0f-8bed-4ebb-aff3-38dde8fc4950", "value": "T17A357D2AF2B3B0BCD017C03053AFDBA2A835F47912216D7B35C496352D66DA01B69F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886239, "uuid": "44f8b8fc-de2d-4655-82c1-5dd11abad03e", "value": "12288:Z39v0uT0xHYTnCFVzuQrZW59EnMt8FPtz0myI/pUxi5k:Z310uT0x4nCFVqQrqCMt83RpUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886239, "uuid": "153efeef-0f11-491e-8ee8-57a6dec248d9", "value": 1070064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886239, "uuid": "621c5085-0574-4f1e-be23-302212c87b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886239, "uuid": "fb063eb7-80db-4a70-9ccc-8f7a65de014d", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0350b86-6beb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781879517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879517, "uuid": "5184ef46-d23e-4b68-81e2-0f0ad419a8be", "comment": "Malware payload", "value": "6659d6a07da4da8aa4cd05d8d77b53e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879517, "uuid": "7c0befd2-52f4-4f6d-b107-f929e999d809", "comment": "Malware payload", "value": "edd35626966fe4ce79579fa06d19d8fff16424ef760693ca33e5c79684927ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879517, "uuid": "e5eb8454-3871-496a-9c28-7b73c8bd0784", "comment": "Malware payload", "value": "369b07938cbe14699cfef1d4e69a3334a4609442", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879517, "uuid": "48708444-8a53-46d1-952f-8e2ddbcc676e", "comment": "Malware payload", "value": "e76a7d3f240e558b0faa95129fa1eb96973a644df43ba16a3b20a1766eefe453e9235eb0d0c537fe78a259f3b3ab44bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879517, "uuid": "da51ac15-9487-49ee-90a0-bd9caba94665", "value": "T1FB1523E05A228185ECE35826BDEE5150A3F173F13E5CFA261021BD782A74BD6C70B49B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879517, "uuid": "61ec01d7-9f79-44e3-baf6-4a58c68b3679", "value": "24576:5IrSo8lbGgoJWdBfZlTp8hz5bWTLIKV6x4WjyBgZbC:5IrLqbSJM5ZlShz5uIKVGvjyAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879517, "uuid": "79c4dc9a-c9fa-441e-990a-2edbf99fed67", "value": 913807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879517, "uuid": "76040711-204a-4670-9e5a-a921ddb527b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879517, "uuid": "1a477cef-2f93-4d4a-b1d3-a48a4e1b0090", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48447081-6bfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886241, "uuid": "1cb82a58-c8d4-44c3-aeda-cdcaa4db9c8e", "comment": "Malware payload (Mirai)", "value": "ee157525a6149e24d6278c175f564525", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886241, "uuid": "2a8f1d16-43b5-4a2c-90e6-a09dd0639b16", "comment": "Malware payload (Mirai)", "value": "ee0bfc8731740273dd4dc6acb156df17c9494bf0baaabe264cda56c017f07bc5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886241, "uuid": "87a7f184-9453-447c-abc6-6a9f406d1a19", "comment": "Malware payload (Mirai)", "value": "f93c8f75e2bce7699f3797e9419aba019719bfcb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886241, "uuid": "51945e19-1c7a-4a07-84b2-9529172eccc5", "comment": "Malware payload (Mirai)", "value": "d8733f2026d5726056eefca3d878a05f1fbe2aafdd0ef2587416d9f70b6268821f601d6990cd7a716e3023ac3079d564", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886241, "uuid": "39ecc910-04b5-4efa-b3e1-67b094d3b3eb", "value": "T1F4934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886241, "uuid": "5a8b30cb-144a-41d1-a1db-0d2359a64f71", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINAS:XGptyz+VJzB7T9/bLUAx9e/SBJOAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886241, "uuid": "fa698f35-aa70-437b-a3ce-13bda04e0bf8", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886241, "uuid": "950f7ffa-2adf-42c0-9a82-e04f9a52098d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886241, "uuid": "87aef6ae-45d3-41a3-a7f5-59aed6aaa9b7", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2855658-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886903, "uuid": "7ea11110-3de3-431d-a2bc-4aadd5646343", "comment": "Malware payload (Mirai)", "value": "9f1bc65c906e5154ba1c01fd4b6a12b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886903, "uuid": "88ee9d8a-c65f-4d2c-a7d9-9df3c0277f63", "comment": "Malware payload (Mirai)", "value": "ee5e70bbdc61b4d88e790ddd50f088819042262c02d0616b04557d8d820861d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886903, "uuid": "f884990d-2133-49da-9534-f91b3e5a914b", "comment": "Malware payload (Mirai)", "value": "3ede13ac3c59d17972b084136d70f0a846b35194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886903, "uuid": "71d99968-169e-48a4-b43b-4cf428bd59fb", "comment": "Malware payload (Mirai)", "value": "4a5d725324b7dd189c823cd9a7d74f0a90db373768fd7cd43dc4283eed494dd03f0169385b26b0a2bf89d40c3883acec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886903, "uuid": "ef8597ac-1e10-4d71-ab4c-a4dbb0dab616", "value": "T12124A85E6E328F7EF2A8C73447B74A24976D63D627E1D684E1ACC1101F2025E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886903, "uuid": "4f5fc5b4-b1ab-4a1f-b6b0-1f7033e835fa", "value": "3072:xc1U+vET0HAe3RNPYGFFTZUm3SwBwaB3tZlvxr:xx+vAUAevzD9viw1htZJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886903, "uuid": "6c5e8d71-7781-4d20-abfb-36f78b06aa86", "value": 227680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886903, "uuid": "e407a4eb-d31c-4ea5-8cce-7af228c21130", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886903, "uuid": "c0d8c8ef-90aa-497c-a647-9ee442c3d54d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31d80c2-6bac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781852517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852517, "uuid": "d80a0f38-f002-4b5f-9cc2-6ac16e729e38", "comment": "Malware payload (Mirai)", "value": "33fbe33f82f7522868674e8c1aed5056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852517, "uuid": "0b6ea546-ce74-4a0e-8499-b20a86b6d0eb", "comment": "Malware payload (Mirai)", "value": "ef1a862d272d231ea8f68225fae205b9af64478f0b3e67bfb9c7511a20bae57b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852517, "uuid": "597efeb9-1bdc-4fa4-a383-afe5dba93a36", "comment": "Malware payload (Mirai)", "value": "7bacac37cd81f3abf2c42998deab597e8d040655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781852517, "uuid": "df2abcae-cdbd-4cf0-9cee-775c3675424e", "comment": "Malware payload (Mirai)", "value": "ed3d87c093d6241e85117e6e2a2cf34b1d5e629e7ca4334b61e6220b89fc81be680d09ce3cb5777d0736b88346bb073b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852517, "uuid": "be0e817b-42db-413f-a402-c4ecbfd11525", "value": "T132432985F8C2996EC6D013BAA72F358E33A1B3E4D1CA3613CCA45B2573856CF1D66B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852517, "uuid": "bb4ae4bc-686f-4d69-9a83-0f4dceeaef78", "value": "1536:spuEPqH2NM5CqELONMNLoQHzpJ7bPcYSH:23yH2NM5TMa0p9PMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781852517, "uuid": "61e0ae02-55e3-4ec8-bedf-4e5fe148fb5f", "value": 55816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781852517, "uuid": "3b73448a-83e5-4986-9404-eeb9db48584a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781852517, "uuid": "250f2a7e-f6f5-434e-bfd7-9edb729a767a", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdcebd5-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781881315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881315, "uuid": "52ca17c6-35ec-4719-8223-94d6a962089b", "comment": "Malware payload (Mirai)", "value": "01511ae6cc461ca7b18f3a0b97e65c4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881315, "uuid": "6f09d437-c26e-4e62-ad2f-c1cf3d1351dc", "comment": "Malware payload (Mirai)", "value": "f020cf06de2f06ebb2e9e351b0954fe9eb8a4f592eff69e474b6921f59292e41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881315, "uuid": "91c9e30b-eb43-48e7-90d8-1c3f51aadb70", "comment": "Malware payload (Mirai)", "value": "cadac767ebb9d88c7713dc5d4ee5f35e452e377e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881315, "uuid": "40efc556-9461-400f-abaf-812c6f16c3d1", "comment": "Malware payload (Mirai)", "value": "6a08661b22a75f52f2d4d4bec54107cac4293091252d6e09555253d00246b843931313a023f50e0cfab8b07bbcf7f25f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881315, "uuid": "c546bfa8-fc8d-4dd9-8254-cf23a5d004d9", "value": "T1E1B30945F8509B13C6C652BBFB4E438D7B2A175CD3EE320399296F25378B96B0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881315, "uuid": "9c63f365-910d-48be-9dc6-584e3e06271a", "value": "1536:gvH557OuvV38GAgzv4VW0BwTHQYk0yO6fhYqf918lGtwywgSlOgpi6IsMFGBvhgA:mD7pvh8Gj4bOrQPZDlAAigJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881315, "uuid": "9a339950-6d9b-4944-ad14-eaba18d2c27d", "value": 117536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881315, "uuid": "09278007-2276-45e9-ade6-29934d7dd1bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881315, "uuid": "30c4b6a5-1722-4267-b4a7-b4daf4b8714c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d3f69b-6c39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781913047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913047, "uuid": "c5bc3160-6326-431e-aabb-d17133e4abdd", "comment": "Malware payload (Mirai)", "value": "86866895daef3ce579803fc4f7810aa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913047, "uuid": "36c32c4f-a119-4d9e-b5e6-fa9823b76d87", "comment": "Malware payload (Mirai)", "value": "f0a7a6a254c98aedbdb37238da29fcab946a12bdbaf11063998cc0a19adeff6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913047, "uuid": "47cbbb50-20c5-4894-9059-c96496f898f3", "comment": "Malware payload (Mirai)", "value": "7e98fbc792fa426ab65e8ff3b4d99f533603d3e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781913047, "uuid": "181f86b7-d28b-43e6-94bc-93357783171d", "comment": "Malware payload (Mirai)", "value": "39cb16b166190ea4523040acce136e8c764915babb2b5b8515eeeb5be01decd5faf0c3ae1437d40aed788681b9a6bb0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913047, "uuid": "f9480080-d019-49cd-a9f8-461ce6587119", "value": "T1A5F3E80ABF610FF7E86BDD7706E90B0128CCB95B25A53B797534E818B50A18B49D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913047, "uuid": "c4a4bbef-ebd5-46fa-84e7-06e86d87ee66", "value": "3072:CbKBCQsSBY2cvQZCyox0PTTCeiY90nG5Qg:CbqCI6QZLoxkye+G5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781913047, "uuid": "7f581eb2-a487-4ff3-be8a-f6e7f35ceff8", "value": 166044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781913047, "uuid": "43d49b28-dc00-4ee8-9c36-31c7990ccc40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781913047, "uuid": "1234f4da-e8c2-4620-911c-e4077390283f", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03d3efa-6bb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781854230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781854230, "uuid": "71bc43b2-c221-48b5-a3d7-a6c507fc969a", "comment": "Malware payload (Prometei)", "value": "d436311605df7041ef2c8573af9eeb07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781854230, "uuid": "bdcb9c56-6506-4849-97f2-8fe472b37aa3", "comment": "Malware payload (Prometei)", "value": "f14e4ac24198de5beb7acc0337c1f6e1c70a390d8f9805d4d0e0b91f9f175404", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781854230, "uuid": "34edb6eb-e6a4-43c0-8883-e99252503b4c", "comment": "Malware payload (Prometei)", "value": "4e533f3d1edffb618d843a79217ae3d7acdfa7ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781854230, "uuid": "716310e4-d6dc-4f62-b5e1-d97834b2fde2", "comment": "Malware payload (Prometei)", "value": "18d760e5c510b09721fed27a397f0f1ca87dfab8a2063095611291711ffc5e5e3b8f5dbba47a562eb17950844a636da7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781854230, "uuid": "91f4158a-64ee-4ef4-b093-5f173f394b1c", "value": "T1DF27CE77814338E9E5A98DB4D41025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781854230, "uuid": "827bbbb4-8c49-4b16-91a8-c36dd1989327", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQM:cqYUQuVDt0TZEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781854230, "uuid": "cb1f9514-aff5-490f-8285-4c2a4c96b883", "value": 20938752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781854230, "uuid": "820d41bc-9a3f-4198-ac44-a41ad22b3bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781854230, "uuid": "78b42b39-d096-4c28-89aa-3d32822d0a91", "value": "f14e4ac24198de5beb7acc0337c1f6e1c70a390d8f9805d4d0e0b91f9f175404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2657a14e-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883607, "uuid": "4423624c-845c-4430-b111-2cc8d6e1ab9a", "comment": "Malware payload (Mirai)", "value": "176d1ec545dd40746ab7cfce9980f5c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883607, "uuid": "e318ff34-8529-48d2-965f-89b9294876c4", "comment": "Malware payload (Mirai)", "value": "f1b2e661f4de21e02980d74eced1318d2d47c445afcb6c2107ab7ad74a0d0ee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883607, "uuid": "51908430-3eab-4796-a7c6-01fd9d80a024", "comment": "Malware payload (Mirai)", "value": "62f69eae85192b261fdbc17b506808cb935541f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883607, "uuid": "c83bb5a4-27db-4b6f-a60d-70be859d00a9", "comment": "Malware payload (Mirai)", "value": "b75064e441e9512863f80c7f5f1d58749749dda3226aef4eab548ceb58e4750b15ded61b7c1a8e91ca19951d3dce6879", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883607, "uuid": "4d5d6e73-a832-435d-90de-c0e06ff30a68", "value": "T13AA36B41F683DCF6D84208B01477E77A5631D8B90035EE87F7986F3EAC66621D90A7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883607, "uuid": "c875b5f7-883f-491d-9b99-3bf57c5a10ef", "value": "1536:RqX3BUi4XTrlbC0AT+Qk/4DhC6q8hshqhfzxGzbulrwGGMu5YpLm75Z6UzGZZ5Aj:RqHBMTrDs+/4XqKxMuQ5emb6EGDjl7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883607, "uuid": "a3e767a0-646a-4c99-8e49-7b522623d7ad", "value": 99624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883607, "uuid": "5809150c-d770-4db9-93cc-3ae501a54728", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883607, "uuid": "b595ac71-7fa1-40b5-9306-104e51ab79ae", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3e6fc9-6c38-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781912743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781912743, "uuid": "b60e210b-2c3c-4a26-afaf-c74eeab33610", "comment": "Malware payload (Mirai)", "value": "71c42fbd8f621844158139b8fcdbd332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781912743, "uuid": "224485cf-dfd8-4ad1-aa78-b0c72cba2867", "comment": "Malware payload (Mirai)", "value": "f1fdd1c043d06d52ff2741f164db74c56acc71521470412608c42e90ff60f66b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781912743, "uuid": "fc4ee6b1-937f-4d75-b333-f8d38dd0cceb", "comment": "Malware payload (Mirai)", "value": "bdb6751d4b0d36720c47f8cc45774f521ef73454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781912743, "uuid": "63f62576-29c9-46a2-81f4-e3bf2d99dc24", "comment": "Malware payload (Mirai)", "value": "7fcb4ecc29ca73150364fccff2e08da23fec4c46d33248c33cce4bd2c464284c7a02f067578fbc8430280e6d2519c954", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781912743, "uuid": "c55bbc05-40c4-4461-864c-60ca44cb843c", "value": "T19B246C02731C0947D1672DB02A3F27E0D3EFA9A125F4F644655FAB8E9272D361485ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781912743, "uuid": "5c1b5985-099e-4946-8502-b2d27c63f03b", "value": "3072:ve+RIX6t9oyMLB9jWwyPAd6B5WxV0m2xpSArvWl8RCM0HH:RqNdWgX2xpSArve8E3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781912743, "uuid": "b25ba530-8ec7-4b98-9c84-911ecaeab528", "value": 214704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781912743, "uuid": "47db10f0-df2e-493c-bb19-632dacb6e942", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781912743, "uuid": "135f7e18-86fd-4e8d-84c9-f56cfe2b5d1b", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3706888f-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781875905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875905, "uuid": "02d86b26-f006-43e3-af23-5ebbb2d599bf", "comment": "Malware payload (Mirai)", "value": "663fe2925980146ac0bb9bf348fc6635", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875905, "uuid": "bd540741-a54c-42be-a6be-cbb12116b88b", "comment": "Malware payload (Mirai)", "value": "f252c6c435904361a76d62a1e678ad7e9ef7ffd491914c1bc0ee160f5d608c5f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875905, "uuid": "37353286-bf98-4a89-92ef-c01042bf55eb", "comment": "Malware payload (Mirai)", "value": "3791a84f4287ab94d22eac29dd2ae9bd296c33e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875905, "uuid": "47792ec9-ef89-4248-acdd-bfacc6db4bc7", "comment": "Malware payload (Mirai)", "value": "82662ee9e332f3a8bbf1294033b97c77dd8af4521dd84c282b9d10e26f8b4d36c27de515f9c3629a4ad887616e59b974", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875905, "uuid": "e75ef268-e666-4134-af8c-28abedab10bf", "value": "T1A051D5CA15A106F52C637A6BF9BE4FCC768A90917CE1BD04D7CC34A1929CE5434D0AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875905, "uuid": "2bc967c1-4ccd-4abe-9b96-9488f7dd1ad8", "value": "48:inlcDlVDSelGgb9lRl3lylulJQ+l2lrlNlDlFKC:inlSlll59lRl3lylulJQ+l2lrlNlDlFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875905, "uuid": "db970a6d-88c9-4c11-ad3d-0368cd4ce60a", "value": 2667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875905, "uuid": "d1882925-8f36-46ad-8420-a7e09752250a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875905, "uuid": "d2790bfa-9b88-4646-8664-5f70a146f4a7", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4e73d3-6ba7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781850118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850118, "uuid": "95c39ced-77bd-46cc-8e65-92b8c6d0304a", "comment": "Malware payload (Mirai)", "value": "8d9c88e1ad42fb89f6255eb2a982e468", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850118, "uuid": "d7e61bd4-d1e7-4a5b-a24e-3fdb596e99a6", "comment": "Malware payload (Mirai)", "value": "f253a4f1afdd89847bbe27defbc46043d73391d1d624752d457505489b5e3f05", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850118, "uuid": "2212b40c-768c-4091-b9e9-25955d4de514", "comment": "Malware payload (Mirai)", "value": "1ce600527b437250c68f479fbbf0a3f96413626b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781850118, "uuid": "4aa24e26-fafe-45d6-9569-cf73689471ec", "comment": "Malware payload (Mirai)", "value": "73347c5deddfbd2d7e65792b7db279a2a8c15cfe662dadfe19a628ea9bb0a7af125cd98f848223d20e6c0f4fdc77ad0d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850118, "uuid": "d110d8ee-0128-478a-9670-d393d3028e73", "value": "T13B31D3C7921157306EF6DDAA71A78C44B9D9B05BEDC29B0484D838FD845CF0A7F48A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850118, "uuid": "8f215a08-fd82-4336-8f97-1bd3febaf87a", "value": "24:vyRudRuW/OSyRkmRk7IOSyRSbRduoOSyRbcRNOSyRNRPjOSyR8bRnOSyRLRTOSyV:v5GW/RQRd5RzR6jRhRERCRTR2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781850118, "uuid": "15f7f266-b536-4400-a6b2-40012d4f932e", "value": 1781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781850118, "uuid": "96cbcd4b-321d-4e61-95cd-6cbc3213c4ca", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781850118, "uuid": "74947af1-674d-4741-b05d-486225f7c569", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223fbed3-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883601, "uuid": "42f4800e-83d8-411c-85e4-e75f2e275b87", "comment": "Malware payload (Mirai)", "value": "61178aa6136264026da7e65c406ec0c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883601, "uuid": "d5582f4f-2929-40ee-b7c6-2bcc0a03ebcd", "comment": "Malware payload (Mirai)", "value": "f686eb834b18fcd94e122d79edb68d1590db6d2091ecdc90e6369622fd4dd9e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883601, "uuid": "11feeff7-84f9-461d-835d-6b34711da9f6", "comment": "Malware payload (Mirai)", "value": "f7da777517072b04b1d79a42d247658285b4535b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883601, "uuid": "abb476a8-3f06-44de-8b15-eca4cf8caef7", "comment": "Malware payload (Mirai)", "value": "49f9ed163c8ee168132c0c5267d3c1a18196633d80a82811ce3c3661e5de624d2b482a174bdf1b6b5569b0cdaf7b39f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883601, "uuid": "6305a73e-c6d1-4593-a2e3-722d7385e23c", "value": "T113344A1AFBCC5EDBC18243398EAA57312337F4A85B0693573A19937D6DDEB9C8DA1040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883601, "uuid": "1a259e9d-9699-43f9-b34d-076d30008964", "value": "3072:ckxDYrwuCRRfZhaWENRTZeFW0Pagl70qkk+Drvvm8MqNe9:dxErNCRAhNRTZeA0yJqk5vvm8MqNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883601, "uuid": "8cf6877e-84b3-4f46-9a64-ea1588d0b467", "value": 235024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883601, "uuid": "c1eaf3d1-0b4e-41dd-beee-89fc5ebb0b30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883601, "uuid": "8c594e7b-a53f-4f07-8e4f-214e6d623c65", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b32ae4e-6be3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781875912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875912, "uuid": "2a971d42-a63b-48ec-b08c-726b3cd91b75", "comment": "Malware payload", "value": "7fab85b3c1a27d6ad657abae29ccdd49", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "uac-bypass", "colour": "#2B0447", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875912, "uuid": "03882905-dcdd-45c2-a5c8-59917c7e2fc4", "comment": "Malware payload", "value": "f6d71d70f12d52503c39dbbcf070615c722ca5bb925368c05cb141cb8a315ebf", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "uac-bypass", "colour": "#2B0447", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875912, "uuid": "065f2919-db8c-424f-b69c-b3b3bc33ac27", "comment": "Malware payload", "value": "8018670d90a4e09d8c267e2c46f0cb6c996729d4", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "uac-bypass", "colour": "#2B0447", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781875912, "uuid": "9daf23a2-84aa-49c0-b509-5bd500ed0908", "comment": "Malware payload", "value": "563039cb5a32f8a391d0a3f72dd1f875333a13e6e5ebe2502e0344a4d0d9291e14224003cc6200512eb90f3baa554953", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "uac-bypass", "colour": "#2B0447", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "Whatsapp", "colour": "#639D48", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875912, "uuid": "e87f5835-7a91-4979-84d1-83f541472272", "value": "T1F2F1C81A2917E1B080B367916CD3E81DF9904A339A21786D7DCCA7D44F34B7DB6C518D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875912, "uuid": "00c07fde-f021-45d0-952b-6111b2e9aa61", "value": "192:iWjLrfFZrsY4pqit7lIFka8NYvDcb/E/c7Bpe:vnF6MmNY4hre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781875912, "uuid": "ccf41e7b-d8ff-4977-b479-6fbed95e2ade", "value": 8009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781875912, "uuid": "40b6c0c6-68cc-4dda-b79e-f7f00dde62b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781875912, "uuid": "0530af3a-2c7b-4f59-b61c-bbbcd7d515a8", "value": "demonstra\u00e7\u00f5es cont\u00e1beis.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bf2dfc-6bb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781856177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781856177, "uuid": "c7fd8596-e6b2-4c28-bb9f-1c7874bfec19", "comment": "Malware payload (Formbook)", "value": "813cd9515973ca72ca7106d474beabda", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781856177, "uuid": "8a1c1801-9fe4-48ce-8d9b-5cec5b33e307", "comment": "Malware payload (Formbook)", "value": "f7accd662f00c8cfc4be386e7a876bf72de4292dbb55e9dd88343df7a20375c8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781856177, "uuid": "298fe6ba-fa1e-400f-8888-c521caea2d24", "comment": "Malware payload (Formbook)", "value": "4d8deb0a7ea66fe25ac82246d7b50f7857a5f16d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781856177, "uuid": "df18c9d2-d875-4f91-ba34-d91f0fa8f1b6", "comment": "Malware payload (Formbook)", "value": "304b618484c02a755c8c234363583a7e8747367a7022221835524b9b7946d5d70091b6db30064766b5769d2e63d87435", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781856177, "uuid": "820cfe9f-d391-4214-a5dd-2013bdcd1d69", "value": "T12295020149C46FB4DF9E5B2990FE2A4AE3E00ACB6416758AE733BD46EFF760051171B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781856177, "uuid": "cd938a67-faec-4cea-880a-447f508e3414", "value": "24576:MhtRkLKNkhUU0/oV3DxeV6B1mTG5WM/nPTHBdt0oTPVwSXQDU5+I:TXVCmMqqMlgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781856177, "uuid": "4eefbdac-52ec-43fc-a5bb-f04a3794af40", "value": 1995931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781856177, "uuid": "41342edb-c259-4802-a7b6-fe6f2a69e51c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781856177, "uuid": "0895f964-0ec6-4f6f-979f-33d3498a5565", "value": "Statement_of_Accountpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27539502-6bf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781883609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883609, "uuid": "6ff562f1-f6fe-4e54-b675-d39506fa6d3f", "comment": "Malware payload (Mirai)", "value": "a77eb740a3c701d908446ba56f57657f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883609, "uuid": "326c5972-f403-40b3-b89b-8cc11a2f9601", "comment": "Malware payload (Mirai)", "value": "f83bd5cf65fe7405e6f827d33a29841d7a84865750734e2e507d1850152ade6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883609, "uuid": "d6d61a60-6b83-4b59-b421-620c9d0295bf", "comment": "Malware payload (Mirai)", "value": "2b2c30d016ae0a7d25d9c758a2bd2a9bd99fed88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781883609, "uuid": "43207a1c-de3e-4b29-9ad8-f12d211b0b7c", "comment": "Malware payload (Mirai)", "value": "89d85367da366ec56ca155db9711d12a1c86b63cd66ce2d8b802fad4acfdb372e7629974e4466d83af0dc07793ffc01d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883609, "uuid": "c997cf3a-de0d-4d03-acff-4c7731287c64", "value": "T1F2A3BE57F86A2E44D151A5F0A4F5DE7587439C6091834FBA36A2C3BE8083D4CF24A7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883609, "uuid": "8b4a5b4c-97d5-4939-9ab3-1781dc09e069", "value": "3072:acoIpeTfQX0M8Un4CKjhZG77CLDV/gUxlq:aXPvE2pgU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781883609, "uuid": "c97bb11c-a5a1-4b3b-97b5-a90c9fcf40c6", "value": 99896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781883609, "uuid": "8de3a1cd-3fba-46b0-a57a-24daf532ea47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781883609, "uuid": "230ff420-cd6e-475d-a11e-7b8a70099f16", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe48578-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781886838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886838, "uuid": "8689c8a6-486d-411e-b704-432635a6d548", "comment": "Malware payload", "value": "e8d8620f47ea5ac95110d67d930e9408", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886838, "uuid": "bbefe216-7644-47a1-bf3a-2d6f72e27c03", "comment": "Malware payload", "value": "f8c26da7826d224041e770b42926c2f5295a82316ca359f62e6433ed81046c51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886838, "uuid": "15d2548e-2455-4b71-9c8d-51f129fd944c", "comment": "Malware payload", "value": "25d361e5188a48833f29d866b52cecacdf2e440b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886838, "uuid": "6a3e65dd-f58b-4329-b44c-2fcfcfed7e0a", "comment": "Malware payload", "value": "d1ea20065ab5fdbde8f58c22d85e40eb2bb946e571c43e0ac7348d7edbdd10130357d168d32cb42154fb4a99a861314b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886838, "uuid": "f2b2d4f1-6f89-49e3-8f1d-a68d6f5382e2", "value": "T1E321EA2797206EB7CC0786B4497593A9D675E8BCC376F603AF112D432E0B4C5AC9BC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886838, "uuid": "9e2937ea-22bf-410d-81a1-154a6720198f", "value": "24:GJ/MkQ+LG4H7n9lgm8lZ195+Ip3R29N/c:GK1IzgtkIW9Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886838, "uuid": "ffbbbed3-a3d5-43d4-bf4e-316037b04c62", "value": 1352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886838, "uuid": "95bcdb19-cd53-4e5b-a107-c3aae63f6ae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886838, "uuid": "67f67db0-ffc8-4606-aeaa-e68534b6e694", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81655ae6-6bbd-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781859708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859708, "uuid": "10a96621-625e-433b-8c53-3067d1210104", "comment": "Malware payload (SilentNet)", "value": "24c92abbf534b78aab60850fca00adea", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859708, "uuid": "34630bf9-24b4-4068-a8d0-49763834b4d0", "comment": "Malware payload (SilentNet)", "value": "f903de8d931dc1d79ca65dfefc5efd7bfffe947a06ecb71c780dc32791b3edab", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859708, "uuid": "fe5e918b-be81-4aa7-a0cd-47cc2d7a0add", "comment": "Malware payload (SilentNet)", "value": "3a058208173ce9661466625f9ba23e7e6b6c2298", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781859708, "uuid": "825836f2-89ca-4da3-bcc1-770b23afd180", "comment": "Malware payload (SilentNet)", "value": "a8da598333669f543fe79af8652ed8c057b50c55be0169ee70dd86a234a325eec80da2ebd6324bae637ba59665f74396", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859708, "uuid": "6a06ac93-ee95-47ac-8ea4-d98c4f90a68b", "value": "T140C52313A05DF87CDDBA963AF235CF62583426B4914B723E2B3806D92CDA4EB474934D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859708, "uuid": "e4125f02-d243-4d9f-a8f1-7f6f544f7004", "value": "49152:DAie5Ok5kFEe2wFjmUfocupJUlcd3QnWOyEoqqmznaZ8vvqdssSji5d:kiegkKEg4pdgWOTJzndvqdsf+5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781859708, "uuid": "01c2e6cc-3866-4284-8e29-6ede0582820f", "value": 2512359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781859708, "uuid": "bc8dcaf4-e2ac-4582-b921-93a1271e6cb2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781859708, "uuid": "320b1b65-c873-45ce-a011-870d1ac104fd", "value": "kryptonclient-5.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfe2f20-6beb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781879324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879324, "uuid": "84383b34-5366-46de-a2c2-d3ff39fefafe", "comment": "Malware payload", "value": "43f79861ef364c9d8b5f71e70ff3881d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879324, "uuid": "301d7faa-df41-43ed-8b6c-1857fb19b92f", "comment": "Malware payload", "value": "f95f6e35d428da4ac22d77bef6b138828daf6b13871ee8af7f0be6034f590dcd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879324, "uuid": "beab6635-e46b-4f0a-a189-53d10a8b7701", "comment": "Malware payload", "value": "f682752b3c7fd95f19181f7f3176c80603eb86ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879324, "uuid": "944a56b8-5195-43d9-9396-84a85cde8bd1", "comment": "Malware payload", "value": "2c0c7d7484a11ca7781c3e6b42aeacc1b5133c4b766b6d73c63c8319880d3bd9db5c64b626eec5fd2ff6269f0246ce75", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879324, "uuid": "d1260d53-eabc-4240-813c-633f3a0dedf8", "value": "T1E296275303851BBDF69D0EC9C94B245B20F2D8677D251298EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879324, "uuid": "a69f4c5c-488a-4922-8ecb-a43712356ce7", "value": "1536:wwRMR1OZ4HeyVogYYvM9EI9Gqn7J3cjBxITKczIBG8JIkwrCUeEEvoCfguYDm8AD:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879324, "uuid": "3beaf4d9-cd2a-4d0c-9bec-335f928f5787", "value": 8968685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879324, "uuid": "0b0517b1-9baa-4664-ad2b-454987bcfa64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879324, "uuid": "df606c09-d19a-4146-9167-3187360df307", "value": "hold.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b981a40-6baf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781853552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853552, "uuid": "fbb70f2a-e120-4080-8b08-9f5601859ccd", "comment": "Malware payload (Mirai)", "value": "44e867c659e2227852186eccc663928f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853552, "uuid": "9748d7ab-5046-465a-88cb-215922869bb9", "comment": "Malware payload (Mirai)", "value": "fa52d0a6ddbdbaeea5174431c0e49df8d37df82b3518f29d687295fcbcbfa58e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853552, "uuid": "e24540d4-3527-4ecb-9950-907874d712a7", "comment": "Malware payload (Mirai)", "value": "5e5bc342d172e0fa82b0bdb74f7a19d3d3815c74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853552, "uuid": "56846b5f-b3f5-4c59-bc21-5d329d8ba3f9", "comment": "Malware payload (Mirai)", "value": "4eb65ffc1742a723a456274781bd36b6a93e642fdba7661d573e1c8d780ccc70b7b3b440f71e3b6005ae530266cc30d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853552, "uuid": "7abb59ae-d940-4407-abab-736c78c5c2ca", "value": "T15FA312A83E1EFA74DB76172EC9DA790E7661E090560FB20739C00078BA5FD4E8FA1645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853552, "uuid": "ada3a1bd-1379-4bd9-8168-93daeb2faeb4", "value": "3072:fDBCnSgM47iiKwVaUb9rnVrL5bXqVG/OAj6:7onDM4mi5ow9rnJL1XxVj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853552, "uuid": "d1a210e2-0b6d-4199-8190-979f3114919c", "value": 105260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853552, "uuid": "cad4f885-cd46-4873-a2f5-610d1db311cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853552, "uuid": "72f2849c-682e-4b70-a954-1b8b061cc23c", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4b41dd-6baf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781853876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853876, "uuid": "ee41a44c-7138-4339-9367-34b023f29f92", "comment": "Malware payload (Mirai)", "value": "259d024189d6e80ea41a8f9a292ae427", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853876, "uuid": "c690a8c1-8fc3-4427-869a-cdaca177dba8", "comment": "Malware payload (Mirai)", "value": "fb372d7468fbe9c1f904f70b71a3c51cf0fc68d4d4e3e0fc247a0532f3e1d4c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853876, "uuid": "54499f30-a3fa-42d8-bc4a-ea0bfc3b2b5b", "comment": "Malware payload (Mirai)", "value": "51dcb0af968a1f088d1bd0f77d0011242ab25675", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781853876, "uuid": "b32e0029-1ecc-4609-bd69-aecf139024eb", "comment": "Malware payload (Mirai)", "value": "4511d6fa1ad256ef4538d4ace800c9bbcec3cf3e74a92c66ddaccd90a56f6bdc7cc4bf8e77d8c31164a61bfe74815ef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853876, "uuid": "f72f1c2f-d831-4f5b-b903-01f9c7177f1a", "value": "T1D0E44A46F8809F62C6D036BAF75D42A873074B79D3EB72069A155B3137DB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853876, "uuid": "d797274d-c623-4893-a951-b9d542300ca3", "value": "12288:Zey0UB6qiclp8mZdVtbLmo4HH7eWJ/Svq1RfF7m0Xd6drHqC4NFiX8pEk+Hxj:YnUB68H8mZd/bQHKWpSy1xF7mqdsM+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781853876, "uuid": "8e1e1392-8d6e-436e-9b67-48b1628846fc", "value": 694712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781853876, "uuid": "1a244bef-992e-485f-b99e-526c12b5dc38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781853876, "uuid": "7d6a69e8-6028-48c8-ba6f-1b9b7077ca2d", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33382c27-6beb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781879334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879334, "uuid": "45210413-48d5-4132-ac43-b4a8cd9b1212", "comment": "Malware payload (Mirai)", "value": "57e553cb9b0e2a904a0ceed5ffe0cc62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879334, "uuid": "749c0060-0111-4eec-bd73-2acc65449e21", "comment": "Malware payload (Mirai)", "value": "fb9af9226258a76cec2af985341711c206af901fa878071cc450b739efa64df2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879334, "uuid": "abb5b4c2-694f-4595-a687-ab6bb96d6767", "comment": "Malware payload (Mirai)", "value": "d9adefd47260dd9765b4cd7efb0ce8140297b396", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781879334, "uuid": "f3ee58a2-c98a-42f3-867c-db98b806cae2", "comment": "Malware payload (Mirai)", "value": "f46d1e0163164401afad616576f513911c1da015b8aabbe8afbcd7a37caa6932377407d0da2a306c22193926480116c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879334, "uuid": "a61b6928-037c-44b6-a2f1-5c610262f842", "value": "T13EF3C80A9F910EBBDCAFDD3702A90A1639CCA54722A43B753674D538F54E50F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879334, "uuid": "f719d249-ccb6-416c-991a-5ed9456b15b0", "value": "1536:PZJpbhxOlosQ2P1j2KM7RjhV5Rj6zlWSj5dBnmfbsZ+CEK7Xg+SEL/zRVTqZiIQN:RJsoiP15kRjkd0sFr7SEfRBcSJxEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781879334, "uuid": "4f14c034-cb50-4dcc-9a26-7c8bca3f5fa7", "value": 161220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781879334, "uuid": "0862bee0-e948-47ae-bcc9-be0c8d039d9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781879334, "uuid": "2efceb2d-190e-462d-a062-610651684318", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae376f0a-6bfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781886842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886842, "uuid": "be1f740b-9745-4922-a326-1333a151e145", "comment": "Malware payload (Mirai)", "value": "898c9f7beaea2e053d847bbde3d9b22c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886842, "uuid": "a72e47e7-8dd2-4761-b58a-fa6c8df055bd", "comment": "Malware payload (Mirai)", "value": "fd8e525ed9fcb3c4f65a458a5729a59daa07e49958ca5e0753247d0f15666cdf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886842, "uuid": "d1ac8bb9-74d5-48ae-a656-51a95e89a07f", "comment": "Malware payload (Mirai)", "value": "efd891ca80a9611fe4e8e62c8952e5db3b896222", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781886842, "uuid": "030c1e2a-bdb3-48a7-b2a9-e07506d3179a", "comment": "Malware payload (Mirai)", "value": "9d948871d4e616cc987c397f68e2c3667b4807926a1b8446e8774abf25d14e482e46db0a500cb664efb5d95f6faa5e77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886842, "uuid": "68aae39f-657c-48e9-81ed-8f75feae7a0b", "value": "T1D9334C278A7D1A17C0C0A77E10E74372E4BB9B815098DB5FBD604D8EAB55380367BBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886842, "uuid": "bed06e92-6437-42a9-a71b-d019e01a5240", "value": "1536:Lu5zIGH2yfANBL5gRh4h1IlUP4jtB5kjh:Lu+GH3INN5gT2P4pB5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781886842, "uuid": "35ea4180-502a-4e20-a665-c46905748a9f", "value": 54572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781886842, "uuid": "80298482-fb55-4567-b1b4-bac9c8670e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781886842, "uuid": "7d1e6927-6897-492c-a945-6a93fa15cc23", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3473f5b9-6bef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781881054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881054, "uuid": "e8bb38d6-d399-4a39-9ece-ef76f0610f36", "comment": "Malware payload (Mirai)", "value": "9ef0e14240e287b0750afe45b248571c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881054, "uuid": "da588f10-f0a2-4f95-9973-20aecb2ad431", "comment": "Malware payload (Mirai)", "value": "fdb6e68ef231c812e582393aa08b21651a50f13bf1e816aa172b53de892ce085", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881054, "uuid": "8a7b30e0-d41e-4c20-9898-2e132b18991b", "comment": "Malware payload (Mirai)", "value": "0d5419f613712c2b5f41e805d7429f66896b60ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781881054, "uuid": "ff076ec5-dd7a-4620-84b3-3f9539bdfe11", "comment": "Malware payload (Mirai)", "value": "62c17d63e200b1af8d7f2e5e9dc7c555c70dafadd427987b554607905d71ed26616d37e4803494a7d64b5f298ba5e5c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881054, "uuid": "3f1638a9-a4cf-460e-9cf8-f50710584b26", "value": "T164D37D01FB580553D1D65EB44B3B077AD32C89935CB4F20C290ABB2A27339BB95D7B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881054, "uuid": "72da9792-d5dc-4169-b196-bf46394c0306", "value": "3072:sJvaE4sOc9hz/ayn4DpdUyyyO9/MGnv16u2ci7ocu:7K9hz/X4D/UdpKGnv16u2ci8cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781881054, "uuid": "ad2a99be-eed9-4dce-af49-bae419d93f51", "value": 132412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781881054, "uuid": "f304ada8-4276-4583-aafc-4e88fe59a97e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781881054, "uuid": "e2320aec-c2b6-4678-901e-58001b0263bf", "value": "monero.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca54b4dd-6ba3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781848664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848664, "uuid": "5f4bbe54-ac19-4429-a76e-42b3699ee38a", "comment": "Malware payload", "value": "0c9890fa705d1feeb5f4d0b386ab997c", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848664, "uuid": "483d1385-67d8-4aad-904c-91d01a1abdf2", "comment": "Malware payload", "value": "ffd324d320d85a26ee90af852bd7f38bcc1dfc1c84ebf9c0ac867c2fece84675", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848664, "uuid": "3925a24b-0cfd-4b10-8d52-10478196f812", "comment": "Malware payload", "value": "df3dbf2f09e60b9d793a54a125bb59bf3993c693", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781848664, "uuid": "b6f2a01e-1fcd-4785-98f9-9146d067c099", "comment": "Malware payload", "value": "9c6d2f48736759b27b697894c42371dcfa6009f5b39d11ea84670ae4fb77edfbd09563cf1244798bfe29b06c19d1f111", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848664, "uuid": "bc791bcb-2685-457c-a479-6f7127af58a4", "value": "T15385231A06E8D4AAF57C4772847300E25421BC75C6A502BF36C5BD6E3F336E1B932B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848664, "uuid": "6cc70cfa-a1a0-44c0-ab0d-e491e93785f2", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848664, "uuid": "6e55b532-cf21-4be7-93af-59a6f83fc7bd", "value": "49152:DH5cMAIRo2EuepaZQR9b5Ewl9ZMgNycn0ZDob+tcP:1cjIRND69FvZpNyvZeMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781848664, "uuid": "986ad03c-2a30-4d0f-9ced-a941aa20e18c", "value": 1859584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781848664, "uuid": "9a33dbcc-a537-4791-95a8-cef1e4ea050b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781848664, "uuid": "2a175ba8-8d70-4ed5-80a6-5e84de194204", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb7fad8-6bc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781861927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861927, "uuid": "ab4fe515-6295-4ff1-9932-c787e5cc54ac", "comment": "Malware payload (Mirai)", "value": "11e303d4b7a72b0439b1594c61c77f7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861927, "uuid": "2ce18ebc-b843-4b9f-b196-bd8206b01ef1", "comment": "Malware payload (Mirai)", "value": "ffdcb73668b83722b7386effaab7963708b83e1ec5ed3dae1f8387fc4eef7e09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861927, "uuid": "ba937c6b-a2f5-45ab-90a9-8acdc2f344d3", "comment": "Malware payload (Mirai)", "value": "150467f9d70630f39795c57d98af626a178d9b66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781861927, "uuid": "dbd1151d-1b7a-408d-ad84-0730c6602922", "comment": "Malware payload (Mirai)", "value": "ccf9d1baed5478270fe3b7357e8fc5ba2843f086f2fd4be19533c186662e4810f2357bad5d6a86618f0a3d27b03144fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861927, "uuid": "49c4643a-7222-4cbe-b24b-354b333b5677", "value": "T14E410E6EFF95DFF4DC28773086BA0E66B726D8A60150A35F0D38D6646A090B45C778B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861927, "uuid": "5998a0c3-3a7b-4587-a1c0-a0d19eb37dee", "value": "48:8+T3r7UacCpgGmkSr8yjHq0im40qX8cH/X0siJp5IKpIE9xOg:xb73KM0R40U10siJpiKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781861927, "uuid": "cd5a6dca-384e-461a-b9ae-1244d6809cd3", "value": 2388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781861927, "uuid": "d53c36c5-0415-4484-b497-2bcc2c6d60e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781861927, "uuid": "92cf1658-f8b6-462d-aab4-9e12c2c868c7", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }